diff options
204 files changed, 3871 insertions, 15 deletions
diff --git a/nDPId-test.c b/nDPId-test.c index 528109a2a..a70f9b9dc 100644 --- a/nDPId-test.c +++ b/nDPId-test.c @@ -264,7 +264,9 @@ static void * nDPId_mainloop_thread(void * const arg) reader_threads[0].json_sockfd = mock_pipefds[PIPE_nDPId]; reader_threads[0].json_sock_reconnect = 0; + jsonize_daemon(&reader_threads[0], DAEMON_EVENT_INIT); run_pcap_loop(&reader_threads[0]); + process_remaining_flows(); free_reader_threads(); close(mock_pipefds[PIPE_nDPId]); @@ -2592,6 +2592,25 @@ static void ndpi_shutdown_walker(void const * const A, ndpi_VISIT which, int dep } } +static void process_remaining_flows(void) +{ + for (unsigned long long int i = 0; i < nDPId_options.reader_thread_count; ++i) + { + for (size_t idle_scan_index = 0; idle_scan_index < reader_threads[i].workflow->max_active_flows; + ++idle_scan_index) + { + ndpi_twalk(reader_threads[i].workflow->ndpi_flows_active[idle_scan_index], + ndpi_shutdown_walker, + reader_threads[i].workflow); + process_idle_flow(&reader_threads[i], idle_scan_index); + } + + jsonize_daemon(&reader_threads[i], DAEMON_EVENT_SHUTDOWN); + close(reader_threads[i].json_sockfd); + reader_threads[i].json_sockfd = -1; + } +} + static int stop_reader_threads(void) { unsigned long long int total_packets_processed = 0; @@ -2621,21 +2640,7 @@ static int stop_reader_threads(void) } printf("------------------------------------ Processing remaining flows\n"); - for (unsigned long long int i = 0; i < nDPId_options.reader_thread_count; ++i) - { - for (size_t idle_scan_index = 0; idle_scan_index < reader_threads[i].workflow->max_active_flows; - ++idle_scan_index) - { - ndpi_twalk(reader_threads[i].workflow->ndpi_flows_active[idle_scan_index], - ndpi_shutdown_walker, - reader_threads[i].workflow); - process_idle_flow(&reader_threads[i], idle_scan_index); - } - - jsonize_daemon(&reader_threads[i], DAEMON_EVENT_SHUTDOWN); - close(reader_threads[i].json_sockfd); - reader_threads[i].json_sockfd = -1; - } + process_remaining_flows(); printf("------------------------------------ Results\n"); for (unsigned long long int i = 0; i < nDPId_options.reader_thread_count; ++i) diff --git a/test/results/1kxun.pcap.out b/test/results/1kxun.pcap.out index 2dbfe4dda..72ecef1aa 100644 --- a/test/results/1kxun.pcap.out +++ b/test/results/1kxun.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"1kxun.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1470104373025,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.44","dst_ip":"224.0.0.252","src_port":59571,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"1kxun.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1470104373,"pkt_ts_usec":25824,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AQBeAAD8SNIkYzEACABFAAA2OooAAAER2FzAqAUs4AAA\/OizFOsAIin75qEAAAABAAAAAAAACGphc29uLVBDAAD\/AAE="} 00502{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1470104373025,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.44","dst_ip":"224.0.0.252","src_port":59571,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}} @@ -1054,3 +1055,111 @@ 00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1433,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1470104427094,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.41","dst_ip":"224.0.0.252","src_port":55593,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1436,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_first_seen":1470104433649,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.186","dst_ip":"255.255.255.255","src_port":32768,"dst_port":1947,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00462{"flow_id":148,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1436,"source":"1kxun.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1470104433,"pkt_ts_usec":649184,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/AAK2Qbs6CABFAABEAABAAEARd0fAqAK6\/\/\/\/\/4AAB5sAMBr8aWNSVlNvVTlBQUJYWldKRFlXeHNBSFZ0Ukc5c2IzSlRhWFJCYldVQQ=="} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":8,"flow_first_seen":1470104384289,"flow_last_seen":1470104426277,"flow_tot_l4_data_len":1128,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.37","dst_ip":"239.255.255.250","src_port":57325,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1470104399652,"flow_last_seen":1470104400059,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.48","dst_ip":"224.0.0.252","src_port":59797,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":2,"flow_first_seen":1470104414395,"flow_last_seen":1470104414402,"flow_tot_l4_data_len":310,"flow_min_l4_data_len":55,"flow_max_l4_data_len":255,"flow_avg_l4_data_len":155,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"168.95.1.1","src_port":63372,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1470104376017,"flow_last_seen":1470104433238,"flow_tot_l4_data_len":1128,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.41","dst_ip":"239.255.255.250","src_port":55312,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":2,"flow_first_seen":1470104430884,"flow_last_seen":1470104431294,"flow_tot_l4_data_len":74,"flow_min_l4_data_len":37,"flow_max_l4_data_len":37,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::e034:7be:d8f9:6197","dst_ip":"ff02::1:3","src_port":49766,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":14,"flow_first_seen":1470104414404,"flow_last_seen":1470104414420,"flow_tot_l4_data_len":9022,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":644,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"203.69.81.73","src_port":53627,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":14,"flow_first_seen":1470104414404,"flow_last_seen":1470104414419,"flow_tot_l4_data_len":8682,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":620,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"203.69.81.73","src_port":53628,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":3,"flow_first_seen":1470104377734,"flow_last_seen":1470104377753,"flow_tot_l4_data_len":170,"flow_min_l4_data_len":46,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"8.8.8.8","src_port":51024,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_first_seen":1470104433649,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.186","dst_ip":"255.255.255.255","src_port":32768,"dst_port":1947,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_first_seen":1470104433649,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.186","dst_ip":"255.255.255.255","src_port":32768,"dst_port":1947,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":12,"flow_first_seen":1470104378045,"flow_last_seen":1470104423102,"flow_tot_l4_data_len":1692,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.95","dst_ip":"239.255.255.250","src_port":59468,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":2,"flow_first_seen":1470104426992,"flow_last_seen":1470104427094,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4568:efbc:40b1:1346","dst_ip":"ff02::1:3","src_port":57148,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":3,"flow_first_seen":1470104395657,"flow_last_seen":1470104422690,"flow_tot_l4_data_len":924,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":2,"flow_first_seen":1470104391254,"flow_last_seen":1470104391362,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.236","dst_ip":"224.0.0.252","src_port":51714,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":25,"flow_first_seen":1470104380773,"flow_last_seen":1470104381859,"flow_tot_l4_data_len":4094,"flow_min_l4_data_len":20,"flow_max_l4_data_len":465,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"203.205.151.234","src_port":49608,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":11,"flow_first_seen":1470104385211,"flow_last_seen":1470104432114,"flow_tot_l4_data_len":1551,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.9","dst_ip":"239.255.255.250","src_port":55484,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":9,"flow_first_seen":1470104385211,"flow_last_seen":1470104432114,"flow_tot_l4_data_len":1269,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.101.33","dst_ip":"239.255.255.250","src_port":55485,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":13,"flow_first_seen":1470104373232,"flow_last_seen":1470104432419,"flow_tot_l4_data_len":1833,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.44","dst_ip":"239.255.255.250","src_port":51389,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":10,"flow_first_seen":1470104419061,"flow_last_seen":1470104419317,"flow_tot_l4_data_len":2153,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1189,"flow_avg_l4_data_len":215,"midstream":1,"l3_proto":"ip4","src_ip":"31.13.87.1","dst_ip":"192.168.5.16","src_port":443,"dst_port":53578,"l4_proto":"tcp","ndpi": {"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":10,"flow_first_seen":1470104419061,"flow_last_seen":1470104419317,"flow_tot_l4_data_len":2153,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1189,"flow_avg_l4_data_len":215,"midstream":1,"l3_proto":"ip4","src_ip":"31.13.87.1","dst_ip":"192.168.5.16","src_port":443,"dst_port":53578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":9,"flow_first_seen":1470104414296,"flow_last_seen":1470104414478,"flow_tot_l4_data_len":4041,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":449,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"31.13.87.36","src_port":53580,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":9,"flow_first_seen":1470104414296,"flow_last_seen":1470104414478,"flow_tot_l4_data_len":4041,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":449,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"31.13.87.36","src_port":53580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":2,"flow_first_seen":1470104402624,"flow_last_seen":1470104402724,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.236","dst_ip":"224.0.0.252","src_port":62069,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":14,"flow_first_seen":1470104373741,"flow_last_seen":1470104416751,"flow_tot_l4_data_len":4312,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.119.1","dst_ip":"255.255.255.255","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":2,"flow_first_seen":1470104406717,"flow_last_seen":1470104407128,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.47","dst_ip":"224.0.0.252","src_port":53962,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":2,"flow_first_seen":1470104409586,"flow_last_seen":1470104409685,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.236","dst_ip":"224.0.0.252","src_port":56043,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":2,"flow_first_seen":1470104406717,"flow_last_seen":1470104407128,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::edf5:240a:c8c0:8312","dst_ip":"ff02::1:3","src_port":53962,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":2,"flow_first_seen":1470104408049,"flow_last_seen":1470104408457,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::e98f:bae2:19f7:6b0f","dst_ip":"ff02::1:3","src_port":51451,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":4,"flow_first_seen":1470104383810,"flow_last_seen":1470104413817,"flow_tot_l4_data_len":1232,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.119.1","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":8,"flow_first_seen":1470104385418,"flow_last_seen":1470104427503,"flow_tot_l4_data_len":1160,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.49","dst_ip":"239.255.255.250","src_port":51704,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":14,"flow_first_seen":1470104373232,"flow_last_seen":1470104430168,"flow_tot_l4_data_len":1974,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.57","dst_ip":"239.255.255.250","src_port":55809,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":2,"flow_first_seen":1470104412556,"flow_last_seen":1470104412962,"flow_tot_l4_data_len":82,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::9bd:81dd:2fdc:5750","dst_ip":"ff02::1:3","src_port":64568,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":2,"flow_first_seen":1470104429964,"flow_last_seen":1470104430065,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.57","dst_ip":"224.0.0.252","src_port":64428,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":33,"flow_first_seen":1470104380890,"flow_last_seen":1470104382084,"flow_tot_l4_data_len":10575,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":320,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"42.120.51.152","src_port":49609,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":2,"flow_first_seen":1470104420438,"flow_last_seen":1470104420540,"flow_tot_l4_data_len":66,"flow_min_l4_data_len":33,"flow_max_l4_data_len":33,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::5d92:62a8:ebde:1319","dst_ip":"ff02::1:3","src_port":61172,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":7,"flow_first_seen":1470104397807,"flow_last_seen":1470104414604,"flow_tot_l4_data_len":1015,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.48","dst_ip":"239.255.255.250","src_port":49701,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":3,"flow_first_seen":1470104424738,"flow_last_seen":1470104426276,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.104","dst_ip":"192.168.255.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":2,"flow_first_seen":1470104393610,"flow_last_seen":1470104394635,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.45","dst_ip":"192.168.255.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":12,"flow_first_seen":1470104393097,"flow_last_seen":1470104422179,"flow_tot_l4_data_len":696,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.236","dst_ip":"192.168.255.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1470104378021,"flow_last_seen":1470104379520,"flow_tot_l4_data_len":348,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"192.168.255.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":3,"flow_first_seen":1470104393610,"flow_last_seen":1470104393611,"flow_tot_l4_data_len":546,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.45","dst_ip":"192.168.255.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1470104379579,"flow_last_seen":1470104379579,"flow_tot_l4_data_len":481,"flow_min_l4_data_len":229,"flow_max_l4_data_len":252,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.67","dst_ip":"192.168.255.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1470104381217,"flow_last_seen":1470104381626,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.37","dst_ip":"224.0.0.252","src_port":56366,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":2,"flow_first_seen":1470104412556,"flow_last_seen":1470104412962,"flow_tot_l4_data_len":82,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.49","dst_ip":"224.0.0.252","src_port":64568,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":13,"flow_first_seen":1470104380188,"flow_last_seen":1470104380928,"flow_tot_l4_data_len":1009,"flow_min_l4_data_len":20,"flow_max_l4_data_len":412,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.244.135.170","src_port":49607,"dst_port":9099,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1470104381935,"flow_last_seen":1470104382038,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.9","dst_ip":"224.0.0.252","src_port":58456,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1470104381935,"flow_last_seen":1470104382036,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.101.33","dst_ip":"224.0.0.252","src_port":58456,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":2,"flow_first_seen":1470104396889,"flow_last_seen":1470104396987,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.41","dst_ip":"224.0.0.252","src_port":54470,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":2,"flow_first_seen":1470104411327,"flow_last_seen":1470104411735,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.37","dst_ip":"224.0.0.252","src_port":54506,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":8,"flow_first_seen":1470104377634,"flow_last_seen":1470104415729,"flow_tot_l4_data_len":1160,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.47","dst_ip":"239.255.255.250","src_port":60267,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":2,"flow_first_seen":1470104399959,"flow_last_seen":1470104400366,"flow_tot_l4_data_len":74,"flow_min_l4_data_len":37,"flow_max_l4_data_len":37,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.50","dst_ip":"224.0.0.252","src_port":62756,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":12,"flow_first_seen":1470104390443,"flow_last_seen":1470104422398,"flow_tot_l4_data_len":1574,"flow_min_l4_data_len":32,"flow_max_l4_data_len":356,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"68.233.253.133","src_port":53624,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":2,"flow_first_seen":1470104403134,"flow_last_seen":1470104403234,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.44","dst_ip":"224.0.0.252","src_port":58702,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":1470104391254,"flow_last_seen":1470104391361,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::5d92:62a8:ebde:1319","dst_ip":"ff02::1:3","src_port":63659,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_first_seen":1470104416855,"flow_last_seen":1470104416959,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.9","dst_ip":"224.0.0.252","src_port":62822,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":2,"flow_first_seen":1470104416855,"flow_last_seen":1470104416958,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.101.33","dst_ip":"224.0.0.252","src_port":62822,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":3,"flow_first_seen":1470104391199,"flow_last_seen":1470104391208,"flow_tot_l4_data_len":74,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"64.233.189.128","src_port":49581,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Google","breed":"Unrated","category":"Web"},"http": {}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":3,"flow_first_seen":1470104391199,"flow_last_seen":1470104391208,"flow_tot_l4_data_len":74,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"64.233.189.128","src_port":49581,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1470104378045,"flow_last_seen":1470104378454,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.95","dst_ip":"224.0.0.252","src_port":58779,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":14,"flow_first_seen":1470104377754,"flow_last_seen":1470104422913,"flow_tot_l4_data_len":2376,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1238,"flow_avg_l4_data_len":169,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.185.35.110","src_port":49597,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":13,"flow_first_seen":1470104379903,"flow_last_seen":1470104379989,"flow_tot_l4_data_len":2961,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":227,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.185.35.110","src_port":49605,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":50,"flow_first_seen":1470104379916,"flow_last_seen":1470104380338,"flow_tot_l4_data_len":34041,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":680,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.185.35.110","src_port":49606,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":14,"flow_first_seen":1470104378906,"flow_last_seen":1470104424115,"flow_tot_l4_data_len":1904,"flow_min_l4_data_len":20,"flow_max_l4_data_len":754,"flow_avg_l4_data_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.73.254.167","src_port":49598,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1470104378005,"flow_last_seen":1470104378007,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53622,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1470104378005,"flow_last_seen":1470104378007,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53622,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":19,"flow_first_seen":1470104381237,"flow_last_seen":1470104402191,"flow_tot_l4_data_len":2936,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1033,"flow_avg_l4_data_len":154,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53623,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":19,"flow_first_seen":1470104402238,"flow_last_seen":1470104408999,"flow_tot_l4_data_len":2932,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1033,"flow_avg_l4_data_len":154,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53625,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":19,"flow_first_seen":1470104414296,"flow_last_seen":1470104423193,"flow_tot_l4_data_len":2504,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1017,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53626,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":17,"flow_first_seen":1470104423246,"flow_last_seen":1470104429322,"flow_tot_l4_data_len":2892,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1033,"flow_avg_l4_data_len":170,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.16","dst_ip":"192.168.115.75","src_port":53629,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":9,"flow_first_seen":1470104376017,"flow_last_seen":1470104433033,"flow_tot_l4_data_len":1305,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.50","dst_ip":"239.255.255.250","src_port":64674,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1470104379169,"flow_last_seen":1470104379271,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.95","dst_ip":"224.0.0.252","src_port":54888,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":2,"flow_first_seen":1470104399958,"flow_last_seen":1470104400059,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.57","dst_ip":"224.0.0.252","src_port":65150,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":2,"flow_first_seen":1470104396888,"flow_last_seen":1470104396987,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4568:efbc:40b1:1346","dst_ip":"ff02::1:3","src_port":50194,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_first_seen":1470104402624,"flow_last_seen":1470104402724,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::5d92:62a8:ebde:1319","dst_ip":"ff02::1:3","src_port":49735,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":3,"flow_first_seen":1470104380737,"flow_last_seen":1470104380772,"flow_tot_l4_data_len":164,"flow_min_l4_data_len":41,"flow_max_l4_data_len":82,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"8.8.8.8","src_port":54420,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":2,"flow_first_seen":1470104430065,"flow_last_seen":1470104430476,"flow_tot_l4_data_len":74,"flow_min_l4_data_len":37,"flow_max_l4_data_len":37,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.50","dst_ip":"224.0.0.252","src_port":57143,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":2,"flow_first_seen":1470104409586,"flow_last_seen":1470104409685,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::5d92:62a8:ebde:1319","dst_ip":"ff02::1:3","src_port":53938,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":43,"flow_first_seen":1470104379117,"flow_last_seen":1470104424357,"flow_tot_l4_data_len":29723,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":691,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49599,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":69,"flow_first_seen":1470104379117,"flow_last_seen":1470104424488,"flow_tot_l4_data_len":61077,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":885,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49600,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":61,"flow_first_seen":1470104379118,"flow_last_seen":1470104424418,"flow_tot_l4_data_len":49597,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":813,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49601,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":65,"flow_first_seen":1470104379118,"flow_last_seen":1470104424446,"flow_tot_l4_data_len":46773,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":719,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49602,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1470104379066,"flow_last_seen":1470104379115,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":39,"flow_max_l4_data_len":103,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"8.8.8.8","src_port":60724,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":34,"flow_first_seen":1470104379118,"flow_last_seen":1470104424360,"flow_tot_l4_data_len":24418,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":718,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49603,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":58,"flow_first_seen":1470104379119,"flow_last_seen":1470104424435,"flow_tot_l4_data_len":43599,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":751,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.187.35.246","src_port":49604,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":5,"flow_first_seen":1470104376816,"flow_last_seen":1470104392380,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::406:55a8:6453:25dd","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":1470104382448,"flow_last_seen":1470104382857,"flow_tot_l4_data_len":82,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::9bd:81dd:2fdc:5750","dst_ip":"ff02::1:3","src_port":61548,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":2,"flow_first_seen":1470104432630,"flow_last_seen":1470104432728,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.236","dst_ip":"224.0.0.252","src_port":65496,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1470104378045,"flow_last_seen":1470104378454,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::e98f:bae2:19f7:6b0f","dst_ip":"ff02::1:3","src_port":58779,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":23,"flow_first_seen":1470104410885,"flow_last_seen":1470104428908,"flow_tot_l4_data_len":6592,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":286,"midstream":1,"l3_proto":"ip4","src_ip":"119.235.235.84","dst_ip":"192.168.5.16","src_port":443,"dst_port":53406,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":23,"flow_first_seen":1470104410885,"flow_last_seen":1470104428908,"flow_tot_l4_data_len":6592,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":286,"midstream":1,"l3_proto":"ip4","src_ip":"119.235.235.84","dst_ip":"192.168.5.16","src_port":443,"dst_port":53406,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":14,"flow_first_seen":1470104381895,"flow_last_seen":1470104382125,"flow_tot_l4_data_len":1805,"flow_min_l4_data_len":20,"flow_max_l4_data_len":653,"flow_avg_l4_data_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.131.48.145","src_port":49612,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":419,"flow_first_seen":1470104382053,"flow_last_seen":1470104433789,"flow_tot_l4_data_len":169439,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1044,"flow_avg_l4_data_len":404,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.131.48.144","src_port":49613,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":3,"flow_first_seen":1470104378901,"flow_last_seen":1470104378905,"flow_tot_l4_data_len":158,"flow_min_l4_data_len":42,"flow_max_l4_data_len":74,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"168.95.1.1","src_port":52723,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_first_seen":1470104377901,"flow_last_seen":1470104378954,"flow_tot_l4_data_len":158,"flow_min_l4_data_len":42,"flow_max_l4_data_len":74,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"8.8.8.8","src_port":52723,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":6,"flow_first_seen":1470104388033,"flow_last_seen":1470104433040,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"203.66.182.87","src_port":49596,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":6,"flow_first_seen":1470104388033,"flow_last_seen":1470104433040,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"203.66.182.87","src_port":49596,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1470104382448,"flow_last_seen":1470104382858,"flow_tot_l4_data_len":82,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.49","dst_ip":"224.0.0.252","src_port":61548,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":4,"flow_first_seen":1470104404055,"flow_last_seen":1470104418595,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::beee:7bff:fe0c:b3de","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1470104377634,"flow_last_seen":1470104378045,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.47","dst_ip":"224.0.0.252","src_port":61603,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1470104379169,"flow_last_seen":1470104379271,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::e98f:bae2:19f7:6b0f","dst_ip":"ff02::1:3","src_port":54888,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1470104373025,"flow_last_seen":1470104373127,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.44","dst_ip":"224.0.0.252","src_port":59571,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1470104377634,"flow_last_seen":1470104378045,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::edf5:240a:c8c0:8312","dst_ip":"ff02::1:3","src_port":61603,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":2,"flow_first_seen":1470104408049,"flow_last_seen":1470104408458,"flow_tot_l4_data_len":76,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.3.95","dst_ip":"224.0.0.252","src_port":51451,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":16,"flow_first_seen":1470104400162,"flow_last_seen":1470104408559,"flow_tot_l4_data_len":7929,"flow_min_l4_data_len":448,"flow_max_l4_data_len":528,"flow_avg_l4_data_len":495,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.49","dst_ip":"239.255.255.250","src_port":1900,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1470104377720,"flow_last_seen":1470104377820,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":30,"flow_max_l4_data_len":30,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"224.0.0.252","src_port":51458,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":2,"flow_first_seen":1470104432630,"flow_last_seen":1470104432728,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":35,"flow_max_l4_data_len":35,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::5d92:62a8:ebde:1319","dst_ip":"ff02::1:3","src_port":58468,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":16,"flow_first_seen":1470104400162,"flow_last_seen":1470104408559,"flow_tot_l4_data_len":8057,"flow_min_l4_data_len":456,"flow_max_l4_data_len":536,"flow_avg_l4_data_len":503,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::9bd:81dd:2fdc:5750","dst_ip":"ff02::c","src_port":1900,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1439,"source":"1kxun.pcap","alias":"nDPId-test"} diff --git a/test/results/443-chrome.pcap.out b/test/results/443-chrome.pcap.out index a6dbb6542..392f82a8f 100644 --- a/test/results/443-chrome.pcap.out +++ b/test/results/443-chrome.pcap.out @@ -1,2 +1,6 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-chrome.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-chrome.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581109434258,"flow_last_seen":0,"flow_tot_l4_data_len":1472,"flow_min_l4_data_len":1472,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":1472,"midstream":1,"l3_proto":"ip4","src_ip":"178.62.197.130","dst_ip":"192.168.1.13","src_port":443,"dst_port":53059,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 02382{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-chrome.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109434,"pkt_ts_usec":258190,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUL9xAADQG19GyPsWCwKgBDQG7z0OMwKr+Oj0RjoAQAfVXrQAAAQEICiUvy0seKwePAbBkhQkGDSwXAwMFJB7ULkZYT314CXk9r8PlYJygP344H6B+ItT1QydBOUTT\/6D31GPVzKtOQjSVxhbT8njy8fnLCF03csGz4\/Y1RkgUVmI84ERVBP7zbdzqFVMxHmkRU4146\/GYpGt09JudxRaBFBE6RH99GaIPOIBgIxL+lVzyEaqTle8b2ooKlmYXANwIghY6MzW7vfR0m2NAd4\/mImO8\/LyUCeGK0r\/puyNRW7lwQQMAmHKJdbXl9VyEWyHoVGg2V7UztPOOS9FaOf7PI0qXcHmQjpNhC3tUdKXBoA5lr9L4gV9TtzI0jsGqvB9N6GFz+qcMvQNu9oMflyIYBhNXeC+wMS3iHkbmb6YjZ1BITgZEep9Fizk45i3xCMymSmOsda0ujEX4jtgvxVvAdOobavQSODmvW7nF0r5t9e88tMuzTz7+vTqoOaJn4Q5qSGioRtcVHnLq2LNPOuGgbZaLvf8nOa3F\/fTzsfVgOnrof2PK7x6zJRR4iLtFUyiyV0abVTIHELfIYnSCf71pFYSlMWF1kbosbMAxw+8gDHb28maLs7wPXvpNMwUQmC5zWPLwG8e+Pf\/3nur0wrn5EOul2L1tr2PBCGM7nQJnzz+Ftab4qAnCKKMUrufRAVhXA6Ue6CMSRLYliOxzGRgmHVxorbbpx87m7XMCx1xGrv\/+sMpgjOYFPN80vjeb9Ar4xkocVQgWuuKpaWdNDznMzFzG0+H1ekKy8mE\/Y4uj8aty0rTxx\/RK0gYF2CUtsmGNskEzCWUbq5MAqcp05SHkAJHGGJeLVJYaWPvGXbFa5QHn9poomy6DBa+Zu\/J+olJwYCoT+frN77wk+XmgZEGX8LeovmjP4s1R+UbEFUsUMksh6m15XB\/oDSc43HBC0ZN2fBl+EVSpfPjbG\/eOyIfLCt5fbBfnhNgvommX5LE+2Hk1er+ly1V3Bk3SksoPHjYC3atFWwOW8i0ksy3cnSr3r7urFNldk3MU3+jnEXfTimw+aCW1vRMowhmfm8PlgjcufRfy+KbXvWvcglQ5SIZzkHbMTgRIVTH0rnzAvQa5V3qwPK10Uoz7qDIouhn\/mb\/ZISHF6mBR\/IXvmgdDxCQjDF0pzdpHGlijQnscX9IYmuALydf\/N95pDI1Ksot3SwlV+ToeoAcOu03ffeX9ZWtpGReoSSLBreVK2S9eOKb7ts0O5zIIo7KsqQiv\/vBgScz8WXOWpxQ\/yJVR5ay52w6EYcainLIU7Xbc\/tjzrhulig3U\/8LJroIUx7FTN+1M\/XXQgxU1xPwXfZVd2BCyLjPf3LnCxXwnRvsKpAN+jMhuodhLSF7CgHqc20YiiLhRoKoX9HTNFjjp4NCVuyybqoR14grCEsHZOU2qhA+8BZe5VlL7unSunUXcr1PeN9gM5Jq4MVqPdpyzDhvJpSxU3Hx+L1u56H6J0VrRo\/R6fO225uB9ZADFU\/E9+rLvS3XjVihQI4Xj3oV8Yz2DHOUB7myCSIfri88nrYevcoAQbwAgIH3ZuvMVV+F7spgWZOgjijLQs9AFYfhIg77XK7GhiJW4kT1GNIqN\/59u+gIdPmDuGurVucPbruilLRCDIsr+53Us+irmCwo\/E2YPbk4a0f3NX0k+rNo92g1D9wTfG3QFRXLoBVDcr2q9BeW0PVJsavNUQM+jFbQkjfp93AvyPnmEBcWXIT002jYiClr1Y1\/emkCZ90t5YN1lLX5fUvWWgwvQ8NqFZ2zWMZciPkbKDA3g3Y+AskVzW3FFBLqR77\/aXs+9FwMDBSQUQnjU3ptBoEOyx5s5g6C1C+gxkfWLgzLDV66R77tBk395nAfOwKbaxf02lWN9Kl7ER9qk1HP5doNJPo83hbomHGy3aIU4qtqfnGI\/DWje6wuZoh6zDMTlo3NI6IL\/slMBsWm6kBIHkYOp"} +00504{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1,"source":"443-chrome.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581109434258,"flow_last_seen":0,"flow_tot_l4_data_len":1472,"flow_min_l4_data_len":1472,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":1472,"midstream":1,"l3_proto":"ip4","src_ip":"178.62.197.130","dst_ip":"192.168.1.13","src_port":443,"dst_port":53059,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"443-chrome.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581109434258,"flow_last_seen":0,"flow_tot_l4_data_len":1472,"flow_min_l4_data_len":1472,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":1472,"midstream":1,"l3_proto":"ip4","src_ip":"178.62.197.130","dst_ip":"192.168.1.13","src_port":443,"dst_port":53059,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"443-chrome.pcap","alias":"nDPId-test"} diff --git a/test/results/443-curl.pcap.out b/test/results/443-curl.pcap.out index 06761cfe7..94d12437d 100644 --- a/test/results/443-curl.pcap.out +++ b/test/results/443-curl.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-curl.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-curl.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581113120474,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":55523,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-curl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113120,"pkt_ts_usec":474299,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGAULAqAENsj7FgtjjAbvMd3aVAAAAALAC\/\/97wQAAAgQFtAEDAwUBAQgKHmJFtwAAAAAEAgAA"} 00436{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"443-curl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113120,"pkt_ts_usec":512991,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGDUayPsWCwKgBDQG72OOPktF9zHd2lqAS\/oj9JgAAAgQFrAQCCAolaAqTHmJFtwEDAwc="} @@ -17,3 +18,5 @@ 00505{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"443-curl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113120,"pkt_ts_usec":615460,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"pkt":"KDc3AG3IEBMx8Tl2CABFAABtW8NAADQGsVGyPsWCwKgBDQG72OOPkt10zHd5GYAYAfp7mQAAAQEICiVoCvkeYkYZFwMDADSs\/COuKf6QzbZuwm5bQ+t1xaNk5sTWeJideDy\/mEPzRPt1g1pEejHD9dWUd1PFn4IWabl7"} 00426{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"443-curl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113120,"pkt_ts_usec":615532,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7FgtjjAbvMd3kZj5LddIAQD\/4LDwAAAQEICh5iRj8laAr5"} 00426{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"443-curl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113120,"pkt_ts_usec":615535,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7FgtjjAbvMd3kZj5LdrYAQD\/wK2AAAAQEICh5iRj8laAr5"} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":109,"source":"443-curl.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":109,"flow_first_seen":1581113120474,"flow_last_seen":1581113121570,"flow_tot_l4_data_len":70276,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":644,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":55523,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":109,"source":"443-curl.pcap","alias":"nDPId-test"} diff --git a/test/results/443-firefox.pcap.out b/test/results/443-firefox.pcap.out index 082c615f4..b8ac35028 100644 --- a/test/results/443-firefox.pcap.out +++ b/test/results/443-firefox.pcap.out @@ -1,3 +1,4 @@ +00388{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-firefox.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-firefox.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581109488041,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":53096,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109488,"pkt_ts_usec":41083,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGAULAqAENsj7Fgs9oAbstYO2oAAAAALAC\/\/8dyQAAAgQFtAEDAwUBAQgKHivVZQAAAAAEAgAA"} 00438{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"443-firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109488,"pkt_ts_usec":79587,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGDUayPsWCwKgBDQG7z2h4KhDzLWDtqaAS\/ojkXQAAAgQFrAQCCAolMJ2OHivVZQEDAwc="} @@ -17,3 +18,5 @@ 00499{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"443-firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109488,"pkt_ts_usec":164490,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"pkt":"KDc3AG3IEBMx8Tl2CABFAABlHdlAADQG70OyPsWCwKgBDQG7z2h4Kh2ILWDwA4AYAfqzkwAAAQEICiUwneMeK9W1FwMDACxffRqcy2j37wKerf7ZOK8PIq4YWRNxkgdTirhwIr1LXYymQjh\/dnRfmvIfcg=="} 00429{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"443-firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109488,"pkt_ts_usec":164577,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7Fgs9oAbstYPADeCodiIAQD\/fx+wAAAQEICh4r1dolMJ3j"} 00429{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"443-firefox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109488,"pkt_ts_usec":164580,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7Fgs9oAbstYPADeCoduYAQD\/bxywAAAQEICh4r1dolMJ3j"} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":667,"source":"443-firefox.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":667,"flow_first_seen":1581109488041,"flow_last_seen":1581109496480,"flow_tot_l4_data_len":435389,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":652,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":53096,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":667,"source":"443-firefox.pcap","alias":"nDPId-test"} diff --git a/test/results/443-git.pcap.out b/test/results/443-git.pcap.out index 4ce1ebc15..821d3bbf1 100644 --- a/test/results/443-git.pcap.out +++ b/test/results/443-git.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-git.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-git.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581113657633,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"140.82.114.4","src_port":55744,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113657,"pkt_ts_usec":633853,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGeqzAqAENjFJyBNnAAbv0\/p5\/AAAAALAC\/\/+NzAAAAgQFtAEDAwUBAQgKHmpbwAAAAAAEAgAA"} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"443-git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113657,"pkt_ts_usec":744320,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADIGiLCMUnIEwKgBDQG72cCAzdDM9P6egKASb0C\/0wAAAgQFnAQCCAoOCxAaHmpbwAEDAwo="} @@ -17,3 +18,5 @@ 00705{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"443-git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113657,"pkt_ts_usec":988380,"pkt_caplen":273,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":273,"pkt_l4_len":239,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEDAABAAEAGeenAqAENjFJyBNnAAbv0\/qEDgM3e3oAYEACF3gAAAQEICh5qXRgOCxBWFwMDAMoAAAAAAAAAAZteE2M50auMrOtfwzcbrjE5WSBBGbdFq8Wv4YIfG49Pd6pjfLi8bvfrvWBPpyLBoiAfBJfKXWUmVmlXSRH2FbhdbL6+RF4mftwCy7PUQCTF7z1+QJXZiylicLOVB6F+QgE78ERJTYJZ5fqeUMaOnSKsYbY3QkmS8On68oWh9PJWvTllzj24jo7NW0yhQmQ5nrxaN845D0504ebzIYNzgvXdV6rf08Iu+PMC6t\/37IhUjJDXatJxPaJ40aWY6+Eo3mch"} 00928{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"443-git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113658,"pkt_ts_usec":131245,"pkt_caplen":437,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":437,"pkt_l4_len":403,"pkt":"KDc3AG3IEBMx8Tl2CABFAAGnwP5AADIGxkaMUnIEwKgBDQG72cCAzd7e9P6h0oAYAB5pFgAAAQEICg4LEHoeal0YFwMDAW6Jm0EBvvRKLb0S9s4ZFGBMJ3epNReWPVZ+jw3d4XVirOKjdNQAI7COlaOiHvNnTlNKp9qv2guBbvHpG8VXnNVC6PdTOxzmNCoVDBZCBZ6MYz8O2gPsFtxZfR3mpveIPegsG09ZTcLM6rMjQHHhOvjdbMQWmvijnpwY3AK8Ou7KDDLoTZtSqnHEEk0HDk8nzvykyDh3WKm2+6v72\/VImnsPeZqMVEifVcU00r4L8C1rn0dMsQnWSzwNg96VpSxg69HXwCoAXbkeTTBTAnyJZTMWWWRvohuzcXJxklcxh3\/XPOYK0t65bhJkDrCUb\/IsRoynsBkL\/+JuUPaSYE0mPT6LYxqv38aXfY9q7gkPKraZ5Xwy02FbwvU9GD59UHHdsPaIKgBceRC+qceZ1jgF6QLKvYkBkpwqtV2vcYSbR1a\/Jj413t8tPLLJwVanjG6CEkcGGQijHtu6RnBIo3+JkhpBZ+rXrOklbvVPqr2Eg84="} 00528{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"443-git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581113658,"pkt_ts_usec":131250,"pkt_caplen":140,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":140,"pkt_l4_len":106,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB+wP9AADIGx26MUnIEwKgBDQG72cCAzeBR9P6h0oAYAB7pmQAAAQEICg4LEHoeal0YFwMDAEWJm0EBvvRKLmX7drjPshGyaEJWmqcp1RQ+pyLs4CGONTV6yT1TRVDipzhBBC2J7XfD1QzS\/vH7qDNCq0AYEKrGNVvpC2I="} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":70,"source":"443-git.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":70,"flow_first_seen":1581113657633,"flow_last_seen":1581113658456,"flow_tot_l4_data_len":34809,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1456,"flow_avg_l4_data_len":497,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"140.82.114.4","src_port":55744,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":70,"source":"443-git.pcap","alias":"nDPId-test"} diff --git a/test/results/443-opvn.pcap.out b/test/results/443-opvn.pcap.out index b16c2bb5f..9bc374acd 100644 --- a/test/results/443-opvn.pcap.out +++ b/test/results/443-opvn.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-opvn.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-opvn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581153175528,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.84","dst_ip":"192.12.192.103","src_port":52973,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-opvn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581153175,"pkt_ts_usec":528454,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+EfAqAFUwAzAZ87tBKpga1quAAAAALAC\/\/\/PlAAAAgQFtAEDAwUBAQgKFg2AOQAAAAAEAgAA"} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"443-opvn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581153175,"pkt_ts_usec":550065,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADYGAkzADMBnwKgBVASqzu1gWZU1YGtar6AScSBwigAAAgQFrAQCCAocQO0VFg2AOQEDAwY="} @@ -15,3 +16,5 @@ 00425{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"443-opvn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581153176,"pkt_ts_usec":716616,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+FPAqAFUwAzAZ87tBKpga1xQYFmaAIAQEAX0RAAAAQEIChYNhM8cQO44"} 02370{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"443-opvn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581153176,"pkt_ts_usec":716678,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUeDFAADYGhILADMBnwKgBVASqzu1gWZoAYGtcUIAQAda19QAAAQEIChxA7jgWDYSwBIQgGQgugPnKUoD7C2lnhAEvosaCXjxmdu0yP19GwQAAAANePnuYAAAAAAITC1JlZ2lzdHJvLml0MRcwFQYDVQQDEw5SZWdpc3Ryby5pdCBDQTEiMCAGCSqGSIb3DQEJARYTc3lzYWRtaW5AaWl0LmNuci5pdDAeFw0xMDExMTYwOTIxMTJaFw0yMDExMTMwOTIxMTJaMHwxCzAJBgNVBAYTAklUMQswCQYDVQQIEwJJVDENMAsGA1UEBxMEUGlzYTEUMBIGA1UEChMLUmVnaXN0cm8uaXQxFzAVBgNVBAMTDlJlZ2lzdHJvLml0IENBMSIwIAYJKoZIhvcNAQkBFhNzeXNhZG1pbkBpaXQuY25yLml0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5U+RMCjnQuvzHq7fgJqj4uLHJ7OnEz7FRhJd1X2OejtSFzQAmtrpXSRsZp7qg+AMCYF1xaxZFwXQB3B08357haSfPf0dwtxbyBWhKuKcpDUbOHHnxnHM\/lHsYjDmkORj7vNun3TjaGRRFT354vRPW5R34FowfSkg8nOPIS\/XxQQIDAQABo4HiMIHfMB0GA1UdDgQWBBRENt80e2klAwXa3FJuxjLNFhjmCDCBrwYDVR0jBIGnMIGkgBRENt80e2klAwXa3FJuxjLNFhjmCKGBgKR+MHwxCzAJBgNVBAYTAklUMQswCQYDVQQIEwJJVDENMAsGA1UEBxMEUGlzYTEUMBIGA1UEChMLUmVnaXN0cm8uaXQxFzAVBgNVBAMTDlJlZ2lzdHJvLml0IENBMSIwIAYJKoZIhvcNAQkBFhNzeXNhZG1pbkBpaXQuY25yLml0ggkAqZ44Y9swi1cwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOBgQAFrDWUvJgb6V+jqUXLPIy4ULOpRDsWT2XzURZZ5WOkx2Yr118oLxXmc\/wn2vuo5X5vL7P4mB03vuxuhMGYpypFpaOsYQ8VCK5saM8K7FkH5ARTrWnlYFkoyENqP4gyluvwL9L5HJOIkPIT0mnuEavn\/gxAoJUalJftiH3lj8RMUhYDAwGPDAABiwCArmEyht5IZRYD3QKjerugfd2uK8X5lMxAoC23X\/EKay6Z0Gv+5sUenP4qnPZsDv4PVtwiKSrpSMAhi3p0axeMDiy4+lTRjYVxGdsYjHLHNzi3LzksUdUFbjlI0IAaDRNo+U\/ykzXhjwR8Xg3PgRZDE93YimUQelNRFYx5QKHf4MsAAQIAgBa1dFfTT5BBaGSxj8+AJ77nJQGQ\/0BD89QOnGO6\/2EI19BQKjm7JXGJXW\/XnJrfnVk\/8N2nTmcGNUB4\/\/FCRdKr4oMDPvfjuv7e7sdVKkuDL7Sx66IBy\/wRJYVfcbw91CQQeeeo+3TKQEvuccV9rdZlcFVm3BtwirMuWnXmwXgvBAEAgIYPrFjXk+HhdIaSJuUz8sxf\/Zlh+VDsWaHE9qguCnhdnP60TnCzY46o\/HPZZ4NVREClqrMiCt91T8+WjGkRsFq4tzGbARsgGQgugPnKUoDxtf5GQuyTUCf9Slfh\/dOgRpb7sgAAAARePnuYAAAAAAPY5NQn+9kPrOvrL\/kkxwz31Ak4o2EfKMrgrX9szLLjoXryuObF\/zGgNrmyaq8fejBO90nHcxMHu6ZfHIkWAwMAsA0AAKgFAwQBAkAAHgYBBgIGAwUBBQIFAwQBBAIEAwMBAwIDAwIBAgICAwCAAH4wfDELMAkGA1UEBhMCSVQxCzAJBgNVBAgTAklUMQ0wCwYDVQQHEwRQaXNhMRQwEgYDVQQKEwtSZWdpc3Ryby5pdDEXMBUGA1UEAxMOUmVnaXN0cm8uaXQgQ0ExIjAgBgkqhkiG9w0BCQEWE3N5c2FkbWluQGlpdC5jbnIuaXQO"} 00500{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"443-opvn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581153176,"pkt_ts_usec":716855,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"EBMx8Tl2KDc3AG3ICABFAABoAABAAEAG+B\/AqAFUwAzAZ87tBKpga1xQYFmfoIAYD9hfJAAAAQEIChYNhM8cQO44ADIo1nvkW+XCAesovRmAJlqMfsDgqoZ62+nwdLKzdgAAAARePnuYAQAAAAEZCC6A+cpSgA=="} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":46,"source":"443-opvn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":46,"flow_first_seen":1581153175528,"flow_last_seen":1581153184491,"flow_tot_l4_data_len":10009,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":217,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.84","dst_ip":"192.12.192.103","src_port":52973,"dst_port":1194,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":46,"source":"443-opvn.pcap","alias":"nDPId-test"} diff --git a/test/results/443-safari.pcap.out b/test/results/443-safari.pcap.out index 4b0c51ecb..b4ce9dcf4 100644 --- a/test/results/443-safari.pcap.out +++ b/test/results/443-safari.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"443-safari.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"443-safari.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1581109359601,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":53031,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"443-safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109359,"pkt_ts_usec":601646,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGAULAqAENsj7Fgs8nAbvmgoUNAAAAALAC\/\/+6MQAAAgQFtAEDAwUBAQgKHinouAAAAAAEAgAA"} 00438{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"443-safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109359,"pkt_ts_usec":639845,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGDUayPsWCwKgBDQG7zyeqmyMX5oKFDqAS\/ogx6QAAAgQFrAQCCAolLqfYHinouAEDAwc="} @@ -17,3 +18,5 @@ 00499{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"443-safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109359,"pkt_ts_usec":948101,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"pkt":"KDc3AG3IEBMx8Tl2CABFAABlQ2BAADQGybyyPsWCwKgBDQG7zyeqmy7p5oKGTIAYAfzx6QAAAQEICiUuqQweKenmFwMDACyPw1aJHd3EuqdSE\/LScQ19HUZ6b\/Hrxr1Ppm2Om5KPE2xvVddH2ITgh0Twfg=="} 00429{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"443-safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109359,"pkt_ts_usec":948180,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7Fgs8nAbvmgoZMqpsu6YAQD\/4\/oQAAAQEICh4p6gwlLqkM"} 00429{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"443-safari.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1581109359,"pkt_ts_usec":948184,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGAU7AqAENsj7Fgs8nAbvmgoZMqpsvGoAQD\/0\/cQAAAQEICh4p6gwlLqkM"} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":41,"source":"443-safari.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":41,"flow_first_seen":1581109359601,"flow_last_seen":1581109360696,"flow_tot_l4_data_len":18535,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":452,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.13","dst_ip":"178.62.197.130","src_port":53031,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":41,"source":"443-safari.pcap","alias":"nDPId-test"} diff --git a/test/results/4in4tunnel.pcap.out b/test/results/4in4tunnel.pcap.out index 7bdbab56c..50e24eca7 100644 --- a/test/results/4in4tunnel.pcap.out +++ b/test/results/4in4tunnel.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"4in4tunnel.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00531{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"4in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1537044271,"pkt_ts_usec":794779,"pkt_caplen":170,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":170,"pkt_l4_len":0,"pkt":"AAAAAAAEpMZPO7OagQBmWIEAYfkIAEW4AJToWAAA\/wQRSEVDI5Ipyi5uRbgAgAABAAD+Ed6ECgpkGQoKZQLzn0JoAGxLmgACAAAEc2wQAAAAAAABAACrzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq80="} 00160{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"4in4tunnel.pcap","alias":"nDPId-test","type":33024} 00531{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"4in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1537058551,"pkt_ts_usec":803081,"pkt_caplen":170,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":170,"pkt_l4_len":0,"pkt":"AAAAAAAEpMZPO7OagQBmWIEAYfkIAEW4AJRbZwAA\/wSeOUVDI5Ipyi5uRbgAgAABAAD+Ed6ECgpkGQoKZQLzn0JoAGzGjAACAAAAJvVqAAAAAAABAACrzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq80="} @@ -8,3 +9,4 @@ 00160{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":4,"source":"4in4tunnel.pcap","alias":"nDPId-test","type":33024} 00531{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":5,"source":"4in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1537165843,"pkt_ts_usec":864842,"pkt_caplen":170,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":170,"pkt_l4_len":0,"pkt":"AAAAAAAEpMZPO7OagQBmWIEAYfkIAEW4AJTPEAAA\/wQqkEVDI5Ipyi5uRbgAgAABAAD+Ed6ECgpkGQoKZQLzn0JoAGz7LQACAAABZb+KAAAAAAABAACrzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq82rzavNq80="} 00160{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":5,"source":"4in4tunnel.pcap","alias":"nDPId-test","type":33024} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5,"source":"4in4tunnel.pcap","alias":"nDPId-test"} diff --git a/test/results/4in6tunnel.pcap.out b/test/results/4in6tunnel.pcap.out index 865d6103c..506561982 100644 --- a/test/results/4in6tunnel.pcap.out +++ b/test/results/4in6tunnel.pcap.out @@ -1,6 +1,9 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"4in6tunnel.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"4in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1543235434019,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"22e0:1685:eda7:38cc:58bd:f3f1:aa3f:22d8","dst_ip":"344a:ba94:152a:ac34::2a","l4_proto":4,"flow_datalink":1,"flow_max_packets":15} 00551{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"4in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1543235434,"pkt_ts_usec":19243,"pkt_caplen":154,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":154,"pkt_l4_len":52,"pkt":"AAECunaOAAAASfSHht1gAAAAADQEPyLgFoXtpzjMWL3z8ao\/Itg0SrqUFSqsNAAAAAAAAAAqRQAANHvwQAB\/BqsfwKgAAQoKCgH7xwG73+E+ggAAAACAAv\/\/fqUAAAIEBYQBAwMIAQEEAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} 00512{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"4in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1543235434019,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"22e0:1685:eda7:38cc:58bd:f3f1:aa3f:22d8","dst_ip":"344a:ba94:152a:ac34::2a","l4_proto":4,"ndpi": {"proto":"IP_in_IP","breed":"Acceptable","category":"Network"}} 00552{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"4in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1543235434,"pkt_ts_usec":19246,"pkt_caplen":154,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":154,"pkt_l4_len":52,"pkt":"AAECunaOAAAASfSHht1gAAAAADQEPTRKupQVKqw0AAAAAAAAACoi4BaF7ac4zFi98\/GqPyLYRQAANEufQABhBvlwCgoKAcCoAAEBu\/vHAwzKjt\/hPoOAEv\/\/sQUAAAIEBXgBAwMIAQEEAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} 00832{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"4in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1543235434,"pkt_ts_usec":19247,"pkt_caplen":366,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":366,"pkt_l4_len":264,"pkt":"AAECunaOAAAASfSHht1gAAAAAQgEPyLgFoXtpzjMWL3z8ao\/Itg0SrqUFSqsNAAAAAAAAAAqRQABCHv3QAB\/BqpEwKgAAQoKCgH7xwG73+E+gwMMyo9QGAQA0icAABYDAwDbAQAA1wMDW5uXE0\/QFYUpkWO+HpgF5MI5wT9TQj14SroSH1Zl8oggjz8AALXLO9H2rxfCGsjqy7cU6\/NXDrPxEswgEUGVcfAAJsAswCvAMMAvwCTAI8AowCfACsAJwBTAEwCdAJwAPQA8ADUALwAKAQAAaAAAABEADwAADHd3dy5iaW5nLmNvbQAKAAgABgAdABcAGAALAAIBAAANABQAEgQBBQECAQQDBQMCAwICBgEGAwAjAAAAEAAOAAwCaDIIaHR0cC8xLjEAFwAAABgABgAKAwIBAP8BAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 02371{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"4in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1543235434,"pkt_ts_usec":19248,"pkt_caplen":1514,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1514,"pkt_l4_len":1412,"pkt":"AAECunaOAAAASfSHht1gAAAABYQEPTRKupQVKqw0AAAAAAAAACoi4BaF7ac4zFi98\/GqPyLYRQAFhEuhQABhBvQeCgoKAcCoAAEBu\/vHAwzKj9\/hP2NQEAQEHmIAABYDAxNZAgAAWgMDW5uXESPnDY6GVdXogmmrS1WdR7CnjiCJLtiMMET4LR0g70cAAGowHs5bbipHOvpkse5qjMhnnSOXdm6lLVoWT1DALwAAEgAQAAUAAwJoMgAXAAD\/AQABAAsAEccAEcQADAYwggwCMIIJ6qADAgECAhMtAAAymdcHHbfRcIpCAAAAADKZMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xNzA3MjAxNzQ3MDhaFw0xOTA3MTAxNzQ3MDhaMBcxFTATBgNVBAMTDHd3dy5iaW5nLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALqOyD7\/sOUit2AU5xoOUrdFD2wiCQmyCmP5nEBsh7fOLKKYjGNWUdfzumqBdw2Fpg1sIUPSI+b5pR9u\/gYNMtH4Aivx5J6CrFn4IFOhgzrs2GlVitrUoC9jheCrGis7gUH0hZglGqEjdJl5neUsrm31e5QyJwbyXnacl+k91de8FxrbBQKrwUcQ5sbzW8nMRIDSG0ss9ON1RYFCdc+JblurOUYfPO\/whJXqO0Ms01rklGWFKVeGj7qkJ52E0Xsw\/jJNpqe0+8AQstFZfXdWGOCgJxEIK7SzyvFbkO5VaXY9vaLDfkwWc1aVyhXCrQCMB8YD7ERtr9YuJ3qp+RBy1iMCAwEAAaOCB9AwggfMMB0GA1UdDgQWBBQJh+WFKXgwICWz3X7cbO2lKagDcDALBgNVHQ8EBAMCBLAwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCARAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMIIFbQYDVR0RBIIFZDCCBWCCDHd3dy5iaW5nLmNvbYIQZGljdC5iaW5nLmNvbS5jboITKi5wbGF0Zm9ybS5iaW5nLmNvbYIKKi5iaW5nLmNvbYIIYmluZy5jb22CFmllb25saW5lLm1pY3Jvc28AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"4in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1543235434019,"flow_last_seen":1543235434019,"flow_tot_l4_data_len":1780,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1412,"flow_avg_l4_data_len":445,"midstream":0,"l3_proto":"ip6","src_ip":"22e0:1685:eda7:38cc:58bd:f3f1:aa3f:22d8","dst_ip":"344a:ba94:152a:ac34::2a","l4_proto":4,"flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"4in6tunnel.pcap","alias":"nDPId-test"} diff --git a/test/results/6in4tunnel.pcap.out b/test/results/6in4tunnel.pcap.out index d50cd99b5..0f7642fce 100644 --- a/test/results/6in4tunnel.pcap.out +++ b/test/results/6in4tunnel.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"6in4tunnel.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00444{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"6in4tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1444236893450,"flow_last_seen":0,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":104,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"174.3.73.24","dst_ip":"184.105.255.26","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} 00528{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"6in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444236893,"pkt_ts_usec":450580,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"ACKQ3jvZAAAkzoE0CABFAAB8tYFAAP8pFzeuA0kYuGn\/GmAAAAAAQDo\/IAEEcB8XAT8+lw7\/\/nNN7CYEqIAAAQAgAAAAAAIksAGAAOC9XY8BWl1OFVYAAAAAqN0GAAAAAAAQERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} 00527{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"6in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444236893,"pkt_ts_usec":555356,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"AAAkzoE0ACKQ3jvZCABFAAB8xlZAAPgpDWK4af8argNJGGAAAAAAQDo3JgSogAABACAAAAAAAiSwASABBHAfFwE\/PpcO\/\/5zTeyBAN+9XY8BWl1OFVYAAAAAqN0GAAAAAAAQERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} @@ -14,3 +15,6 @@ 00529{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"6in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444236898,"pkt_ts_usec":563922,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"AAAkzoE0ACKQ3jvZCABFAAB8xltAAPgpDV24af8argNJGGAAAAAAQDo3JgSogAABACAAAAAAAiSwASABBHAfFwE\/PpcO\/\/5zTeyBAGyeXY8BX2JOFVYAAAAAFvgGAAAAAAAQERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} 00530{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"6in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444236899,"pkt_ts_usec":458727,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"ACKQ3jvZAAAkzoE0CABFAAB8uBRAAP8pFKSuA0kYuGn\/GmAAAAAAQDo\/IAEEcB8XAT8+lw7\/\/nNN7CYEqIAAAQAgAAAAAAIksAGAAO2XXY8BYGNOFVYAAAAAlf0GAAAAAAAQERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} 00529{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"6in4tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444236899,"pkt_ts_usec":563862,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"AAAkzoE0ACKQ3jvZCABFAAB8xlxAAPgpDVy4af8argNJGGAAAAAAQDo3JgSogAABACAAAAAAAiSwASABBHAfFwE\/PpcO\/\/5zTeyBAOyXXY8BYGNOFVYAAAAAlf0GAAAAAAAQERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3"} +00477{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":127,"source":"6in4tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":127,"flow_first_seen":1444236893450,"flow_last_seen":1444236915586,"flow_tot_l4_data_len":35975,"flow_min_l4_data_len":72,"flow_max_l4_data_len":1877,"flow_avg_l4_data_len":283,"midstream":0,"l3_proto":"ip4","src_ip":"174.3.73.24","dst_ip":"184.105.255.26","l4_proto":41,"ndpi": {"proto":"Unknown","breed":"Unrated"}} +00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":127,"source":"6in4tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":127,"flow_first_seen":1444236893450,"flow_last_seen":1444236915586,"flow_tot_l4_data_len":35975,"flow_min_l4_data_len":72,"flow_max_l4_data_len":1877,"flow_avg_l4_data_len":283,"midstream":0,"l3_proto":"ip4","src_ip":"174.3.73.24","dst_ip":"184.105.255.26","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":127,"source":"6in4tunnel.pcap","alias":"nDPId-test"} diff --git a/test/results/6in6tunnel.pcap.out b/test/results/6in6tunnel.pcap.out index c57dd8c3f..e596d43bc 100644 --- a/test/results/6in6tunnel.pcap.out +++ b/test/results/6in6tunnel.pcap.out @@ -1,4 +1,10 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"6in6tunnel.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1335197872162,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"2001:4f8:4:7:2e0:81ff:fe52:ffff","dst_ip":"2001:4f8:4:7:2e0:81ff:fe52:9a6b","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} 00497{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"6in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1335197872,"pkt_ts_usec":162188,"pkt_caplen":106,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":106,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/AAAAAAAAht1gAAAAADQpQCABBPgABAAHAuCB\/\/5S\/\/8gAQT4AAQABwLggf\/+UpprYAAAAAAMEUDerQAAAAAAAAAAAAAAAL7vyv4AAAAAAAAAAAAAAAC6vnUwMsgADIPSWFhYWA=="} 00435{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1335197872164,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"feed::beef","dst_ip":"feed::cafe","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} 00493{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1335197872,"pkt_ts_usec":164220,"pkt_caplen":106,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":106,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/AAAAAAAAht1gAAAAADQpQP7tAAAAAAAAAAAAAAAAvu\/+7QAAAAAAAAAAAAAAAMr+YAAAAAAMEUDerQAAAAAAAAAAAAAAAL7vyv4AAAAAAAAAAAAAAAC6vnUwMsgADIHQWVlZWQ=="} +00492{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1335197872162,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"2001:4f8:4:7:2e0:81ff:fe52:ffff","dst_ip":"2001:4f8:4:7:2e0:81ff:fe52:9a6b","l4_proto":41,"ndpi": {"proto":"Unknown","breed":"Unrated"}} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1335197872162,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"2001:4f8:4:7:2e0:81ff:fe52:ffff","dst_ip":"2001:4f8:4:7:2e0:81ff:fe52:9a6b","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} +00450{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1335197872164,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"feed::beef","dst_ip":"feed::cafe","l4_proto":41,"ndpi": {"proto":"Unknown","breed":"Unrated"}} +00436{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1335197872164,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip6","src_ip":"feed::beef","dst_ip":"feed::cafe","l4_proto":41,"flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"6in6tunnel.pcap","alias":"nDPId-test"} diff --git a/test/results/BGP_Cisco_hdlc_slarp.pcap.out b/test/results/BGP_Cisco_hdlc_slarp.pcap.out index 1c7415cd5..4fa042be7 100644 --- a/test/results/BGP_Cisco_hdlc_slarp.pcap.out +++ b/test/results/BGP_Cisco_hdlc_slarp.pcap.out @@ -1,3 +1,4 @@ +00397{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00369{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1445156939,"pkt_ts_usec":131847,"pkt_caplen":48,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":48,"pkt_l4_len":0,"pkt":"DwAIAEXAACz4kkAAAQa2VmQQAQJkEAEBR5QAs7zqddEAAAAAYAJAABMAAAACBAW0"} 00171{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","datalink":9} 00370{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1445156939,"pkt_ts_usec":145123,"pkt_caplen":48,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":48,"pkt_l4_len":0,"pkt":"DwAIAEXAACyvfwAAAQY\/amQQAQFkEAECALNHlBlZ03+86nXSYBJAACYWAAACBAW0"} @@ -26,3 +27,4 @@ 00172{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":13,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","datalink":9} 00366{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":14,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1445156989,"pkt_ts_usec":230918,"pkt_caplen":44,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":44,"pkt_l4_len":0,"pkt":"DwAIAEXAACj4mEAAAQa2VGQQAQJkEAEBR5QAs7zqdh4ZWdSNUBA+8z2HAAA="} 00172{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":14,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test","datalink":9} +00140{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":14,"source":"BGP_Cisco_hdlc_slarp.pcap","alias":"nDPId-test"} diff --git a/test/results/BGP_redist.pcap.out b/test/results/BGP_redist.pcap.out index a77b491c5..1fa075aa3 100644 --- a/test/results/BGP_redist.pcap.out +++ b/test/results/BGP_redist.pcap.out @@ -1,4 +1,6 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"BGP_redist.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00539{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"BGP_redist.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1256636836,"pkt_ts_usec":167156,"pkt_caplen":163,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":163,"pkt_l4_len":0,"pkt":"DwCIRwABLf5FwACbk8xAAP8G2sQCAgICBAQEBACz+C\/VqGxJPJL2UFAYP7QOoQAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/wBzAgAAAFxAAQECQAIAgAQEAAAAVkAFBAAAAGTAECAAAgBkAAAEVwAFAAAAAQIAgAAAAAAAAwCAAawQAgEAAIAOIQABgAwAAAAAAAAAAAICAgIAeAABkQAAAGQAAABkqgAAAA=="} 00163{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"BGP_redist.pcap","alias":"nDPId-test","datalink":104} 00534{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"BGP_redist.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1256636836,"pkt_ts_usec":167195,"pkt_caplen":159,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":159,"pkt_l4_len":0,"pkt":"DwAIAEXAAJv\/w0AA\/gZtywICAgIFBQUFALPBGWeqNFC\/WbBkUBg\/x6y+AAD\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/AHMCAAAAXEABAQJAAgCABAQAAABWQAUEAAAAZMAQIAACAGQAAARXAAUAAAABAgCAAAAAAAADAIABrBACAQAAgA4hAAGADAAAAAAAAAAAAgICAgB4AAGRAAAAZAAAAGSqAAAA"} 00163{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":2,"source":"BGP_redist.pcap","alias":"nDPId-test","datalink":104} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"BGP_redist.pcap","alias":"nDPId-test"} diff --git a/test/results/EAQ.pcap.out b/test/results/EAQ.pcap.out index 8d4716aa3..eec259231 100644 --- a/test/results/EAQ.pcap.out +++ b/test/results/EAQ.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"EAQ.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432820948562,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.194.119.48","src_port":53497,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00430{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"EAQ.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820948,"pkt_ts_usec":562939,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8xb9AAEAGRgEKCAABrcJ3MND5AFA4ezYlAAAAAKACOQisdgAAAgQFtAQCCAoABPOaAAAAAAEDAwQ="} 00404{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"EAQ.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820948,"pkt_ts_usec":566510,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAAJAABAGO9OtwncwCggAAQBQ0PnHhMnaOHs2JlAS\/\/+vjAAA"} @@ -489,3 +490,22 @@ 00415{"flow_id":19,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"EAQ.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432821045,"pkt_ts_usec":664807,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"ABoRAAACABoRAAABCABFAAAsADNAABARE3\/IwoRECggAARdwzfYAGKtMAAAABAAADeIAB6oNAABgAA=="} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1432821045664,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.133.66","src_port":56128,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00414{"flow_id":104,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432821045,"pkt_ts_usec":664868,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"ABoRAAACABoRAAABCABFAAAsAABAAEAR4rMKCAAByMKFQttAF3AAGE3JAAAABAAADeIAB8lIAACQAA=="} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1432821044555,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.141.67","src_port":48563,"dst_port":6000,"l4_proto":"udp","ndpi": {"proto":"EAQ","breed":"Acceptable","category":"Network"}} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1432821044555,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.141.67","src_port":48563,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":10,"flow_first_seen":1432820959035,"flow_last_seen":1432821045664,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.132.68","src_port":52726,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":10,"flow_first_seen":1432820949685,"flow_last_seen":1432821035985,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.185.125.226","src_port":48890,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1432821042151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.66","src_port":48666,"dst_port":6000,"l4_proto":"udp","ndpi": {"proto":"EAQ","breed":"Acceptable","category":"Network"}} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1432821042151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.66","src_port":48666,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":10,"flow_first_seen":1432820950801,"flow_last_seen":1432821036105,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.148.66","src_port":42620,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":10,"flow_first_seen":1432820958981,"flow_last_seen":1432821045604,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.132.67","src_port":39185,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":10,"flow_first_seen":1432820949735,"flow_last_seen":1432821036045,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.148.67","src_port":51569,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1432821043151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.68","src_port":47714,"dst_port":6000,"l4_proto":"udp","ndpi": {"proto":"EAQ","breed":"Acceptable","category":"Network"}} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1432821043151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.68","src_port":47714,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":10,"flow_first_seen":1432820950865,"flow_last_seen":1432821036155,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.148.68","src_port":43641,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":10,"flow_first_seen":1432820949586,"flow_last_seen":1432821035895,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.185.138.146","src_port":52257,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1432821045664,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.133.66","src_port":56128,"dst_port":6000,"l4_proto":"udp","ndpi": {"proto":"EAQ","breed":"Acceptable","category":"Network"}} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1432821045664,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.133.66","src_port":56128,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":10,"flow_first_seen":1432820957932,"flow_last_seen":1432821044555,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.132.66","src_port":43979,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1432821041151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.67","src_port":37985,"dst_port":6000,"l4_proto":"udp","ndpi": {"proto":"EAQ","breed":"Acceptable","category":"Network"}} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1432821041151,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.194.129.67","src_port":37985,"dst_port":6000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":197,"source":"EAQ.pcap","alias":"nDPId-test"} diff --git a/test/results/IEC104.pcap.out b/test/results/IEC104.pcap.out index a72cd7ac5..a2f6131e9 100644 --- a/test/results/IEC104.pcap.out +++ b/test/results/IEC104.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"IEC104.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"IEC104.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1317629088495,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.175.211.1","dst_ip":"10.119.105.26","src_port":2404,"dst_port":54768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00414{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"IEC104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1317629088,"pkt_ts_usec":495135,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"eCvLK7lWABIAxkrACABFAAAoUqRAAH0GWeoKr9MBCndpGglk1fBIoLt3AFkTVVAQ\/elpjgAAAAAAAAAA"} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"IEC104.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1317629088520,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.175.211.3","dst_ip":"10.119.105.26","src_port":2404,"dst_port":54769,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -17,3 +18,6 @@ 00563{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"IEC104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1317629090,"pkt_ts_usec":298203,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"eCvLK7lWABIAxkrACABFAACaGK9AAH0Gk20Kr9MBCndpGglk1fBIoL1FAFkTVVAY\/emmigAAaFUyfkK5JAUDABQpDw8bAACAPwAF3wKKIwoLDw8ZAAAAQgAF3wKKIwoLDw8eAACAPwAF3wKKIwoLDw8SAIDDQgAF3wKKIwoLDw8Qq6q0QgAF3wKKIwoLaBk0fkK5JAEDABQqDw4Rq6qwQgAF3wKKIwoL"} 00408{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"IEC104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1317629090,"pkt_ts_usec":496349,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAAMB6wBeCvLK7lWCABFAAAoMG9AAIAGAAAKd2kaCq\/TAdXwCWQAWRNVSKC9t1AQAPxRXAAA"} 00444{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"IEC104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1317629090,"pkt_ts_usec":498077,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"eCvLK7lWABIAxkrACABFAABDGPtAAH0Gk3gKr9MBCndpGglk1fBIoL23AFkTVVAY\/emDkQAAaBk2fkK5JAEDABQpy68CzcwsvgA94AKKIwoL"} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":15,"source":"IEC104.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1317629088495,"flow_last_seen":1317629090498,"flow_tot_l4_data_len":843,"flow_min_l4_data_len":20,"flow_max_l4_data_len":272,"flow_avg_l4_data_len":70,"midstream":1,"l3_proto":"ip4","src_ip":"10.175.211.1","dst_ip":"10.119.105.26","src_port":2404,"dst_port":54768,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":15,"source":"IEC104.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1317629088520,"flow_last_seen":1317629088739,"flow_tot_l4_data_len":66,"flow_min_l4_data_len":20,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":22,"midstream":1,"l3_proto":"ip4","src_ip":"10.175.211.3","dst_ip":"10.119.105.26","src_port":2404,"dst_port":54769,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":15,"source":"IEC104.pcap","alias":"nDPId-test"} diff --git a/test/results/KakaoTalk_chat.pcap.out b/test/results/KakaoTalk_chat.pcap.out index 8936da117..fa1003db5 100644 --- a/test/results/KakaoTalk_chat.pcap.out +++ b/test/results/KakaoTalk_chat.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00403{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069021,"pkt_ts_usec":959113,"pkt_caplen":76,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":76,"pkt_l4_len":0,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwAAEAAQBHSIAoYUrwKvAEBljAANQAogKaG7QEAAAEAAAAAAAAEYXV0aAVrYWthbwNjb20AAAEAAQ=="} 00167{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","datalink":113} 00405{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":6995,"pkt_caplen":79,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":79,"pkt_l4_len":0,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAD8AAEAAQBHSHQoYUrwKvAEBixMANQArGNJpegEAAAEAAAAAAAAHYWMtdGFsawVrYWthbwNjb20AAAEAAQ=="} @@ -692,3 +693,4 @@ 00169{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":346,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","datalink":113} 02261{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":299933,"pkt_caplen":1456,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":1456,"pkt_l4_len":0,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABaAUu0AALgahAjb\/\/ccKGFK8FGfmVG+Fj0Y6r4+vgBAARqHKAAABAQgKNOib\/AACo2cWAwEGtQIAAEYDAVU9H1Gb\/qiDm98eXfIJxb4shEK1GhPjZeBEv8P67\/0aIFU9H1G382hmASwGnCuJDP0Mh2TynvUtxumEykegoF7eAAQACwAGYwAGYAADPjCCAzowggKjoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwgaQxCzAJBgNVBAYTAktSMRQwEgYDVQQIDAtHeWVvbmdnaSBkbzEOMAwGA1UEBwwFU3V3b24xJTAjBgNVBAoMHFNBTVNVTkcgRUxFQ1RST05JQ1MgQ08uLCBMVEQxHjAcBgNVBAMMFSoucHVzaC5zYW1zdW5nb3NwLmNvbTEoMCYGCSqGSIb3DQEJARYZYWRtaW5AcHVzaC5zYW1zdW5nb3NwLmNvbTAeFw05OTEyMzExNTA1MDRaFw00OTEyMTgxNTA1MDRaMIGUMQswCQYDVQQGEwJLUjEUMBIGA1UECAwLR3llb25nZ2kgZG8xJTAjBgNVBAoMHFNBTVNVTkcgRUxFQ1RST05JQ1MgQ08uLCBMVEQxHjAcBgNVBAMMFSoucHVzaC5zYW1zdW5nb3NwLmNvbTEoMCYGCSqGSIb3DQEJARYZYWRtaW5AcHVzaC5zYW1zdW5nb3NwLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsyrNiMIXJ++fpsiI08sYxPZbKOY56a37f6J9ViQReAUe3UWF2fdOff49ukAjUISbhahOinbZux+ildb7qUyHJVHQXanBrQsLoODvfOiws0bRofk+EjA3+puR1KI8EgNDCJfkzYF40k16LBiMv6fKIGXOV6sbZciKSSDD+AX5+08CAwEAAaOBiTCBhjAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUHQ6IKqRzfLkHpPDYYWaWWRoHaGswHwYDVR0jBBgwFoAUWMjZPBPgzaBussvwASa64F2DMFEwCwYDVR0PBAQDAgXgMA0GCSqGSIb3DQEBBQUAA4GBALo4j8DvDTq0WR5v2UJovDtyilA1Zel1mK2n\/GtzjEjxAUkMxaGxxxnaEWdSVH0\/0pG7jG3ieJSWSLWW4HdJJ+ZytoamKq2k87O5sF5LkM+ZGg+UlFyFpcvLuYXtbZHa4CFAnYmBZ5nQNz06gzWDYU9\/yRhZSf2unf7zNha\/BodKAAMcMIIDGDCCAoGgAwIBAgIJAPMld7YDENSnMA0GCSqGSIb3DQEBBQUAMIGkMQswCQYDVQQGEwJLUjEUMBIGA1UECAwLR3llb25nZ2kgZG8xDjAMBgNVBAcMBVN1d29uMSUwIwYDVQQKDBxTQU1TVU5HIEVMRUNUUk9OSUNTIENPLiwgTFREMR4wHAYDVQQDDBUqLnB1c2guc2Ftc3VuZ29zcC5jb20xKDAmBgkqhkiG9w0BCQEWGWFkbWluQHB1c2guc2Ftc3VuZ29zcC5jb20wHhcNOTkxMjMxMTUwMjEwWhcNNDkxMjE4MTUwMjEwWjCBpDELMAkGA1UEBhMCS1IxFDASBgNVBAgMC0d5ZW9uZ2dpIGRvMQ4wDAYDVQQHDAVTdXdvbjElMCMGA1UECgwcU0FNU1VORyBFTEVDVFJPTklDUyBDTy4sIExURDEeMBwGA1UEAwwVKi5wdXNoLnNhbXN1bmdvc3AuY29tMSgwJgYJKoZIhvcNAQkBFhlhZG1pbkBwdXNoLnNhbXN1bmdvc3AuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS\/wx087bX6AA7bz\/rPd\/AOtm8g1ebRfENevGCnMrnUw=="} 00169{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","datalink":113} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test"} diff --git a/test/results/KakaoTalk_talk.pcap.out b/test/results/KakaoTalk_talk.pcap.out index 2f7c85912..38c0fc52e 100644 --- a/test/results/KakaoTalk_talk.pcap.out +++ b/test/results/KakaoTalk_talk.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069140,"pkt_ts_usec":120551,"pkt_caplen":130,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":130,"pkt_l4_len":0,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAHLza0AAPwZJVQoYUrxn9jn7x00fkMsN+RcrPwfugBgApZHwAAABAQgKAAs11Jj3Xso6AAAArVkC\/4gP\/deLY5qAl+gvk5f8xql5QXAwvM9bb5tQyHwtP1GibAaltsw94jGcvj4NNAB8Nc8SXCTCPg=="} 00167{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","datalink":113} 00392{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069140,"pkt_ts_usec":453803,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADRbKkAALgby1Gf2OfsKGFK8H5DHTSs\/B+7LDflVgBAADqYIAAABAQgKmPgkmwALNdQ="} @@ -6404,3 +6405,4 @@ 00170{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":3202,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","datalink":113} 00971{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":3203,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069216,"pkt_ts_usec":559027,"pkt_caplen":490,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":490,"pkt_l4_len":0,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAdoKMEAAjgb4BouWAH0KGFK8Abu3Y2Ij1jlRKAS0UBifXH0zAACuAQAASco9e7VdqRc+Gkt7POZ3iw2F7xO4X2pC90c2WlKrkfUQp81wR7\/apKWRUN0xPn3rHrbfRdi+XhHa+j4GRhmQQo\/WP2OspzKBm3YLCNKlzTZ8kvGwZaDeSN6zsmCH4s4re40+RQD92a4DC1ldY8M0G8hP9VOib0DJc8A\/U\/Hl7Yga02rJ0WU9\/xZx0Y6IJDivqf2F6fu0KFw9\/9fRYLX4a4x4Dr04QF6nYY2hppUHqN+VoOshDOfBSjLOUu9eZW5XsK1QKV3ankWOeHcuur1QBnDUH7AyyKw05AsWLTgn93O9gTlO+KcD06aYGem2n3YDlKyjAH0YiG7yWXnHwud76KDQSYBeZwVKZUdN03qYy46C+rNDMk1+00VzRWs8Md0kD\/3WMG7IkKoLgycycmrBfqojZNvS0\/0M4FWQtEgD0\/9joTJQJuB7Q89d9iEB\/EX6dWqIJrF\/uwZ62wHFVsQVYEl6gV8ebF1xuilClTTE9Kv1ehLuEA6uKjKq32J1m2Se02dJBOb3S7pO0rsp3AvylwOa4z1IIKA5no19mPAA1kDKuhcfIna6FJ+5AXdIvA=="} 00170{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":3203,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test","datalink":113} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3203,"source":"KakaoTalk_talk.pcap","alias":"nDPId-test"} diff --git a/test/results/NTPv2.pcap.out b/test/results/NTPv2.pcap.out index f4038b920..71e60ebf2 100644 --- a/test/results/NTPv2.pcap.out +++ b/test/results/NTPv2.pcap.out @@ -1,3 +1,6 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"NTPv2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":376,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":376,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00883{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436865383,"pkt_ts_usec":632810,"pkt_caplen":410,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":410,"pkt_l4_len":376,"pkt":"RIpbLCrSACaIdf8bCABFAAGMHS4AADERoZDQaF8KTi5MAgB7AFABeH6Xlw4DKgAFAEgAAAAAAAAQOgAAAAAAAAGISO9ZbawQDGUAAAABDAIHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAQZwAAAAAAAADHQLufDawQDGUAAAABuxwHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQxAAAAAAAAAa6UEgp0qwQDGUAAAABKtoHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ2AAAAAAAAAWzX1q4C6wQDGUAAAABAFAHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ2wAAAAAAAAWRR3um9qwQDGUAAAABAFAHAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} 00499{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":376,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":376,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}} +00470{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865383632,"flow_last_seen":0,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":376,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":376,"midstream":0,"l3_proto":"ip4","src_ip":"208.104.95.10","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"NTPv2.pcap","alias":"nDPId-test"} diff --git a/test/results/NTPv3.pcap.out b/test/results/NTPv3.pcap.out index 599dd380a..dc6671195 100644 --- a/test/results/NTPv3.pcap.out +++ b/test/results/NTPv3.pcap.out @@ -1,3 +1,6 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"NTPv3.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00466{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436865405,"pkt_ts_usec":371462,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"RIpbLCrSACaIdf8bCABFAABMAABAADcRbcOvkIwdTi5MAgB7AFAAOLcYHAAE+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADZT08RAAAAANlPTxEAAAAA"} 00496{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}} +00467{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865405371,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"175.144.140.29","dst_ip":"78.46.76.2","src_port":123,"dst_port":80,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"NTPv3.pcap","alias":"nDPId-test"} diff --git a/test/results/NTPv4.pcap.out b/test/results/NTPv4.pcap.out index 7a5af650a..4459a127b 100644 --- a/test/results/NTPv4.pcap.out +++ b/test/results/NTPv4.pcap.out @@ -1,3 +1,6 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"NTPv4.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00466{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"NTPv4.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865396190,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"85.22.62.120","dst_ip":"78.46.76.11","src_port":123,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"NTPv4.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436865396,"pkt_ts_usec":190857,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"RIpb2HMEACaIdf8bCABFAABMrX9AADcRaFpVFj54Ti5MCwB7AHsAOKmfIwIH6wAABFAAAAOrg7wD39lPUcMxZbhg2URXVTAzb9DZRFdVMbTpeNlPUfQtJuL0"} 00496{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"NTPv4.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865396190,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"85.22.62.120","dst_ip":"78.46.76.11","src_port":123,"dst_port":123,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}} +00467{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"NTPv4.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436865396190,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"85.22.62.120","dst_ip":"78.46.76.11","src_port":123,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"NTPv4.pcap","alias":"nDPId-test"} diff --git a/test/results/Oscar.pcap.out b/test/results/Oscar.pcap.out index 3235aa6ea..e7c9b17b3 100644 --- a/test/results/Oscar.pcap.out +++ b/test/results/Oscar.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"Oscar.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"Oscar.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1434606464176,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"10.30.29.3","dst_ip":"178.237.24.249","src_port":63357,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"Oscar.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434606464,"pkt_ts_usec":176482,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAxCW5ILDE3pmjdICABFAABAZ9pAAEAGAAAKHh0Dsu0Y+fd9Abu9oGylAAAAALAC\/\/\/zOQAAAgQFtAEDAwUBAQgKFdAS4wAAAAAEAgAA"} 00414{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"Oscar.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434606464,"pkt_ts_usec":205135,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"DE3pmjdIAAxCW5ILCABFAAAsd\/VAAG8GoM+y7Rj5Ch4dAwG7933\/L+hsvaBspmASQABaVgAAAgQFUAAA"} @@ -14,3 +15,6 @@ 02230{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"Oscar.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434606464,"pkt_ts_usec":315224,"pkt_caplen":1414,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1414,"pkt_l4_len":1380,"pkt":"DE3pmjdIAAxCW5ILCABFAAV4eAxAAG8Gm2yy7Rj5Ch4dAwG7933\/L+sGvaBuJVAQQACxfQAAKgIZjwZzAAEABwAAAAAAAgAFAAEAAABQAAAJxAAAB9AAAAXcAAADIAAAFtsAABdwAAAAAAAAAgAAAFAAAAu4AAAH0AAABdwAAAPoAAAXcAAAF3AAAABAAAADAAAAFAAADBwAAAnEAAAH0AAABdwAAA2sAAARlAAAAEAAAAQAAAAUAAAVfAAAFLQAABBoAAALuAAAF3AAAB9AAAAAQAAABQAAAAoAABV8AAAUtAAAEGgAAAu4AAAXcAAAH0AAAABAAAABAV0AAQABAAEAAgABAAMAAQAEAAEABQABAAYAAQAHAAEACAABAAkAAQAKAAEACwABAAwAAQANAAEADgABAA8AAQAQAAEAEQABABIAAQATAAEAFAABABUAAQAWAAEAFwABABgAAQAZAAEAGgABABsAAQAcAAEAHQABAB8AAQAgAAEAIQABACIAAQAjAAEAJAABACUAAQAmAAEAJwABACgAAgABAAIAAgACAAMAAgAEAAIABgACAAcAAgAIAAIACgACAAwAAgANAAIADgACAA8AAgAQAAIAEQACABIAAgATAAIAFAACABUAAgAWAAIAFwACABgAAgAZAAMAAQADAAIAAwADAAMABgADAAcAAwAIAAMACQADAAoAAwALAAMADAADAA0AAwAOAAMADwADABAAAwARAAMAEgADABMAAwAUAAMAFQADABYABAABAAQAAgAEAAMABAAEAAQABQAEAAcABAAIAAQACQAEAAoABAALAAQADAAEAA0ABAAOAAQADwAEABAABAARAAQAEgAEABMABAAUAAQAFQAEABYABAAXAAQAGAAEABkABAAaAAQAGwAEABwABAAdAAQAHgAEAB8ACAABAAgAAgAJAAEACQACAAkAAwAJAAQACQAJAAkACgAJAAsACwABAAsAAgALAAMACwAEABMAAQATAAIAEwADABMABAATAAUAEwAGABMABwATAAgAEwAJABMACgATAAsAEwAMABMADQATAA4AEwAPABMAEAATABEAEwASABMAEwATABQAEwAVABMAFgATABcAEwAYABMAGQATABsAEwAcABMAHQATAB4AEwAfABMAIAATACEAEwAiABMAIwATACQAEwAlABMAJgATACcAEwAoABMAKQATACoAEwArABMALAATAC0AEwAuABMALwATADAAEwAxABMAMgATADMAEwA0ABMANQATADYAEwA3ABMAOAATADkAEwA6ABMAOwATADwAEwA9ABMAPgATAD8AEwBAABMAQQATAEIAEwBDABMARAATAEUAEwBGABMARwATAEgAEwBJABMASgATAEsAEwBMABMATQATAE4AEwBPABMAUAATAFEAEwBSABMAUwATAFQAEwBVABMAVgATAFcAEwBYABMAWQATAFoAEwBbABMAXAATAF0AEwBeABMAXwATAGAAEwBhABMAYgATAGMAEwBkABMAZQATAGYAEwBnABMAaAATAGkAEwBqABMAawATAGwAEwBtABMAbgATAG8AEwBwABMAcQATAHIAEwBzABMAdAATAHUAEwB2ABMAdwATAHgAEwB5ABMAegATAHsAEwB8ABMAfQATAH4AEwB\/ABMAgAATAIEAEwCCABMAgwATAIQAEwCFABMAhgATAIcAEwCIABMAiQATAIoAEwCLABMAjAATAI0AEwCOABMAjwATAJAAEwCRABMAkgATAJMAEwCUABMAlQATAJYAEwCXABMAmAATAJkAEwCaABMAmwATAJwAEwCdABMAngATAJ8AEwCgABMAoQATAKIAEwCjABMApAATAKUAEwCmABMApwATAA=="} 00808{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"Oscar.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434606464,"pkt_ts_usec":316067,"pkt_caplen":351,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":351,"pkt_l4_len":317,"pkt":"DE3pmjdIAAxCW5ILCABFAAFReA1AAG8Gn5Ky7Rj5Ch4dAwG7933\/L\/BWvaBuJVAYQACc7wAAqAATAKkAEwCqABMAqwATAKwAEwCtABMArgATAK8AEwCwABMAsQATALIAEwCzABMAtAATALUAEwC2ABMAtwATALgAEwC5ABMAugATALsAEwC8ABMAvQATAL4AEwC\/ABMAwAATAMEAEwDCABMAwwATAMQAEwDFABMAxgATAMcAEwDIABMAyQATAMoAEwDLABMAzAATAM0AEwDOABMAzwATANAAEwDRABMA0gATANMAFQABABUAAgAVAAMAIgABACIAAgAiAAMAJQABACUAAgAlAAMAJQAEACUABQAlAAYAJQAHACUACAAlAAkAAgAGAAMABAADAAUACQAFAAkABgAJAAcACQAIAAMABAABAB4AAgAFAAQABgATABoABAACAAIACQACAAsABQAA"} 00411{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"Oscar.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434606464,"pkt_ts_usec":316149,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAxCW5ILDE3pmjdICABFAAAorgZAAEAGAAAKHh0Dsu0Y+fd9Abu9oG4l\/y\/xf1AQ\/\/\/zIQAA"} +00507{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":71,"source":"Oscar.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":71,"flow_first_seen":1434606464176,"flow_last_seen":1434606536630,"flow_tot_l4_data_len":6898,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1380,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"10.30.29.3","dst_ip":"178.237.24.249","src_port":63357,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":71,"source":"Oscar.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":71,"flow_first_seen":1434606464176,"flow_last_seen":1434606536630,"flow_tot_l4_data_len":6898,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1380,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"10.30.29.3","dst_ip":"178.237.24.249","src_port":63357,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":71,"source":"Oscar.pcap","alias":"nDPId-test"} diff --git a/test/results/WebattackRCE.pcap.out b/test/results/WebattackRCE.pcap.out index 0a042aa44..51d06db38 100644 --- a/test/results/WebattackRCE.pcap.out +++ b/test/results/WebattackRCE.pcap.out @@ -1,3 +1,4 @@ +00389{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"WebattackRCE.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1576420276577,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49544,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00611{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"WebattackRCE.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576420276,"pkt_ts_usec":577658,"pkt_caplen":199,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":199,"pkt_l4_len":165,"pkt":"AAAAAAAAAAAAAAAACABFAAC5VktAAEAG5fF\/AAABfwAAAcGIH5Al+2Gy82DXQ4AYAED+rQAAAQEICp1m+omdZvqJR0VUIC8gSFRUUC8xLjENClVzZXItQWdlbnQ6IE1vemlsbGEvNS4wMCAoTmlrdG8vMi4xLjYpIChFdmFzaW9uczpOb25lKSAoVGVzdDpQb3J0IENoZWNrKQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KSG9zdDogMTI3LjAuMC4xDQoNCg=="} 00749{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1576420276577,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49544,"dst_port":8080,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"127.0.0.1","url":"127.0.0.1\/","code":0,"content_type":"","user_agent":"Mozilla\/5.00 (Nikto\/2.1.6) (Evasions:None) (Test:Port Check)"}} @@ -2389,3 +2390,801 @@ 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":797,"flow_packet_id":1,"flow_first_seen":1576420278014,"flow_last_seen":0,"flow_tot_l4_data_len":289,"flow_min_l4_data_len":289,"flow_max_l4_data_len":289,"flow_avg_l4_data_len":289,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51204,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00779{"flow_id":797,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576420278,"pkt_ts_usec":14387,"pkt_caplen":323,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":323,"pkt_l4_len":289,"pkt":"AAAAAAAAAAAAAAAACABFAAE1Ck9AAEAGMXJ\/AAABfwAAAcgEH5AitzMTI6HHCIAYAED\/KQAAAQEICp1nACadZwAmR0VUIC9zaGVsbD9jYXQrL2V0Yy9ob3N0cyBIVFRQLzEuMQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KVXNlci1BZ2VudDogTW96aWxsYS81LjAwIChOaWt0by8yLjEuNikgKEV2YXNpb25zOk5vbmUpIChUZXN0OjAwNzIzNSkNCkNvbnRlbnQtTGVuZ3RoOiAzOQ0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQNCkhvc3Q6IDEyNy4wLjAuMQ0KDQp0cmFuc2FjdGlvbl9pZD0xJm9hdXRoX3Rva2VuPSclM2JlY2hvICc="} 00771{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":797,"flow_packet_id":1,"flow_first_seen":1576420278014,"flow_last_seen":0,"flow_tot_l4_data_len":289,"flow_min_l4_data_len":289,"flow_max_l4_data_len":289,"flow_avg_l4_data_len":289,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51204,"dst_port":8080,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","12":"HTTP Numeric IP Address"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"127.0.0.1","url":"127.0.0.1\/shell?cat+\/etc\/hosts","code":0,"content_type":"","user_agent":"Mozilla\/5.00 (Nikto\/2.1.6) (Evasions:None) (Test:007235)"}} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":745,"flow_packet_id":1,"flow_first_seen":1576420277895,"flow_last_seen":0,"flow_tot_l4_data_len":214,"flow_min_l4_data_len":214,"flow_max_l4_data_len":214,"flow_avg_l4_data_len":214,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51052,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":746,"flow_packet_id":1,"flow_first_seen":1576420277896,"flow_last_seen":0,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":224,"flow_max_l4_data_len":224,"flow_avg_l4_data_len":224,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51054,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":747,"flow_packet_id":1,"flow_first_seen":1576420277898,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51056,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":748,"flow_packet_id":1,"flow_first_seen":1576420277899,"flow_last_seen":0,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":208,"flow_max_l4_data_len":208,"flow_avg_l4_data_len":208,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51058,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":749,"flow_packet_id":1,"flow_first_seen":1576420277901,"flow_last_seen":0,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":212,"flow_max_l4_data_len":212,"flow_avg_l4_data_len":212,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51060,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":750,"flow_packet_id":1,"flow_first_seen":1576420277902,"flow_last_seen":0,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":212,"flow_max_l4_data_len":212,"flow_avg_l4_data_len":212,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51062,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":751,"flow_packet_id":1,"flow_first_seen":1576420277903,"flow_last_seen":0,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":241,"flow_max_l4_data_len":241,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51064,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":752,"flow_packet_id":1,"flow_first_seen":1576420277905,"flow_last_seen":0,"flow_tot_l4_data_len":201,"flow_min_l4_data_len":201,"flow_max_l4_data_len":201,"flow_avg_l4_data_len":201,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51066,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":753,"flow_packet_id":1,"flow_first_seen":1576420277907,"flow_last_seen":0,"flow_tot_l4_data_len":205,"flow_min_l4_data_len":205,"flow_max_l4_data_len":205,"flow_avg_l4_data_len":205,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51068,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":754,"flow_packet_id":1,"flow_first_seen":1576420277908,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51070,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":755,"flow_packet_id":1,"flow_first_seen":1576420277909,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51072,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":756,"flow_packet_id":1,"flow_first_seen":1576420277910,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51074,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":757,"flow_packet_id":1,"flow_first_seen":1576420277912,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51076,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":758,"flow_packet_id":1,"flow_first_seen":1576420277913,"flow_last_seen":0,"flow_tot_l4_data_len":164,"flow_min_l4_data_len":164,"flow_max_l4_data_len":164,"flow_avg_l4_data_len":164,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51078,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":759,"flow_packet_id":1,"flow_first_seen":1576420277917,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51080,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":760,"flow_packet_id":1,"flow_first_seen":1576420277919,"flow_last_seen":0,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":208,"flow_max_l4_data_len":208,"flow_avg_l4_data_len":208,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51082,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":761,"flow_packet_id":1,"flow_first_seen":1576420277920,"flow_last_seen":0,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":199,"flow_max_l4_data_len":199,"flow_avg_l4_data_len":199,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51084,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":762,"flow_packet_id":1,"flow_first_seen":1576420277922,"flow_last_seen":0,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":208,"flow_max_l4_data_len":208,"flow_avg_l4_data_len":208,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51086,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":763,"flow_packet_id":1,"flow_first_seen":1576420277923,"flow_last_seen":0,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":199,"flow_max_l4_data_len":199,"flow_avg_l4_data_len":199,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51088,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":764,"flow_packet_id":1,"flow_first_seen":1576420277925,"flow_last_seen":0,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":192,"flow_max_l4_data_len":192,"flow_avg_l4_data_len":192,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51090,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":765,"flow_packet_id":1,"flow_first_seen":1576420277926,"flow_last_seen":0,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":168,"flow_max_l4_data_len":168,"flow_avg_l4_data_len":168,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51092,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":766,"flow_packet_id":1,"flow_first_seen":1576420277928,"flow_last_seen":0,"flow_tot_l4_data_len":231,"flow_min_l4_data_len":231,"flow_max_l4_data_len":231,"flow_avg_l4_data_len":231,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51094,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":767,"flow_packet_id":1,"flow_first_seen":1576420277929,"flow_last_seen":0,"flow_tot_l4_data_len":167,"flow_min_l4_data_len":167,"flow_max_l4_data_len":167,"flow_avg_l4_data_len":167,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51096,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":768,"flow_packet_id":1,"flow_first_seen":1576420277931,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51098,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":769,"flow_packet_id":1,"flow_first_seen":1576420277933,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51100,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":770,"flow_packet_id":1,"flow_first_seen":1576420277971,"flow_last_seen":0,"flow_tot_l4_data_len":328,"flow_min_l4_data_len":328,"flow_max_l4_data_len":328,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51148,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":771,"flow_packet_id":1,"flow_first_seen":1576420277972,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51150,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":772,"flow_packet_id":1,"flow_first_seen":1576420277974,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51152,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":773,"flow_packet_id":1,"flow_first_seen":1576420277975,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51154,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":774,"flow_packet_id":1,"flow_first_seen":1576420277976,"flow_last_seen":0,"flow_tot_l4_data_len":331,"flow_min_l4_data_len":331,"flow_max_l4_data_len":331,"flow_avg_l4_data_len":331,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51156,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":775,"flow_packet_id":1,"flow_first_seen":1576420277977,"flow_last_seen":0,"flow_tot_l4_data_len":342,"flow_min_l4_data_len":342,"flow_max_l4_data_len":342,"flow_avg_l4_data_len":342,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51158,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":776,"flow_packet_id":1,"flow_first_seen":1576420277980,"flow_last_seen":0,"flow_tot_l4_data_len":342,"flow_min_l4_data_len":342,"flow_max_l4_data_len":342,"flow_avg_l4_data_len":342,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51160,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":777,"flow_packet_id":1,"flow_first_seen":1576420277981,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51162,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":778,"flow_packet_id":1,"flow_first_seen":1576420277983,"flow_last_seen":0,"flow_tot_l4_data_len":328,"flow_min_l4_data_len":328,"flow_max_l4_data_len":328,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51164,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":779,"flow_packet_id":1,"flow_first_seen":1576420277984,"flow_last_seen":0,"flow_tot_l4_data_len":331,"flow_min_l4_data_len":331,"flow_max_l4_data_len":331,"flow_avg_l4_data_len":331,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51166,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":780,"flow_packet_id":1,"flow_first_seen":1576420277986,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51168,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":781,"flow_packet_id":1,"flow_first_seen":1576420277988,"flow_last_seen":0,"flow_tot_l4_data_len":342,"flow_min_l4_data_len":342,"flow_max_l4_data_len":342,"flow_avg_l4_data_len":342,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51170,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":782,"flow_packet_id":1,"flow_first_seen":1576420277989,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51172,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":783,"flow_packet_id":1,"flow_first_seen":1576420277991,"flow_last_seen":0,"flow_tot_l4_data_len":342,"flow_min_l4_data_len":342,"flow_max_l4_data_len":342,"flow_avg_l4_data_len":342,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51174,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":784,"flow_packet_id":1,"flow_first_seen":1576420277992,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51176,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":785,"flow_packet_id":1,"flow_first_seen":1576420277993,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51178,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":786,"flow_packet_id":1,"flow_first_seen":1576420277997,"flow_last_seen":0,"flow_tot_l4_data_len":610,"flow_min_l4_data_len":610,"flow_max_l4_data_len":610,"flow_avg_l4_data_len":610,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51182,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":787,"flow_packet_id":1,"flow_first_seen":1576420277998,"flow_last_seen":0,"flow_tot_l4_data_len":617,"flow_min_l4_data_len":617,"flow_max_l4_data_len":617,"flow_avg_l4_data_len":617,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51184,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":788,"flow_packet_id":1,"flow_first_seen":1576420278000,"flow_last_seen":0,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":292,"flow_max_l4_data_len":292,"flow_avg_l4_data_len":292,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51186,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":789,"flow_packet_id":1,"flow_first_seen":1576420278001,"flow_last_seen":0,"flow_tot_l4_data_len":297,"flow_min_l4_data_len":297,"flow_max_l4_data_len":297,"flow_avg_l4_data_len":297,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51188,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":790,"flow_packet_id":1,"flow_first_seen":1576420278002,"flow_last_seen":0,"flow_tot_l4_data_len":301,"flow_min_l4_data_len":301,"flow_max_l4_data_len":301,"flow_avg_l4_data_len":301,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51190,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":791,"flow_packet_id":1,"flow_first_seen":1576420278004,"flow_last_seen":0,"flow_tot_l4_data_len":297,"flow_min_l4_data_len":297,"flow_max_l4_data_len":297,"flow_avg_l4_data_len":297,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51192,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":792,"flow_packet_id":1,"flow_first_seen":1576420278005,"flow_last_seen":0,"flow_tot_l4_data_len":307,"flow_min_l4_data_len":307,"flow_max_l4_data_len":307,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51194,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":793,"flow_packet_id":1,"flow_first_seen":1576420278006,"flow_last_seen":0,"flow_tot_l4_data_len":299,"flow_min_l4_data_len":299,"flow_max_l4_data_len":299,"flow_avg_l4_data_len":299,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51196,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":794,"flow_packet_id":1,"flow_first_seen":1576420278008,"flow_last_seen":0,"flow_tot_l4_data_len":303,"flow_min_l4_data_len":303,"flow_max_l4_data_len":303,"flow_avg_l4_data_len":303,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51198,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":795,"flow_packet_id":1,"flow_first_seen":1576420278010,"flow_last_seen":0,"flow_tot_l4_data_len":299,"flow_min_l4_data_len":299,"flow_max_l4_data_len":299,"flow_avg_l4_data_len":299,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51200,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":796,"flow_packet_id":1,"flow_first_seen":1576420278012,"flow_last_seen":0,"flow_tot_l4_data_len":309,"flow_min_l4_data_len":309,"flow_max_l4_data_len":309,"flow_avg_l4_data_len":309,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51202,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":797,"flow_packet_id":1,"flow_first_seen":1576420278014,"flow_last_seen":0,"flow_tot_l4_data_len":289,"flow_min_l4_data_len":289,"flow_max_l4_data_len":289,"flow_avg_l4_data_len":289,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51204,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1576420276577,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49544,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1576420276660,"flow_last_seen":0,"flow_tot_l4_data_len":162,"flow_min_l4_data_len":162,"flow_max_l4_data_len":162,"flow_avg_l4_data_len":162,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49546,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1576420276662,"flow_last_seen":0,"flow_tot_l4_data_len":164,"flow_min_l4_data_len":164,"flow_max_l4_data_len":164,"flow_avg_l4_data_len":164,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49548,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1576420276665,"flow_last_seen":0,"flow_tot_l4_data_len":204,"flow_min_l4_data_len":204,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":204,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49550,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1576420276666,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49552,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1576420276667,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49554,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1576420276668,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49556,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1576420276669,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49558,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1576420276672,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49560,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1576420276673,"flow_last_seen":0,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":186,"flow_max_l4_data_len":186,"flow_avg_l4_data_len":186,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49562,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1576420276675,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49564,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1576420276676,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49566,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1576420276677,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49568,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1576420276678,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49570,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1576420276679,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49572,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1576420276680,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49574,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1576420276681,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49576,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1576420276683,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49578,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1576420276685,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49580,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1576420276686,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49582,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1576420276687,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49584,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1576420276689,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49586,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1576420276690,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49588,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1576420276692,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49590,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1576420276694,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49592,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1576420276695,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49594,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1576420276697,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49596,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1576420276699,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49598,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1576420276701,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49600,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1576420276703,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49602,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1576420276704,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49604,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1576420276705,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49606,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1576420276707,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49608,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1576420276708,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49610,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1576420276710,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49612,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1576420276711,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49614,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1576420276713,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49616,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1576420276714,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49618,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1576420276717,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49620,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1576420276718,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49622,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1576420276719,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49624,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1576420276721,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49626,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1576420276722,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49628,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1576420276724,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49630,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1576420276725,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49632,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1576420276727,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49634,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1576420276728,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49636,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1576420276730,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49638,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1576420276733,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49640,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1576420276734,"flow_last_seen":0,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":160,"flow_max_l4_data_len":160,"flow_avg_l4_data_len":160,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49642,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1576420276738,"flow_last_seen":0,"flow_tot_l4_data_len":195,"flow_min_l4_data_len":195,"flow_max_l4_data_len":195,"flow_avg_l4_data_len":195,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49644,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1576420276739,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49646,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1576420276741,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49648,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1576420276742,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49650,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1576420276743,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49652,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1576420276744,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49654,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1576420276745,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49656,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1576420276747,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49658,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1576420276749,"flow_last_seen":0,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":186,"flow_max_l4_data_len":186,"flow_avg_l4_data_len":186,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49660,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1576420276751,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49662,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1576420276754,"flow_last_seen":0,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":199,"flow_max_l4_data_len":199,"flow_avg_l4_data_len":199,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49664,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1576420276756,"flow_last_seen":0,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":194,"flow_max_l4_data_len":194,"flow_avg_l4_data_len":194,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49666,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1576420276758,"flow_last_seen":0,"flow_tot_l4_data_len":187,"flow_min_l4_data_len":187,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49668,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1576420276760,"flow_last_seen":0,"flow_tot_l4_data_len":189,"flow_min_l4_data_len":189,"flow_max_l4_data_len":189,"flow_avg_l4_data_len":189,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49670,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1576420276761,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49672,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1576420276763,"flow_last_seen":0,"flow_tot_l4_data_len":190,"flow_min_l4_data_len":190,"flow_max_l4_data_len":190,"flow_avg_l4_data_len":190,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49674,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1576420276764,"flow_last_seen":0,"flow_tot_l4_data_len":187,"flow_min_l4_data_len":187,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49676,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1576420276765,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49678,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1576420276768,"flow_last_seen":0,"flow_tot_l4_data_len":162,"flow_min_l4_data_len":162,"flow_max_l4_data_len":162,"flow_avg_l4_data_len":162,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49680,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1576420276770,"flow_last_seen":0,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":168,"flow_max_l4_data_len":168,"flow_avg_l4_data_len":168,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49682,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1576420276771,"flow_last_seen":0,"flow_tot_l4_data_len":191,"flow_min_l4_data_len":191,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":191,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49684,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1576420276773,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49686,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1576420276774,"flow_last_seen":0,"flow_tot_l4_data_len":189,"flow_min_l4_data_len":189,"flow_max_l4_data_len":189,"flow_avg_l4_data_len":189,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49688,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1576420276776,"flow_last_seen":0,"flow_tot_l4_data_len":201,"flow_min_l4_data_len":201,"flow_max_l4_data_len":201,"flow_avg_l4_data_len":201,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49690,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1576420276777,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49692,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1576420276779,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49694,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1576420276780,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49696,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1576420276781,"flow_last_seen":0,"flow_tot_l4_data_len":170,"flow_min_l4_data_len":170,"flow_max_l4_data_len":170,"flow_avg_l4_data_len":170,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49698,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1576420276784,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49700,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1576420276786,"flow_last_seen":0,"flow_tot_l4_data_len":201,"flow_min_l4_data_len":201,"flow_max_l4_data_len":201,"flow_avg_l4_data_len":201,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49702,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1576420276787,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49704,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1576420276789,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49706,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1576420276790,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49708,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1576420276792,"flow_last_seen":0,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49710,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1576420276793,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49712,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1576420276794,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49714,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1576420276796,"flow_last_seen":0,"flow_tot_l4_data_len":167,"flow_min_l4_data_len":167,"flow_max_l4_data_len":167,"flow_avg_l4_data_len":167,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49716,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1576420276797,"flow_last_seen":0,"flow_tot_l4_data_len":207,"flow_min_l4_data_len":207,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":207,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49718,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1576420276801,"flow_last_seen":0,"flow_tot_l4_data_len":155,"flow_min_l4_data_len":155,"flow_max_l4_data_len":155,"flow_avg_l4_data_len":155,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49720,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1576420276803,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49722,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1576420276804,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49724,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1576420276806,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49726,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1576420276807,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49728,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1576420276809,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49730,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1576420276810,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49732,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1576420276812,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49734,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_first_seen":1576420276813,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49736,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1576420276815,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49738,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1576420276817,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49740,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1576420276819,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49742,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1576420276820,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49744,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1576420276821,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49746,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1576420276823,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49748,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1576420276824,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49750,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1576420276825,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49752,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1576420276827,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49754,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1576420276828,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49756,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1576420276829,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49758,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1576420276832,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49760,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1576420276834,"flow_last_seen":0,"flow_tot_l4_data_len":206,"flow_min_l4_data_len":206,"flow_max_l4_data_len":206,"flow_avg_l4_data_len":206,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49764,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1576420276835,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49766,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1576420276837,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49768,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_first_seen":1576420276839,"flow_last_seen":0,"flow_tot_l4_data_len":258,"flow_min_l4_data_len":258,"flow_max_l4_data_len":258,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49770,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1576420276840,"flow_last_seen":0,"flow_tot_l4_data_len":259,"flow_min_l4_data_len":259,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":259,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49772,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1576420276841,"flow_last_seen":0,"flow_tot_l4_data_len":270,"flow_min_l4_data_len":270,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":270,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49774,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1576420276842,"flow_last_seen":0,"flow_tot_l4_data_len":263,"flow_min_l4_data_len":263,"flow_max_l4_data_len":263,"flow_avg_l4_data_len":263,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49776,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1576420276844,"flow_last_seen":0,"flow_tot_l4_data_len":265,"flow_min_l4_data_len":265,"flow_max_l4_data_len":265,"flow_avg_l4_data_len":265,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49778,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1576420276847,"flow_last_seen":0,"flow_tot_l4_data_len":260,"flow_min_l4_data_len":260,"flow_max_l4_data_len":260,"flow_avg_l4_data_len":260,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49780,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1576420276856,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49782,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1576420276858,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49784,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_first_seen":1576420276859,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49786,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1576420276860,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49788,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1576420276862,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49790,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1576420276863,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49792,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1576420276864,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49794,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1576420276865,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49796,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1576420276866,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49798,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1576420276869,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49800,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1576420276870,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49802,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1576420276871,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49804,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1576420276872,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49806,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1576420276873,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49808,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1576420276874,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49810,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1576420276876,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49812,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_first_seen":1576420276877,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49814,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1576420276879,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49816,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1576420276881,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49818,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1576420276884,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49820,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1576420276885,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49822,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1576420276886,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49824,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_first_seen":1576420276888,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49826,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":1,"flow_first_seen":1576420276890,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49828,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":1,"flow_first_seen":1576420276891,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49830,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1576420276893,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49832,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1576420276894,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49834,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":1,"flow_first_seen":1576420276896,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49836,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":1,"flow_first_seen":1576420276897,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49838,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_first_seen":1576420276900,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49840,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_first_seen":1576420276901,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49842,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1576420276903,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49844,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1576420276904,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49846,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1576420276905,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49848,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_first_seen":1576420276907,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49850,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1576420276908,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49852,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1576420276910,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49854,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1576420276912,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49856,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":1,"flow_first_seen":1576420276913,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49858,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":1,"flow_first_seen":1576420276916,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49860,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":1,"flow_first_seen":1576420276917,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49862,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1576420276919,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49864,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_first_seen":1576420276920,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49866,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1576420276922,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49868,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1576420276924,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49870,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1576420276925,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49872,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1576420276926,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49874,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1576420276928,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49876,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":1,"flow_first_seen":1576420276929,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49878,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":1,"flow_first_seen":1576420276932,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49880,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1576420276933,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49882,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1576420276934,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49884,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1576420276936,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49886,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1576420276937,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49888,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1576420276938,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49890,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":174,"flow_packet_id":1,"flow_first_seen":1576420276939,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49892,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":1,"flow_first_seen":1576420276941,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49894,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1576420276943,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49896,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_first_seen":1576420276945,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49898,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":1,"flow_first_seen":1576420276947,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49900,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":1,"flow_first_seen":1576420276949,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49902,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1576420276950,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49904,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1576420276953,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49906,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1576420276955,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49908,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":1,"flow_first_seen":1576420276956,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49910,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1576420276957,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49912,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1576420276959,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49914,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":1,"flow_first_seen":1576420276960,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49916,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":1,"flow_first_seen":1576420276961,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49918,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1576420276964,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49920,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":1,"flow_first_seen":1576420276965,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49922,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":1,"flow_first_seen":1576420276966,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49924,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_first_seen":1576420276968,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49926,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":1,"flow_first_seen":1576420276969,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49928,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1576420276970,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49930,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1576420276972,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49932,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1576420276973,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49934,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_first_seen":1576420276976,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49936,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":1,"flow_first_seen":1576420276977,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49938,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":1,"flow_first_seen":1576420276980,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49940,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":1,"flow_first_seen":1576420276982,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49942,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":1,"flow_first_seen":1576420276983,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49944,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1576420276985,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49946,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_first_seen":1576420276986,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49948,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1576420276987,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49950,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1576420276989,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49952,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1576420276990,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49954,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1576420276992,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49956,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_first_seen":1576420276993,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49958,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":1,"flow_first_seen":1576420276995,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49960,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":1,"flow_first_seen":1576420276996,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49962,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1576420276998,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49964,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1576420276999,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49966,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":1,"flow_first_seen":1576420277000,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49968,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":1,"flow_first_seen":1576420277001,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49970,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":1,"flow_first_seen":1576420277002,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49972,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":1,"flow_first_seen":1576420277004,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49974,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":1,"flow_first_seen":1576420277006,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49976,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":1,"flow_first_seen":1576420277007,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49978,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":1,"flow_first_seen":1576420277010,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49980,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1576420277011,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49982,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_first_seen":1576420277013,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49984,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":1,"flow_first_seen":1576420277014,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49986,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":1,"flow_first_seen":1576420277016,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49988,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":1,"flow_first_seen":1576420277017,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49990,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":1,"flow_first_seen":1576420277019,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49992,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_first_seen":1576420277020,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49994,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_first_seen":1576420277021,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49996,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":1,"flow_first_seen":1576420277023,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":49998,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":1,"flow_first_seen":1576420277025,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50000,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":1,"flow_first_seen":1576420277027,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50002,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":1,"flow_first_seen":1576420277028,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50004,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":1,"flow_first_seen":1576420277029,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50006,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":1,"flow_first_seen":1576420277031,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50008,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":1,"flow_first_seen":1576420277032,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50010,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":1,"flow_first_seen":1576420277033,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50012,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":1,"flow_first_seen":1576420277034,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50014,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":1,"flow_first_seen":1576420277036,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50016,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":1,"flow_first_seen":1576420277037,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50018,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":1,"flow_first_seen":1576420277040,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50020,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":1,"flow_first_seen":1576420277041,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50022,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":1,"flow_first_seen":1576420277042,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50024,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_first_seen":1576420277044,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50026,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1576420277045,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50028,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1576420277046,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50030,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":1,"flow_first_seen":1576420277048,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50032,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_first_seen":1576420277049,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50034,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_first_seen":1576420277050,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50036,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":1,"flow_first_seen":1576420277051,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50038,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_first_seen":1576420277054,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50040,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":1,"flow_first_seen":1576420277055,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50042,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":1,"flow_first_seen":1576420277057,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50044,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":1,"flow_first_seen":1576420277058,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50046,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":1,"flow_first_seen":1576420277060,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50048,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_first_seen":1576420277061,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50050,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":1,"flow_first_seen":1576420277063,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50052,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":1,"flow_first_seen":1576420277064,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50054,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":1,"flow_first_seen":1576420277066,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50056,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":1,"flow_first_seen":1576420277067,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50058,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":1,"flow_first_seen":1576420277070,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50060,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":1,"flow_first_seen":1576420277072,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50062,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":1,"flow_first_seen":1576420277074,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50064,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":1,"flow_first_seen":1576420277075,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50066,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":1,"flow_first_seen":1576420277077,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50068,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":1,"flow_first_seen":1576420277078,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50070,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":1,"flow_first_seen":1576420277079,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50072,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":1,"flow_first_seen":1576420277081,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50074,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":1,"flow_first_seen":1576420277083,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50076,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":1,"flow_first_seen":1576420277084,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50078,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":1,"flow_first_seen":1576420277086,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50080,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":1,"flow_first_seen":1576420277087,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50082,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":1,"flow_first_seen":1576420277089,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50084,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1576420277090,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50086,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1576420277091,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50088,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":1,"flow_first_seen":1576420277093,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50090,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":1,"flow_first_seen":1576420277094,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50092,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":275,"flow_packet_id":1,"flow_first_seen":1576420277096,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50094,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":1,"flow_first_seen":1576420277098,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50096,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":1,"flow_first_seen":1576420277100,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50098,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":278,"flow_packet_id":1,"flow_first_seen":1576420277106,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50100,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":279,"flow_packet_id":1,"flow_first_seen":1576420277109,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50102,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":280,"flow_packet_id":1,"flow_first_seen":1576420277113,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50104,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":281,"flow_packet_id":1,"flow_first_seen":1576420277115,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50106,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":1,"flow_first_seen":1576420277116,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50108,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":1,"flow_first_seen":1576420277118,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50110,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":1,"flow_first_seen":1576420277119,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50112,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":1,"flow_first_seen":1576420277121,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50114,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":1,"flow_first_seen":1576420277122,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50116,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":287,"flow_packet_id":1,"flow_first_seen":1576420277123,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50118,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":288,"flow_packet_id":1,"flow_first_seen":1576420277126,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50120,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":289,"flow_packet_id":1,"flow_first_seen":1576420277127,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50122,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":290,"flow_packet_id":1,"flow_first_seen":1576420277128,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50124,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":1,"flow_first_seen":1576420277130,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50126,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":1,"flow_first_seen":1576420277134,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50128,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":1,"flow_first_seen":1576420277136,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50130,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":1,"flow_first_seen":1576420277141,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50132,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":1,"flow_first_seen":1576420277142,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50134,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":1,"flow_first_seen":1576420277144,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50136,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":1,"flow_first_seen":1576420277145,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50138,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":1,"flow_first_seen":1576420277148,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50140,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":1,"flow_first_seen":1576420277153,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50142,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":1,"flow_first_seen":1576420277155,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50144,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":301,"flow_packet_id":1,"flow_first_seen":1576420277157,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50146,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":302,"flow_packet_id":1,"flow_first_seen":1576420277159,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50148,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":303,"flow_packet_id":1,"flow_first_seen":1576420277160,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50150,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":304,"flow_packet_id":1,"flow_first_seen":1576420277162,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50152,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":305,"flow_packet_id":1,"flow_first_seen":1576420277164,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50154,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":1,"flow_first_seen":1576420277165,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50156,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":307,"flow_packet_id":1,"flow_first_seen":1576420277166,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50158,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":1,"flow_first_seen":1576420277168,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50160,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":309,"flow_packet_id":1,"flow_first_seen":1576420277170,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50162,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":1,"flow_first_seen":1576420277171,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50164,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":311,"flow_packet_id":1,"flow_first_seen":1576420277172,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50166,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":312,"flow_packet_id":1,"flow_first_seen":1576420277173,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50168,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":1,"flow_first_seen":1576420277175,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50170,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":314,"flow_packet_id":1,"flow_first_seen":1576420277176,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50172,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_first_seen":1576420277177,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50174,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":1,"flow_first_seen":1576420277179,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50176,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":1,"flow_first_seen":1576420277180,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50178,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":318,"flow_packet_id":1,"flow_first_seen":1576420277183,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50180,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":319,"flow_packet_id":1,"flow_first_seen":1576420277184,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50182,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":320,"flow_packet_id":1,"flow_first_seen":1576420277185,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50184,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":321,"flow_packet_id":1,"flow_first_seen":1576420277186,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50186,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":322,"flow_packet_id":1,"flow_first_seen":1576420277187,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50188,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":323,"flow_packet_id":1,"flow_first_seen":1576420277189,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50190,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":324,"flow_packet_id":1,"flow_first_seen":1576420277190,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50192,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":325,"flow_packet_id":1,"flow_first_seen":1576420277193,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50194,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":326,"flow_packet_id":1,"flow_first_seen":1576420277194,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50196,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":327,"flow_packet_id":1,"flow_first_seen":1576420277196,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50198,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":328,"flow_packet_id":1,"flow_first_seen":1576420277198,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50200,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":329,"flow_packet_id":1,"flow_first_seen":1576420277200,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50202,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":330,"flow_packet_id":1,"flow_first_seen":1576420277201,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50204,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":331,"flow_packet_id":1,"flow_first_seen":1576420277203,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50206,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":332,"flow_packet_id":1,"flow_first_seen":1576420277204,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50208,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":333,"flow_packet_id":1,"flow_first_seen":1576420277206,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50210,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":334,"flow_packet_id":1,"flow_first_seen":1576420277207,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50212,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":335,"flow_packet_id":1,"flow_first_seen":1576420277209,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50214,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":336,"flow_packet_id":1,"flow_first_seen":1576420277210,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50216,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":337,"flow_packet_id":1,"flow_first_seen":1576420277211,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50218,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":338,"flow_packet_id":1,"flow_first_seen":1576420277213,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50220,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":339,"flow_packet_id":1,"flow_first_seen":1576420277215,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50222,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":340,"flow_packet_id":1,"flow_first_seen":1576420277216,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50224,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":341,"flow_packet_id":1,"flow_first_seen":1576420277217,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50226,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":342,"flow_packet_id":1,"flow_first_seen":1576420277218,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50228,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":343,"flow_packet_id":1,"flow_first_seen":1576420277219,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50230,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":344,"flow_packet_id":1,"flow_first_seen":1576420277221,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50232,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":345,"flow_packet_id":1,"flow_first_seen":1576420277222,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50234,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":346,"flow_packet_id":1,"flow_first_seen":1576420277224,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50236,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":347,"flow_packet_id":1,"flow_first_seen":1576420277225,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50238,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":348,"flow_packet_id":1,"flow_first_seen":1576420277228,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50240,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":349,"flow_packet_id":1,"flow_first_seen":1576420277229,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50242,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":350,"flow_packet_id":1,"flow_first_seen":1576420277231,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50244,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":351,"flow_packet_id":1,"flow_first_seen":1576420277232,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50246,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":352,"flow_packet_id":1,"flow_first_seen":1576420277233,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50248,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":353,"flow_packet_id":1,"flow_first_seen":1576420277235,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50250,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":354,"flow_packet_id":1,"flow_first_seen":1576420277236,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50252,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":355,"flow_packet_id":1,"flow_first_seen":1576420277237,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50254,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":356,"flow_packet_id":1,"flow_first_seen":1576420277239,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50256,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":357,"flow_packet_id":1,"flow_first_seen":1576420277240,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50258,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":358,"flow_packet_id":1,"flow_first_seen":1576420277242,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50260,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":359,"flow_packet_id":1,"flow_first_seen":1576420277243,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50262,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":360,"flow_packet_id":1,"flow_first_seen":1576420277244,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50264,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":361,"flow_packet_id":1,"flow_first_seen":1576420277246,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50266,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":362,"flow_packet_id":1,"flow_first_seen":1576420277247,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50268,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":363,"flow_packet_id":1,"flow_first_seen":1576420277248,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50270,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":364,"flow_packet_id":1,"flow_first_seen":1576420277249,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50272,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":365,"flow_packet_id":1,"flow_first_seen":1576420277252,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50274,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":366,"flow_packet_id":1,"flow_first_seen":1576420277253,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50276,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":367,"flow_packet_id":1,"flow_first_seen":1576420277255,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50278,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":368,"flow_packet_id":1,"flow_first_seen":1576420277258,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50280,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":369,"flow_packet_id":1,"flow_first_seen":1576420277260,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50282,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":370,"flow_packet_id":1,"flow_first_seen":1576420277261,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50284,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":371,"flow_packet_id":1,"flow_first_seen":1576420277263,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50286,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":372,"flow_packet_id":1,"flow_first_seen":1576420277264,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50288,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":373,"flow_packet_id":1,"flow_first_seen":1576420277266,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50290,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":374,"flow_packet_id":1,"flow_first_seen":1576420277268,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50292,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":375,"flow_packet_id":1,"flow_first_seen":1576420277269,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50294,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":376,"flow_packet_id":1,"flow_first_seen":1576420277270,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50296,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":377,"flow_packet_id":1,"flow_first_seen":1576420277272,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50298,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":378,"flow_packet_id":1,"flow_first_seen":1576420277274,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50300,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":379,"flow_packet_id":1,"flow_first_seen":1576420277276,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50302,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":380,"flow_packet_id":1,"flow_first_seen":1576420277277,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50304,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":381,"flow_packet_id":1,"flow_first_seen":1576420277278,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50306,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":382,"flow_packet_id":1,"flow_first_seen":1576420277279,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50308,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":383,"flow_packet_id":1,"flow_first_seen":1576420277281,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50310,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":384,"flow_packet_id":1,"flow_first_seen":1576420277282,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50312,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":385,"flow_packet_id":1,"flow_first_seen":1576420277283,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50314,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":386,"flow_packet_id":1,"flow_first_seen":1576420277284,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50316,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":387,"flow_packet_id":1,"flow_first_seen":1576420277286,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50318,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":388,"flow_packet_id":1,"flow_first_seen":1576420277288,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50320,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":389,"flow_packet_id":1,"flow_first_seen":1576420277291,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50322,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":390,"flow_packet_id":1,"flow_first_seen":1576420277292,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50324,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":391,"flow_packet_id":1,"flow_first_seen":1576420277293,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50326,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":392,"flow_packet_id":1,"flow_first_seen":1576420277295,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50328,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":393,"flow_packet_id":1,"flow_first_seen":1576420277296,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50330,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":394,"flow_packet_id":1,"flow_first_seen":1576420277298,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50332,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":395,"flow_packet_id":1,"flow_first_seen":1576420277299,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50334,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":396,"flow_packet_id":1,"flow_first_seen":1576420277301,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50336,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":397,"flow_packet_id":1,"flow_first_seen":1576420277302,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50338,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":398,"flow_packet_id":1,"flow_first_seen":1576420277304,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50340,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":399,"flow_packet_id":1,"flow_first_seen":1576420277306,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50342,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":400,"flow_packet_id":1,"flow_first_seen":1576420277307,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50344,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":401,"flow_packet_id":1,"flow_first_seen":1576420277308,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50346,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":402,"flow_packet_id":1,"flow_first_seen":1576420277309,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50348,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":403,"flow_packet_id":1,"flow_first_seen":1576420277310,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50350,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":404,"flow_packet_id":1,"flow_first_seen":1576420277311,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50352,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":405,"flow_packet_id":1,"flow_first_seen":1576420277313,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50354,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":406,"flow_packet_id":1,"flow_first_seen":1576420277314,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50356,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":407,"flow_packet_id":1,"flow_first_seen":1576420277315,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50358,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":408,"flow_packet_id":1,"flow_first_seen":1576420277317,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50360,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":409,"flow_packet_id":1,"flow_first_seen":1576420277319,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50362,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":410,"flow_packet_id":1,"flow_first_seen":1576420277321,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50364,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":411,"flow_packet_id":1,"flow_first_seen":1576420277322,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50366,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":412,"flow_packet_id":1,"flow_first_seen":1576420277324,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50368,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":413,"flow_packet_id":1,"flow_first_seen":1576420277325,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50370,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":414,"flow_packet_id":1,"flow_first_seen":1576420277326,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50372,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":415,"flow_packet_id":1,"flow_first_seen":1576420277328,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50374,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":416,"flow_packet_id":1,"flow_first_seen":1576420277329,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50376,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":417,"flow_packet_id":1,"flow_first_seen":1576420277331,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50378,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":418,"flow_packet_id":1,"flow_first_seen":1576420277333,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50380,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":419,"flow_packet_id":1,"flow_first_seen":1576420277334,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50382,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":420,"flow_packet_id":1,"flow_first_seen":1576420277336,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50384,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":421,"flow_packet_id":1,"flow_first_seen":1576420277337,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50386,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":422,"flow_packet_id":1,"flow_first_seen":1576420277339,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50388,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":423,"flow_packet_id":1,"flow_first_seen":1576420277340,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50390,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":424,"flow_packet_id":1,"flow_first_seen":1576420277342,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50392,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":425,"flow_packet_id":1,"flow_first_seen":1576420277343,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50394,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":426,"flow_packet_id":1,"flow_first_seen":1576420277344,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50396,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":427,"flow_packet_id":1,"flow_first_seen":1576420277345,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50398,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":428,"flow_packet_id":1,"flow_first_seen":1576420277347,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50400,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":429,"flow_packet_id":1,"flow_first_seen":1576420277349,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50402,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":430,"flow_packet_id":1,"flow_first_seen":1576420277350,"flow_last_seen":0,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":174,"flow_max_l4_data_len":174,"flow_avg_l4_data_len":174,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50404,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":431,"flow_packet_id":1,"flow_first_seen":1576420277352,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50406,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":432,"flow_packet_id":1,"flow_first_seen":1576420277354,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50408,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":433,"flow_packet_id":1,"flow_first_seen":1576420277355,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50410,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":434,"flow_packet_id":1,"flow_first_seen":1576420277357,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50412,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":435,"flow_packet_id":1,"flow_first_seen":1576420277358,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50414,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":436,"flow_packet_id":1,"flow_first_seen":1576420277359,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50416,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":437,"flow_packet_id":1,"flow_first_seen":1576420277361,"flow_last_seen":0,"flow_tot_l4_data_len":162,"flow_min_l4_data_len":162,"flow_max_l4_data_len":162,"flow_avg_l4_data_len":162,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50418,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":438,"flow_packet_id":1,"flow_first_seen":1576420277375,"flow_last_seen":0,"flow_tot_l4_data_len":237,"flow_min_l4_data_len":237,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":237,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50438,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":439,"flow_packet_id":1,"flow_first_seen":1576420277378,"flow_last_seen":0,"flow_tot_l4_data_len":237,"flow_min_l4_data_len":237,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":237,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50440,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":440,"flow_packet_id":1,"flow_first_seen":1576420277381,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50442,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":441,"flow_packet_id":1,"flow_first_seen":1576420277383,"flow_last_seen":0,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":254,"flow_max_l4_data_len":254,"flow_avg_l4_data_len":254,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50444,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":442,"flow_packet_id":1,"flow_first_seen":1576420277386,"flow_last_seen":0,"flow_tot_l4_data_len":250,"flow_min_l4_data_len":250,"flow_max_l4_data_len":250,"flow_avg_l4_data_len":250,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50446,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":443,"flow_packet_id":1,"flow_first_seen":1576420277387,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50448,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":444,"flow_packet_id":1,"flow_first_seen":1576420277389,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50450,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":445,"flow_packet_id":1,"flow_first_seen":1576420277391,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50452,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":446,"flow_packet_id":1,"flow_first_seen":1576420277392,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50454,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":447,"flow_packet_id":1,"flow_first_seen":1576420277394,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50456,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":448,"flow_packet_id":1,"flow_first_seen":1576420277395,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50458,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":449,"flow_packet_id":1,"flow_first_seen":1576420277398,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50460,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":450,"flow_packet_id":1,"flow_first_seen":1576420277399,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50462,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":451,"flow_packet_id":1,"flow_first_seen":1576420277401,"flow_last_seen":0,"flow_tot_l4_data_len":255,"flow_min_l4_data_len":255,"flow_max_l4_data_len":255,"flow_avg_l4_data_len":255,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50464,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":452,"flow_packet_id":1,"flow_first_seen":1576420277402,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50466,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":453,"flow_packet_id":1,"flow_first_seen":1576420277403,"flow_last_seen":0,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":254,"flow_max_l4_data_len":254,"flow_avg_l4_data_len":254,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50468,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":454,"flow_packet_id":1,"flow_first_seen":1576420277405,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50470,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":455,"flow_packet_id":1,"flow_first_seen":1576420277406,"flow_last_seen":0,"flow_tot_l4_data_len":252,"flow_min_l4_data_len":252,"flow_max_l4_data_len":252,"flow_avg_l4_data_len":252,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50472,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":456,"flow_packet_id":1,"flow_first_seen":1576420277407,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50474,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":457,"flow_packet_id":1,"flow_first_seen":1576420277409,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50476,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":458,"flow_packet_id":1,"flow_first_seen":1576420277410,"flow_last_seen":0,"flow_tot_l4_data_len":255,"flow_min_l4_data_len":255,"flow_max_l4_data_len":255,"flow_avg_l4_data_len":255,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50478,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":459,"flow_packet_id":1,"flow_first_seen":1576420277412,"flow_last_seen":0,"flow_tot_l4_data_len":250,"flow_min_l4_data_len":250,"flow_max_l4_data_len":250,"flow_avg_l4_data_len":250,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50480,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":460,"flow_packet_id":1,"flow_first_seen":1576420277414,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50482,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":461,"flow_packet_id":1,"flow_first_seen":1576420277416,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50484,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":462,"flow_packet_id":1,"flow_first_seen":1576420277417,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50486,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":463,"flow_packet_id":1,"flow_first_seen":1576420277419,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50488,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":464,"flow_packet_id":1,"flow_first_seen":1576420277420,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50490,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":465,"flow_packet_id":1,"flow_first_seen":1576420277422,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50492,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":466,"flow_packet_id":1,"flow_first_seen":1576420277423,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50494,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":467,"flow_packet_id":1,"flow_first_seen":1576420277425,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50496,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":468,"flow_packet_id":1,"flow_first_seen":1576420277426,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50498,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":469,"flow_packet_id":1,"flow_first_seen":1576420277428,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50500,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":470,"flow_packet_id":1,"flow_first_seen":1576420277429,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50502,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":471,"flow_packet_id":1,"flow_first_seen":1576420277431,"flow_last_seen":0,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":240,"flow_max_l4_data_len":240,"flow_avg_l4_data_len":240,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50504,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":472,"flow_packet_id":1,"flow_first_seen":1576420277432,"flow_last_seen":0,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":241,"flow_max_l4_data_len":241,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50506,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":473,"flow_packet_id":1,"flow_first_seen":1576420277433,"flow_last_seen":0,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":241,"flow_max_l4_data_len":241,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50508,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":474,"flow_packet_id":1,"flow_first_seen":1576420277434,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50510,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":475,"flow_packet_id":1,"flow_first_seen":1576420277436,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50512,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":476,"flow_packet_id":1,"flow_first_seen":1576420277437,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50514,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":477,"flow_packet_id":1,"flow_first_seen":1576420277438,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50516,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":478,"flow_packet_id":1,"flow_first_seen":1576420277439,"flow_last_seen":0,"flow_tot_l4_data_len":255,"flow_min_l4_data_len":255,"flow_max_l4_data_len":255,"flow_avg_l4_data_len":255,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50518,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":479,"flow_packet_id":1,"flow_first_seen":1576420277442,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50520,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":480,"flow_packet_id":1,"flow_first_seen":1576420277443,"flow_last_seen":0,"flow_tot_l4_data_len":243,"flow_min_l4_data_len":243,"flow_max_l4_data_len":243,"flow_avg_l4_data_len":243,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50522,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":481,"flow_packet_id":1,"flow_first_seen":1576420277444,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50524,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":482,"flow_packet_id":1,"flow_first_seen":1576420277446,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50526,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":483,"flow_packet_id":1,"flow_first_seen":1576420277448,"flow_last_seen":0,"flow_tot_l4_data_len":243,"flow_min_l4_data_len":243,"flow_max_l4_data_len":243,"flow_avg_l4_data_len":243,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50528,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":484,"flow_packet_id":1,"flow_first_seen":1576420277449,"flow_last_seen":0,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":247,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50530,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":485,"flow_packet_id":1,"flow_first_seen":1576420277451,"flow_last_seen":0,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":241,"flow_max_l4_data_len":241,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50532,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":486,"flow_packet_id":1,"flow_first_seen":1576420277452,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50534,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":487,"flow_packet_id":1,"flow_first_seen":1576420277454,"flow_last_seen":0,"flow_tot_l4_data_len":245,"flow_min_l4_data_len":245,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":245,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50536,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":488,"flow_packet_id":1,"flow_first_seen":1576420277455,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50538,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":489,"flow_packet_id":1,"flow_first_seen":1576420277458,"flow_last_seen":0,"flow_tot_l4_data_len":249,"flow_min_l4_data_len":249,"flow_max_l4_data_len":249,"flow_avg_l4_data_len":249,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50540,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":490,"flow_packet_id":1,"flow_first_seen":1576420277459,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50542,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":491,"flow_packet_id":1,"flow_first_seen":1576420277460,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50544,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":492,"flow_packet_id":1,"flow_first_seen":1576420277462,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50546,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":493,"flow_packet_id":1,"flow_first_seen":1576420277463,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50548,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":494,"flow_packet_id":1,"flow_first_seen":1576420277464,"flow_last_seen":0,"flow_tot_l4_data_len":250,"flow_min_l4_data_len":250,"flow_max_l4_data_len":250,"flow_avg_l4_data_len":250,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50550,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":495,"flow_packet_id":1,"flow_first_seen":1576420277465,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50552,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":496,"flow_packet_id":1,"flow_first_seen":1576420277466,"flow_last_seen":0,"flow_tot_l4_data_len":248,"flow_min_l4_data_len":248,"flow_max_l4_data_len":248,"flow_avg_l4_data_len":248,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50554,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":497,"flow_packet_id":1,"flow_first_seen":1576420277467,"flow_last_seen":0,"flow_tot_l4_data_len":244,"flow_min_l4_data_len":244,"flow_max_l4_data_len":244,"flow_avg_l4_data_len":244,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50556,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":498,"flow_packet_id":1,"flow_first_seen":1576420277469,"flow_last_seen":0,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":246,"flow_max_l4_data_len":246,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50558,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":499,"flow_packet_id":1,"flow_first_seen":1576420277471,"flow_last_seen":0,"flow_tot_l4_data_len":237,"flow_min_l4_data_len":237,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":237,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50560,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":500,"flow_packet_id":1,"flow_first_seen":1576420277473,"flow_last_seen":0,"flow_tot_l4_data_len":211,"flow_min_l4_data_len":211,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":211,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50562,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":501,"flow_packet_id":1,"flow_first_seen":1576420277474,"flow_last_seen":0,"flow_tot_l4_data_len":313,"flow_min_l4_data_len":313,"flow_max_l4_data_len":313,"flow_avg_l4_data_len":313,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50564,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":502,"flow_packet_id":1,"flow_first_seen":1576420277477,"flow_last_seen":0,"flow_tot_l4_data_len":325,"flow_min_l4_data_len":325,"flow_max_l4_data_len":325,"flow_avg_l4_data_len":325,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50566,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":503,"flow_packet_id":1,"flow_first_seen":1576420277478,"flow_last_seen":0,"flow_tot_l4_data_len":325,"flow_min_l4_data_len":325,"flow_max_l4_data_len":325,"flow_avg_l4_data_len":325,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50568,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":504,"flow_packet_id":1,"flow_first_seen":1576420277480,"flow_last_seen":0,"flow_tot_l4_data_len":166,"flow_min_l4_data_len":166,"flow_max_l4_data_len":166,"flow_avg_l4_data_len":166,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50570,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":505,"flow_packet_id":1,"flow_first_seen":1576420277488,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50572,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":506,"flow_packet_id":1,"flow_first_seen":1576420277490,"flow_last_seen":0,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":197,"flow_max_l4_data_len":197,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50574,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":507,"flow_packet_id":1,"flow_first_seen":1576420277491,"flow_last_seen":0,"flow_tot_l4_data_len":193,"flow_min_l4_data_len":193,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":193,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50576,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":508,"flow_packet_id":1,"flow_first_seen":1576420277492,"flow_last_seen":0,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":168,"flow_max_l4_data_len":168,"flow_avg_l4_data_len":168,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50578,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":509,"flow_packet_id":1,"flow_first_seen":1576420277495,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50580,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":510,"flow_packet_id":1,"flow_first_seen":1576420277496,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50582,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":511,"flow_packet_id":1,"flow_first_seen":1576420277497,"flow_last_seen":0,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":168,"flow_max_l4_data_len":168,"flow_avg_l4_data_len":168,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50584,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":512,"flow_packet_id":1,"flow_first_seen":1576420277498,"flow_last_seen":0,"flow_tot_l4_data_len":168,"flow_min_l4_data_len":168,"flow_max_l4_data_len":168,"flow_avg_l4_data_len":168,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50586,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":513,"flow_packet_id":1,"flow_first_seen":1576420277499,"flow_last_seen":0,"flow_tot_l4_data_len":166,"flow_min_l4_data_len":166,"flow_max_l4_data_len":166,"flow_avg_l4_data_len":166,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50588,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":514,"flow_packet_id":1,"flow_first_seen":1576420277500,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50590,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":515,"flow_packet_id":1,"flow_first_seen":1576420277501,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50592,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":516,"flow_packet_id":1,"flow_first_seen":1576420277503,"flow_last_seen":0,"flow_tot_l4_data_len":223,"flow_min_l4_data_len":223,"flow_max_l4_data_len":223,"flow_avg_l4_data_len":223,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50594,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":517,"flow_packet_id":1,"flow_first_seen":1576420277505,"flow_last_seen":0,"flow_tot_l4_data_len":185,"flow_min_l4_data_len":185,"flow_max_l4_data_len":185,"flow_avg_l4_data_len":185,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50596,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":518,"flow_packet_id":1,"flow_first_seen":1576420277506,"flow_last_seen":0,"flow_tot_l4_data_len":190,"flow_min_l4_data_len":190,"flow_max_l4_data_len":190,"flow_avg_l4_data_len":190,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50598,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":519,"flow_packet_id":1,"flow_first_seen":1576420277509,"flow_last_seen":0,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":178,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":178,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50600,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":520,"flow_packet_id":1,"flow_first_seen":1576420277510,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50602,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":521,"flow_packet_id":1,"flow_first_seen":1576420277512,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50604,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":522,"flow_packet_id":1,"flow_first_seen":1576420277513,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50606,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":523,"flow_packet_id":1,"flow_first_seen":1576420277515,"flow_last_seen":0,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":200,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":200,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50608,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":524,"flow_packet_id":1,"flow_first_seen":1576420277516,"flow_last_seen":0,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":186,"flow_max_l4_data_len":186,"flow_avg_l4_data_len":186,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50610,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":525,"flow_packet_id":1,"flow_first_seen":1576420277518,"flow_last_seen":0,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":194,"flow_max_l4_data_len":194,"flow_avg_l4_data_len":194,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50612,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":526,"flow_packet_id":1,"flow_first_seen":1576420277519,"flow_last_seen":0,"flow_tot_l4_data_len":187,"flow_min_l4_data_len":187,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50614,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":527,"flow_packet_id":1,"flow_first_seen":1576420277520,"flow_last_seen":0,"flow_tot_l4_data_len":184,"flow_min_l4_data_len":184,"flow_max_l4_data_len":184,"flow_avg_l4_data_len":184,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50616,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":528,"flow_packet_id":1,"flow_first_seen":1576420277522,"flow_last_seen":0,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":196,"flow_max_l4_data_len":196,"flow_avg_l4_data_len":196,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50618,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":529,"flow_packet_id":1,"flow_first_seen":1576420277525,"flow_last_seen":0,"flow_tot_l4_data_len":232,"flow_min_l4_data_len":232,"flow_max_l4_data_len":232,"flow_avg_l4_data_len":232,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50620,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":530,"flow_packet_id":1,"flow_first_seen":1576420277526,"flow_last_seen":0,"flow_tot_l4_data_len":232,"flow_min_l4_data_len":232,"flow_max_l4_data_len":232,"flow_avg_l4_data_len":232,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50622,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":531,"flow_packet_id":1,"flow_first_seen":1576420277527,"flow_last_seen":0,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":186,"flow_max_l4_data_len":186,"flow_avg_l4_data_len":186,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50624,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":532,"flow_packet_id":1,"flow_first_seen":1576420277528,"flow_last_seen":0,"flow_tot_l4_data_len":201,"flow_min_l4_data_len":201,"flow_max_l4_data_len":201,"flow_avg_l4_data_len":201,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50626,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":533,"flow_packet_id":1,"flow_first_seen":1576420277534,"flow_last_seen":0,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":186,"flow_max_l4_data_len":186,"flow_avg_l4_data_len":186,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50628,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":534,"flow_packet_id":1,"flow_first_seen":1576420277535,"flow_last_seen":0,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":176,"flow_max_l4_data_len":176,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50630,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":535,"flow_packet_id":1,"flow_first_seen":1576420277536,"flow_last_seen":0,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":216,"flow_max_l4_data_len":216,"flow_avg_l4_data_len":216,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50632,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":536,"flow_packet_id":1,"flow_first_seen":1576420277537,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50634,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":537,"flow_packet_id":1,"flow_first_seen":1576420277538,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50636,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":538,"flow_packet_id":1,"flow_first_seen":1576420277540,"flow_last_seen":0,"flow_tot_l4_data_len":187,"flow_min_l4_data_len":187,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50638,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":539,"flow_packet_id":1,"flow_first_seen":1576420277543,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50640,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":540,"flow_packet_id":1,"flow_first_seen":1576420277544,"flow_last_seen":0,"flow_tot_l4_data_len":187,"flow_min_l4_data_len":187,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50642,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":541,"flow_packet_id":1,"flow_first_seen":1576420277546,"flow_last_seen":0,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":197,"flow_max_l4_data_len":197,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50644,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":542,"flow_packet_id":1,"flow_first_seen":1576420277547,"flow_last_seen":0,"flow_tot_l4_data_len":191,"flow_min_l4_data_len":191,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":191,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50646,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":543,"flow_packet_id":1,"flow_first_seen":1576420277549,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50648,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":544,"flow_packet_id":1,"flow_first_seen":1576420277550,"flow_last_seen":0,"flow_tot_l4_data_len":171,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50650,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":545,"flow_packet_id":1,"flow_first_seen":1576420277552,"flow_last_seen":0,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":197,"flow_max_l4_data_len":197,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50652,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":546,"flow_packet_id":1,"flow_first_seen":1576420277553,"flow_last_seen":0,"flow_tot_l4_data_len":230,"flow_min_l4_data_len":230,"flow_max_l4_data_len":230,"flow_avg_l4_data_len":230,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50654,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":547,"flow_packet_id":1,"flow_first_seen":1576420277554,"flow_last_seen":0,"flow_tot_l4_data_len":235,"flow_min_l4_data_len":235,"flow_max_l4_data_len":235,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50656,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":548,"flow_packet_id":1,"flow_first_seen":1576420277556,"flow_last_seen":0,"flow_tot_l4_data_len":206,"flow_min_l4_data_len":206,"flow_max_l4_data_len":206,"flow_avg_l4_data_len":206,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50658,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":549,"flow_packet_id":1,"flow_first_seen":1576420277558,"flow_last_seen":0,"flow_tot_l4_data_len":236,"flow_min_l4_data_len":236,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":236,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50660,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":550,"flow_packet_id":1,"flow_first_seen":1576420277560,"flow_last_seen":0,"flow_tot_l4_data_len":238,"flow_min_l4_data_len":238,"flow_max_l4_data_len":238,"flow_avg_l4_data_len":238,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50662,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":551,"flow_packet_id":1,"flow_first_seen":1576420277561,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50664,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":552,"flow_packet_id":1,"flow_first_seen":1576420277562,"flow_last_seen":0,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":172,"flow_max_l4_data_len":172,"flow_avg_l4_data_len":172,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50666,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":553,"flow_packet_id":1,"flow_first_seen":1576420277564,"flow_last_seen":0,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":196,"flow_max_l4_data_len":196,"flow_avg_l4_data_len":196,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50668,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":554,"flow_packet_id":1,"flow_first_seen":1576420277565,"flow_last_seen":0,"flow_tot_l4_data_len":182,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50670,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":555,"flow_packet_id":1,"flow_first_seen":1576420277566,"flow_last_seen":0,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":197,"flow_max_l4_data_len":197,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50672,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":556,"flow_packet_id":1,"flow_first_seen":1576420277567,"flow_last_seen":0,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":169,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":169,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50674,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":557,"flow_packet_id":1,"flow_first_seen":1576420277568,"flow_last_seen":0,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":175,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50676,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":558,"flow_packet_id":1,"flow_first_seen":1576420277570,"flow_last_seen":0,"flow_tot_l4_data_len":193,"flow_min_l4_data_len":193,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":193,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50678,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":559,"flow_packet_id":1,"flow_first_seen":1576420277572,"flow_last_seen":0,"flow_tot_l4_data_len":203,"flow_min_l4_data_len":203,"flow_max_l4_data_len":203,"flow_avg_l4_data_len":203,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50680,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":560,"flow_packet_id":1,"flow_first_seen":1576420277574,"flow_last_seen":0,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":200,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":200,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50682,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":561,"flow_packet_id":1,"flow_first_seen":1576420277575,"flow_last_seen":0,"flow_tot_l4_data_len":207,"flow_min_l4_data_len":207,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":207,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50684,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":562,"flow_packet_id":1,"flow_first_seen":1576420277577,"flow_last_seen":0,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":197,"flow_max_l4_data_len":197,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50686,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":563,"flow_packet_id":1,"flow_first_seen":1576420277578,"flow_last_seen":0,"flow_tot_l4_data_len":227,"flow_min_l4_data_len":227,"flow_max_l4_data_len":227,"flow_avg_l4_data_len":227,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50688,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":564,"flow_packet_id":1,"flow_first_seen":1576420277580,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50690,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":565,"flow_packet_id":1,"flow_first_seen":1576420277581,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50692,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":566,"flow_packet_id":1,"flow_first_seen":1576420277583,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50694,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":567,"flow_packet_id":1,"flow_first_seen":1576420277584,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50696,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":568,"flow_packet_id":1,"flow_first_seen":1576420277586,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50698,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":569,"flow_packet_id":1,"flow_first_seen":1576420277588,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50700,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":570,"flow_packet_id":1,"flow_first_seen":1576420277590,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50702,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":571,"flow_packet_id":1,"flow_first_seen":1576420277592,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50704,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":572,"flow_packet_id":1,"flow_first_seen":1576420277593,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50706,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":573,"flow_packet_id":1,"flow_first_seen":1576420277595,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50708,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":574,"flow_packet_id":1,"flow_first_seen":1576420277597,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50710,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":575,"flow_packet_id":1,"flow_first_seen":1576420277598,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50712,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":576,"flow_packet_id":1,"flow_first_seen":1576420277600,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50714,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":577,"flow_packet_id":1,"flow_first_seen":1576420277602,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50716,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":578,"flow_packet_id":1,"flow_first_seen":1576420277604,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50718,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":579,"flow_packet_id":1,"flow_first_seen":1576420277607,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50720,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":580,"flow_packet_id":1,"flow_first_seen":1576420277608,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50722,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":581,"flow_packet_id":1,"flow_first_seen":1576420277609,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50724,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":582,"flow_packet_id":1,"flow_first_seen":1576420277611,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50726,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":583,"flow_packet_id":1,"flow_first_seen":1576420277612,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50728,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":584,"flow_packet_id":1,"flow_first_seen":1576420277614,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50730,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":585,"flow_packet_id":1,"flow_first_seen":1576420277615,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50732,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":586,"flow_packet_id":1,"flow_first_seen":1576420277616,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50734,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":587,"flow_packet_id":1,"flow_first_seen":1576420277618,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50736,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":588,"flow_packet_id":1,"flow_first_seen":1576420277619,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50738,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":589,"flow_packet_id":1,"flow_first_seen":1576420277622,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50740,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":590,"flow_packet_id":1,"flow_first_seen":1576420277624,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50742,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":591,"flow_packet_id":1,"flow_first_seen":1576420277625,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50744,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":592,"flow_packet_id":1,"flow_first_seen":1576420277627,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50746,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":593,"flow_packet_id":1,"flow_first_seen":1576420277628,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50748,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":594,"flow_packet_id":1,"flow_first_seen":1576420277630,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50750,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":595,"flow_packet_id":1,"flow_first_seen":1576420277631,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50752,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":596,"flow_packet_id":1,"flow_first_seen":1576420277633,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50754,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":597,"flow_packet_id":1,"flow_first_seen":1576420277637,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50756,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":598,"flow_packet_id":1,"flow_first_seen":1576420277639,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50758,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":599,"flow_packet_id":1,"flow_first_seen":1576420277642,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50760,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":600,"flow_packet_id":1,"flow_first_seen":1576420277644,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50762,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":601,"flow_packet_id":1,"flow_first_seen":1576420277646,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50764,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":602,"flow_packet_id":1,"flow_first_seen":1576420277648,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50766,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":603,"flow_packet_id":1,"flow_first_seen":1576420277650,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50768,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":604,"flow_packet_id":1,"flow_first_seen":1576420277657,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50770,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":605,"flow_packet_id":1,"flow_first_seen":1576420277658,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50772,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":606,"flow_packet_id":1,"flow_first_seen":1576420277660,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50774,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":607,"flow_packet_id":1,"flow_first_seen":1576420277662,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50776,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":608,"flow_packet_id":1,"flow_first_seen":1576420277663,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50778,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":609,"flow_packet_id":1,"flow_first_seen":1576420277667,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50780,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":610,"flow_packet_id":1,"flow_first_seen":1576420277669,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50782,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":611,"flow_packet_id":1,"flow_first_seen":1576420277670,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50784,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":612,"flow_packet_id":1,"flow_first_seen":1576420277675,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50786,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":613,"flow_packet_id":1,"flow_first_seen":1576420277677,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50788,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":614,"flow_packet_id":1,"flow_first_seen":1576420277678,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50790,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":615,"flow_packet_id":1,"flow_first_seen":1576420277680,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50792,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":616,"flow_packet_id":1,"flow_first_seen":1576420277681,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50794,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":617,"flow_packet_id":1,"flow_first_seen":1576420277683,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50796,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":618,"flow_packet_id":1,"flow_first_seen":1576420277685,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50798,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":619,"flow_packet_id":1,"flow_first_seen":1576420277687,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50800,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":620,"flow_packet_id":1,"flow_first_seen":1576420277689,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50802,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":621,"flow_packet_id":1,"flow_first_seen":1576420277691,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50804,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":622,"flow_packet_id":1,"flow_first_seen":1576420277693,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50806,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":623,"flow_packet_id":1,"flow_first_seen":1576420277695,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50808,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":624,"flow_packet_id":1,"flow_first_seen":1576420277699,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50810,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":625,"flow_packet_id":1,"flow_first_seen":1576420277701,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50812,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":626,"flow_packet_id":1,"flow_first_seen":1576420277702,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50814,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":627,"flow_packet_id":1,"flow_first_seen":1576420277703,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50816,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":1,"flow_first_seen":1576420277705,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50818,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":1,"flow_first_seen":1576420277708,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50820,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":630,"flow_packet_id":1,"flow_first_seen":1576420277709,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50822,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":631,"flow_packet_id":1,"flow_first_seen":1576420277711,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50824,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":632,"flow_packet_id":1,"flow_first_seen":1576420277713,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50826,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":633,"flow_packet_id":1,"flow_first_seen":1576420277715,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50828,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":634,"flow_packet_id":1,"flow_first_seen":1576420277716,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50830,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":635,"flow_packet_id":1,"flow_first_seen":1576420277718,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50832,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":636,"flow_packet_id":1,"flow_first_seen":1576420277719,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50834,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":637,"flow_packet_id":1,"flow_first_seen":1576420277721,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50836,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":638,"flow_packet_id":1,"flow_first_seen":1576420277723,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50838,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":639,"flow_packet_id":1,"flow_first_seen":1576420277725,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50840,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":640,"flow_packet_id":1,"flow_first_seen":1576420277727,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50842,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":641,"flow_packet_id":1,"flow_first_seen":1576420277729,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50844,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":642,"flow_packet_id":1,"flow_first_seen":1576420277730,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50846,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":643,"flow_packet_id":1,"flow_first_seen":1576420277732,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50848,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":1,"flow_first_seen":1576420277734,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50850,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":645,"flow_packet_id":1,"flow_first_seen":1576420277736,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50852,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":646,"flow_packet_id":1,"flow_first_seen":1576420277737,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50854,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":647,"flow_packet_id":1,"flow_first_seen":1576420277739,"flow_last_seen":0,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50856,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":648,"flow_packet_id":1,"flow_first_seen":1576420277741,"flow_last_seen":0,"flow_tot_l4_data_len":329,"flow_min_l4_data_len":329,"flow_max_l4_data_len":329,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50858,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":649,"flow_packet_id":1,"flow_first_seen":1576420277743,"flow_last_seen":0,"flow_tot_l4_data_len":306,"flow_min_l4_data_len":306,"flow_max_l4_data_len":306,"flow_avg_l4_data_len":306,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50860,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":650,"flow_packet_id":1,"flow_first_seen":1576420277745,"flow_last_seen":0,"flow_tot_l4_data_len":329,"flow_min_l4_data_len":329,"flow_max_l4_data_len":329,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50862,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":651,"flow_packet_id":1,"flow_first_seen":1576420277746,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50864,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":652,"flow_packet_id":1,"flow_first_seen":1576420277747,"flow_last_seen":0,"flow_tot_l4_data_len":343,"flow_min_l4_data_len":343,"flow_max_l4_data_len":343,"flow_avg_l4_data_len":343,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50866,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":653,"flow_packet_id":1,"flow_first_seen":1576420277749,"flow_last_seen":0,"flow_tot_l4_data_len":337,"flow_min_l4_data_len":337,"flow_max_l4_data_len":337,"flow_avg_l4_data_len":337,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50868,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":654,"flow_packet_id":1,"flow_first_seen":1576420277750,"flow_last_seen":0,"flow_tot_l4_data_len":335,"flow_min_l4_data_len":335,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":335,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50870,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":655,"flow_packet_id":1,"flow_first_seen":1576420277752,"flow_last_seen":0,"flow_tot_l4_data_len":335,"flow_min_l4_data_len":335,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":335,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50872,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":656,"flow_packet_id":1,"flow_first_seen":1576420277753,"flow_last_seen":0,"flow_tot_l4_data_len":330,"flow_min_l4_data_len":330,"flow_max_l4_data_len":330,"flow_avg_l4_data_len":330,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50874,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":657,"flow_packet_id":1,"flow_first_seen":1576420277754,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50876,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":658,"flow_packet_id":1,"flow_first_seen":1576420277756,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50878,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":659,"flow_packet_id":1,"flow_first_seen":1576420277758,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50880,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":660,"flow_packet_id":1,"flow_first_seen":1576420277760,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50882,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":661,"flow_packet_id":1,"flow_first_seen":1576420277762,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50884,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":662,"flow_packet_id":1,"flow_first_seen":1576420277764,"flow_last_seen":0,"flow_tot_l4_data_len":329,"flow_min_l4_data_len":329,"flow_max_l4_data_len":329,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50886,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":663,"flow_packet_id":1,"flow_first_seen":1576420277766,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50888,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":664,"flow_packet_id":1,"flow_first_seen":1576420277767,"flow_last_seen":0,"flow_tot_l4_data_len":343,"flow_min_l4_data_len":343,"flow_max_l4_data_len":343,"flow_avg_l4_data_len":343,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50890,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":665,"flow_packet_id":1,"flow_first_seen":1576420277769,"flow_last_seen":0,"flow_tot_l4_data_len":337,"flow_min_l4_data_len":337,"flow_max_l4_data_len":337,"flow_avg_l4_data_len":337,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50892,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":666,"flow_packet_id":1,"flow_first_seen":1576420277770,"flow_last_seen":0,"flow_tot_l4_data_len":335,"flow_min_l4_data_len":335,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":335,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50894,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":667,"flow_packet_id":1,"flow_first_seen":1576420277772,"flow_last_seen":0,"flow_tot_l4_data_len":335,"flow_min_l4_data_len":335,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":335,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50896,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":668,"flow_packet_id":1,"flow_first_seen":1576420277773,"flow_last_seen":0,"flow_tot_l4_data_len":330,"flow_min_l4_data_len":330,"flow_max_l4_data_len":330,"flow_avg_l4_data_len":330,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50898,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":669,"flow_packet_id":1,"flow_first_seen":1576420277776,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50900,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":670,"flow_packet_id":1,"flow_first_seen":1576420277777,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50902,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":671,"flow_packet_id":1,"flow_first_seen":1576420277778,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50904,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":672,"flow_packet_id":1,"flow_first_seen":1576420277780,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50906,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":673,"flow_packet_id":1,"flow_first_seen":1576420277781,"flow_last_seen":0,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":336,"flow_max_l4_data_len":336,"flow_avg_l4_data_len":336,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50908,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":674,"flow_packet_id":1,"flow_first_seen":1576420277782,"flow_last_seen":0,"flow_tot_l4_data_len":306,"flow_min_l4_data_len":306,"flow_max_l4_data_len":306,"flow_avg_l4_data_len":306,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50910,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":675,"flow_packet_id":1,"flow_first_seen":1576420277784,"flow_last_seen":0,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":315,"flow_max_l4_data_len":315,"flow_avg_l4_data_len":315,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50912,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":676,"flow_packet_id":1,"flow_first_seen":1576420277785,"flow_last_seen":0,"flow_tot_l4_data_len":320,"flow_min_l4_data_len":320,"flow_max_l4_data_len":320,"flow_avg_l4_data_len":320,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50914,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":677,"flow_packet_id":1,"flow_first_seen":1576420277786,"flow_last_seen":0,"flow_tot_l4_data_len":314,"flow_min_l4_data_len":314,"flow_max_l4_data_len":314,"flow_avg_l4_data_len":314,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50916,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":678,"flow_packet_id":1,"flow_first_seen":1576420277788,"flow_last_seen":0,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":312,"flow_max_l4_data_len":312,"flow_avg_l4_data_len":312,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50918,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":679,"flow_packet_id":1,"flow_first_seen":1576420277790,"flow_last_seen":0,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":312,"flow_max_l4_data_len":312,"flow_avg_l4_data_len":312,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50920,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":680,"flow_packet_id":1,"flow_first_seen":1576420277792,"flow_last_seen":0,"flow_tot_l4_data_len":331,"flow_min_l4_data_len":331,"flow_max_l4_data_len":331,"flow_avg_l4_data_len":331,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50922,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":681,"flow_packet_id":1,"flow_first_seen":1576420277794,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50924,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":682,"flow_packet_id":1,"flow_first_seen":1576420277795,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50926,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":683,"flow_packet_id":1,"flow_first_seen":1576420277797,"flow_last_seen":0,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":315,"flow_max_l4_data_len":315,"flow_avg_l4_data_len":315,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50928,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":684,"flow_packet_id":1,"flow_first_seen":1576420277799,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50930,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":685,"flow_packet_id":1,"flow_first_seen":1576420277800,"flow_last_seen":0,"flow_tot_l4_data_len":347,"flow_min_l4_data_len":347,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":347,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50932,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":686,"flow_packet_id":1,"flow_first_seen":1576420277802,"flow_last_seen":0,"flow_tot_l4_data_len":352,"flow_min_l4_data_len":352,"flow_max_l4_data_len":352,"flow_avg_l4_data_len":352,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50934,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":687,"flow_packet_id":1,"flow_first_seen":1576420277803,"flow_last_seen":0,"flow_tot_l4_data_len":346,"flow_min_l4_data_len":346,"flow_max_l4_data_len":346,"flow_avg_l4_data_len":346,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50936,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":688,"flow_packet_id":1,"flow_first_seen":1576420277804,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50938,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":689,"flow_packet_id":1,"flow_first_seen":1576420277807,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50940,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":690,"flow_packet_id":1,"flow_first_seen":1576420277808,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50942,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":691,"flow_packet_id":1,"flow_first_seen":1576420277810,"flow_last_seen":0,"flow_tot_l4_data_len":348,"flow_min_l4_data_len":348,"flow_max_l4_data_len":348,"flow_avg_l4_data_len":348,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50944,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":692,"flow_packet_id":1,"flow_first_seen":1576420277811,"flow_last_seen":0,"flow_tot_l4_data_len":353,"flow_min_l4_data_len":353,"flow_max_l4_data_len":353,"flow_avg_l4_data_len":353,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50946,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":693,"flow_packet_id":1,"flow_first_seen":1576420277812,"flow_last_seen":0,"flow_tot_l4_data_len":347,"flow_min_l4_data_len":347,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":347,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50948,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":694,"flow_packet_id":1,"flow_first_seen":1576420277813,"flow_last_seen":0,"flow_tot_l4_data_len":345,"flow_min_l4_data_len":345,"flow_max_l4_data_len":345,"flow_avg_l4_data_len":345,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50950,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":695,"flow_packet_id":1,"flow_first_seen":1576420277814,"flow_last_seen":0,"flow_tot_l4_data_len":345,"flow_min_l4_data_len":345,"flow_max_l4_data_len":345,"flow_avg_l4_data_len":345,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50952,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":696,"flow_packet_id":1,"flow_first_seen":1576420277816,"flow_last_seen":0,"flow_tot_l4_data_len":338,"flow_min_l4_data_len":338,"flow_max_l4_data_len":338,"flow_avg_l4_data_len":338,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50954,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":697,"flow_packet_id":1,"flow_first_seen":1576420277817,"flow_last_seen":0,"flow_tot_l4_data_len":347,"flow_min_l4_data_len":347,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":347,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50956,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":698,"flow_packet_id":1,"flow_first_seen":1576420277819,"flow_last_seen":0,"flow_tot_l4_data_len":352,"flow_min_l4_data_len":352,"flow_max_l4_data_len":352,"flow_avg_l4_data_len":352,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50958,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":699,"flow_packet_id":1,"flow_first_seen":1576420277821,"flow_last_seen":0,"flow_tot_l4_data_len":346,"flow_min_l4_data_len":346,"flow_max_l4_data_len":346,"flow_avg_l4_data_len":346,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50960,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":700,"flow_packet_id":1,"flow_first_seen":1576420277822,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50962,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":701,"flow_packet_id":1,"flow_first_seen":1576420277824,"flow_last_seen":0,"flow_tot_l4_data_len":344,"flow_min_l4_data_len":344,"flow_max_l4_data_len":344,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50964,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":702,"flow_packet_id":1,"flow_first_seen":1576420277827,"flow_last_seen":0,"flow_tot_l4_data_len":339,"flow_min_l4_data_len":339,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50966,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":703,"flow_packet_id":1,"flow_first_seen":1576420277828,"flow_last_seen":0,"flow_tot_l4_data_len":348,"flow_min_l4_data_len":348,"flow_max_l4_data_len":348,"flow_avg_l4_data_len":348,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50968,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":704,"flow_packet_id":1,"flow_first_seen":1576420277829,"flow_last_seen":0,"flow_tot_l4_data_len":353,"flow_min_l4_data_len":353,"flow_max_l4_data_len":353,"flow_avg_l4_data_len":353,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50970,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":705,"flow_packet_id":1,"flow_first_seen":1576420277831,"flow_last_seen":0,"flow_tot_l4_data_len":347,"flow_min_l4_data_len":347,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":347,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50972,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":706,"flow_packet_id":1,"flow_first_seen":1576420277832,"flow_last_seen":0,"flow_tot_l4_data_len":345,"flow_min_l4_data_len":345,"flow_max_l4_data_len":345,"flow_avg_l4_data_len":345,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50974,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":707,"flow_packet_id":1,"flow_first_seen":1576420277834,"flow_last_seen":0,"flow_tot_l4_data_len":345,"flow_min_l4_data_len":345,"flow_max_l4_data_len":345,"flow_avg_l4_data_len":345,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50976,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":708,"flow_packet_id":1,"flow_first_seen":1576420277836,"flow_last_seen":0,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":315,"flow_max_l4_data_len":315,"flow_avg_l4_data_len":315,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50978,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":709,"flow_packet_id":1,"flow_first_seen":1576420277838,"flow_last_seen":0,"flow_tot_l4_data_len":324,"flow_min_l4_data_len":324,"flow_max_l4_data_len":324,"flow_avg_l4_data_len":324,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50980,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":710,"flow_packet_id":1,"flow_first_seen":1576420277840,"flow_last_seen":0,"flow_tot_l4_data_len":329,"flow_min_l4_data_len":329,"flow_max_l4_data_len":329,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50982,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":711,"flow_packet_id":1,"flow_first_seen":1576420277841,"flow_last_seen":0,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":323,"flow_max_l4_data_len":323,"flow_avg_l4_data_len":323,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50984,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":712,"flow_packet_id":1,"flow_first_seen":1576420277843,"flow_last_seen":0,"flow_tot_l4_data_len":321,"flow_min_l4_data_len":321,"flow_max_l4_data_len":321,"flow_avg_l4_data_len":321,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50986,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":713,"flow_packet_id":1,"flow_first_seen":1576420277844,"flow_last_seen":0,"flow_tot_l4_data_len":321,"flow_min_l4_data_len":321,"flow_max_l4_data_len":321,"flow_avg_l4_data_len":321,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50988,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":714,"flow_packet_id":1,"flow_first_seen":1576420277845,"flow_last_seen":0,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":340,"flow_max_l4_data_len":340,"flow_avg_l4_data_len":340,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50990,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":715,"flow_packet_id":1,"flow_first_seen":1576420277847,"flow_last_seen":0,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":177,"flow_max_l4_data_len":177,"flow_avg_l4_data_len":177,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50992,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":716,"flow_packet_id":1,"flow_first_seen":1576420277849,"flow_last_seen":0,"flow_tot_l4_data_len":173,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50994,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":717,"flow_packet_id":1,"flow_first_seen":1576420277850,"flow_last_seen":0,"flow_tot_l4_data_len":272,"flow_min_l4_data_len":272,"flow_max_l4_data_len":272,"flow_avg_l4_data_len":272,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50996,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":718,"flow_packet_id":1,"flow_first_seen":1576420277851,"flow_last_seen":0,"flow_tot_l4_data_len":278,"flow_min_l4_data_len":278,"flow_max_l4_data_len":278,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50998,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":719,"flow_packet_id":1,"flow_first_seen":1576420277854,"flow_last_seen":0,"flow_tot_l4_data_len":279,"flow_min_l4_data_len":279,"flow_max_l4_data_len":279,"flow_avg_l4_data_len":279,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51000,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":720,"flow_packet_id":1,"flow_first_seen":1576420277855,"flow_last_seen":0,"flow_tot_l4_data_len":279,"flow_min_l4_data_len":279,"flow_max_l4_data_len":279,"flow_avg_l4_data_len":279,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51002,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":721,"flow_packet_id":1,"flow_first_seen":1576420277857,"flow_last_seen":0,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":280,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":280,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51004,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":722,"flow_packet_id":1,"flow_first_seen":1576420277858,"flow_last_seen":0,"flow_tot_l4_data_len":278,"flow_min_l4_data_len":278,"flow_max_l4_data_len":278,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51006,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":723,"flow_packet_id":1,"flow_first_seen":1576420277860,"flow_last_seen":0,"flow_tot_l4_data_len":282,"flow_min_l4_data_len":282,"flow_max_l4_data_len":282,"flow_avg_l4_data_len":282,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51008,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":724,"flow_packet_id":1,"flow_first_seen":1576420277861,"flow_last_seen":0,"flow_tot_l4_data_len":275,"flow_min_l4_data_len":275,"flow_max_l4_data_len":275,"flow_avg_l4_data_len":275,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51010,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":725,"flow_packet_id":1,"flow_first_seen":1576420277863,"flow_last_seen":0,"flow_tot_l4_data_len":282,"flow_min_l4_data_len":282,"flow_max_l4_data_len":282,"flow_avg_l4_data_len":282,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51012,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":726,"flow_packet_id":1,"flow_first_seen":1576420277864,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51014,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":727,"flow_packet_id":1,"flow_first_seen":1576420277866,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51016,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":728,"flow_packet_id":1,"flow_first_seen":1576420277867,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51018,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":729,"flow_packet_id":1,"flow_first_seen":1576420277870,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51020,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":730,"flow_packet_id":1,"flow_first_seen":1576420277871,"flow_last_seen":0,"flow_tot_l4_data_len":211,"flow_min_l4_data_len":211,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":211,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51022,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":731,"flow_packet_id":1,"flow_first_seen":1576420277873,"flow_last_seen":0,"flow_tot_l4_data_len":218,"flow_min_l4_data_len":218,"flow_max_l4_data_len":218,"flow_avg_l4_data_len":218,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51024,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":732,"flow_packet_id":1,"flow_first_seen":1576420277874,"flow_last_seen":0,"flow_tot_l4_data_len":221,"flow_min_l4_data_len":221,"flow_max_l4_data_len":221,"flow_avg_l4_data_len":221,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51026,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":733,"flow_packet_id":1,"flow_first_seen":1576420277875,"flow_last_seen":0,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":216,"flow_max_l4_data_len":216,"flow_avg_l4_data_len":216,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51028,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":734,"flow_packet_id":1,"flow_first_seen":1576420277877,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51030,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":735,"flow_packet_id":1,"flow_first_seen":1576420277878,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51032,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":736,"flow_packet_id":1,"flow_first_seen":1576420277880,"flow_last_seen":0,"flow_tot_l4_data_len":214,"flow_min_l4_data_len":214,"flow_max_l4_data_len":214,"flow_avg_l4_data_len":214,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51034,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":737,"flow_packet_id":1,"flow_first_seen":1576420277882,"flow_last_seen":0,"flow_tot_l4_data_len":232,"flow_min_l4_data_len":232,"flow_max_l4_data_len":232,"flow_avg_l4_data_len":232,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51036,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":738,"flow_packet_id":1,"flow_first_seen":1576420277883,"flow_last_seen":0,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":200,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":200,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51038,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":739,"flow_packet_id":1,"flow_first_seen":1576420277885,"flow_last_seen":0,"flow_tot_l4_data_len":193,"flow_min_l4_data_len":193,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":193,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51040,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":740,"flow_packet_id":1,"flow_first_seen":1576420277887,"flow_last_seen":0,"flow_tot_l4_data_len":198,"flow_min_l4_data_len":198,"flow_max_l4_data_len":198,"flow_avg_l4_data_len":198,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51042,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":741,"flow_packet_id":1,"flow_first_seen":1576420277889,"flow_last_seen":0,"flow_tot_l4_data_len":191,"flow_min_l4_data_len":191,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":191,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51044,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":742,"flow_packet_id":1,"flow_first_seen":1576420277890,"flow_last_seen":0,"flow_tot_l4_data_len":179,"flow_min_l4_data_len":179,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":179,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51046,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":743,"flow_packet_id":1,"flow_first_seen":1576420277892,"flow_last_seen":0,"flow_tot_l4_data_len":205,"flow_min_l4_data_len":205,"flow_max_l4_data_len":205,"flow_avg_l4_data_len":205,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51048,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test","flow_id":744,"flow_packet_id":1,"flow_first_seen":1576420277893,"flow_last_seen":0,"flow_tot_l4_data_len":219,"flow_min_l4_data_len":219,"flow_max_l4_data_len":219,"flow_avg_l4_data_len":219,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":51050,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":797,"source":"WebattackRCE.pcap","alias":"nDPId-test"} diff --git a/test/results/WebattackSQLinj.pcap.out b/test/results/WebattackSQLinj.pcap.out index aba945694..051ee6801 100644 --- a/test/results/WebattackSQLinj.pcap.out +++ b/test/results/WebattackSQLinj.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1499348407419,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36196,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348407,"pkt_ts_usec":419016,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABm5CmnxAMGxFOsxCABFAAA84aRAAD4G5CusEAABwKgKMo1kAFAWk4RJAAAAAKACchDPRwAAAgQFtAQCCAoBPmXtAAAAAAEDAwc="} 00442{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348407,"pkt_ts_usec":419147,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMGxFOsxABm5CmnxCABFAAA8AABAAEAGw9DAqAoyrBAAAQBQjWS7EzBkFpOESqAScSCpZgAAAgQFtAQCCAoD6DdgAT5l7QEDAwc="} @@ -114,3 +115,9 @@ 00431{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":92,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348519,"pkt_ts_usec":77010,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABm5CmnxAMGxFOsxCABFAAA0tH1AAD4GEVusEAABwKgKMo10AFC7kHzDsuKDZ4ARASWKoQAAAQEICgE+0vgD6J+I"} 00431{"flow_id":9,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348519,"pkt_ts_usec":77129,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AMGxFOsxABm5CmnxCABFAAA07LtAAEAG1xzAqAoyrBAAAQBQjXSy4oNnu5B8xIARAOyF9wAAAQEICgPopGoBPtL4"} 00431{"flow_id":9,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348519,"pkt_ts_usec":77716,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABm5CmnxAMGxFOsxCABFAAA0tH5AAD4GEVqsEAABwKgKMo10AFC7kHzEsuKDaIAQASWFvgAAAQEICgE+0vgD6KRq"} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":10,"flow_first_seen":1499348467295,"flow_last_seen":1499348472302,"flow_tot_l4_data_len":2956,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2053,"flow_avg_l4_data_len":295,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36204,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":10,"flow_first_seen":1499348480992,"flow_last_seen":1499348486002,"flow_tot_l4_data_len":1389,"flow_min_l4_data_len":32,"flow_max_l4_data_len":562,"flow_avg_l4_data_len":138,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36206,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":10,"flow_first_seen":1499348494345,"flow_last_seen":1499348499355,"flow_tot_l4_data_len":2712,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1872,"flow_avg_l4_data_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36208,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":10,"flow_first_seen":1499348506489,"flow_last_seen":1499348511497,"flow_tot_l4_data_len":2754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1913,"flow_avg_l4_data_len":275,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36210,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":12,"flow_first_seen":1499348514064,"flow_last_seen":1499348519077,"flow_tot_l4_data_len":5149,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2733,"flow_avg_l4_data_len":429,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":36212,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":94,"source":"WebattackSQLinj.pcap","alias":"nDPId-test"} diff --git a/test/results/WebattackXSS.pcap.out b/test/results/WebattackXSS.pcap.out index db80509c7..727db3035 100644 --- a/test/results/WebattackXSS.pcap.out +++ b/test/results/WebattackXSS.pcap.out @@ -1,3 +1,4 @@ +00389{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"WebattackXSS.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1499346935283,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":52098,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"WebattackXSS.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499346935,"pkt_ts_usec":283859,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABm5CmnxAMGxFOsxCABFAAA8wadAAD4GBCmsEAABwKgKMsuCAFAodgngAAAAAKACchCXWwAAAgQFtAQCCAoBOMhHAAAAAAEDAwc="} 00439{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"WebattackXSS.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499346935,"pkt_ts_usec":283960,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMGxFOsxABm5CmnxCABFAAA8AABAAEAGw9DAqAoyrBAAAQBQy4I5j3VaKHYJ4aAScSBLsAAAAgQFtAQCCAoD4pm+ATjIRwEDAwc="} @@ -6060,3 +6061,88 @@ 00444{"flow_id":661,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9369,"source":"WebattackXSS.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348099,"pkt_ts_usec":359601,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABm5CmnxAMGxFOsxCABFAAA8tSBAAD4GELCsEAABwKgKMoxuAFCNr4w1AAAAAKACchB+DgAAAgQFtAQCCAoBPTkVAAAAAAEDAwc="} 00444{"flow_id":661,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9370,"source":"WebattackXSS.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348099,"pkt_ts_usec":359726,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AMGxFOsxABm5CmnxCABFAAA8AABAAEAGw9DAqAoyrBAAAQBQjG7WE+F5ja+MNqAScSC47wAAAgQFtAQCCAoD5wqJAT05FQEDAwc="} 00432{"flow_id":661,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9371,"source":"WebattackXSS.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1499348099,"pkt_ts_usec":360303,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABm5CmnxAMGxFOsxCABFAAA0tSFAAD4GELesEAABwKgKMoxuAFCNr4w21hPheoAQAOVX9wAAAQEICgE9ORUD5wqJ"} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":606,"flow_packet_id":311,"flow_first_seen":1499348002450,"flow_last_seen":1499348071824,"flow_tot_l4_data_len":242323,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1901,"flow_avg_l4_data_len":779,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":34940,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":620,"flow_packet_id":7,"flow_first_seen":1499348028117,"flow_last_seen":1499348033910,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35208,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":620,"flow_packet_id":7,"flow_first_seen":1499348028117,"flow_last_seen":1499348033910,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35208,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":621,"flow_packet_id":6,"flow_first_seen":1499348029395,"flow_last_seen":1499348034910,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35222,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":621,"flow_packet_id":6,"flow_first_seen":1499348029395,"flow_last_seen":1499348034910,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35222,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":622,"flow_packet_id":6,"flow_first_seen":1499348030687,"flow_last_seen":1499348035910,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35236,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":622,"flow_packet_id":6,"flow_first_seen":1499348030687,"flow_last_seen":1499348035910,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35236,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":623,"flow_packet_id":7,"flow_first_seen":1499348033296,"flow_last_seen":1499348038910,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35262,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":623,"flow_packet_id":7,"flow_first_seen":1499348033296,"flow_last_seen":1499348038910,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35262,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":624,"flow_packet_id":6,"flow_first_seen":1499348034569,"flow_last_seen":1499348039911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35276,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":624,"flow_packet_id":6,"flow_first_seen":1499348034569,"flow_last_seen":1499348039911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35276,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":625,"flow_packet_id":6,"flow_first_seen":1499348037175,"flow_last_seen":1499348042911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35302,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":625,"flow_packet_id":6,"flow_first_seen":1499348037175,"flow_last_seen":1499348042911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35302,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":626,"flow_packet_id":6,"flow_first_seen":1499348038438,"flow_last_seen":1499348043911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35316,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":626,"flow_packet_id":6,"flow_first_seen":1499348038438,"flow_last_seen":1499348043911,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35316,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":627,"flow_packet_id":6,"flow_first_seen":1499348041088,"flow_last_seen":1499348046912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35342,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":627,"flow_packet_id":6,"flow_first_seen":1499348041088,"flow_last_seen":1499348046912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35342,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":6,"flow_first_seen":1499348042384,"flow_last_seen":1499348047912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35356,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":628,"flow_packet_id":6,"flow_first_seen":1499348042384,"flow_last_seen":1499348047912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35356,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":6,"flow_first_seen":1499348043670,"flow_last_seen":1499348048912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35370,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":629,"flow_packet_id":6,"flow_first_seen":1499348043670,"flow_last_seen":1499348048912,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35370,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":630,"flow_packet_id":6,"flow_first_seen":1499348046262,"flow_last_seen":1499348051913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35396,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":630,"flow_packet_id":6,"flow_first_seen":1499348046262,"flow_last_seen":1499348051913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35396,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":631,"flow_packet_id":6,"flow_first_seen":1499348047547,"flow_last_seen":1499348052913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35410,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":631,"flow_packet_id":6,"flow_first_seen":1499348047547,"flow_last_seen":1499348052913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35410,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":632,"flow_packet_id":6,"flow_first_seen":1499348050079,"flow_last_seen":1499348055913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35436,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":632,"flow_packet_id":6,"flow_first_seen":1499348050079,"flow_last_seen":1499348055913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35436,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":633,"flow_packet_id":6,"flow_first_seen":1499348051362,"flow_last_seen":1499348056913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35450,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":633,"flow_packet_id":6,"flow_first_seen":1499348051362,"flow_last_seen":1499348056913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35450,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":634,"flow_packet_id":6,"flow_first_seen":1499348052641,"flow_last_seen":1499348057914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35464,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":634,"flow_packet_id":6,"flow_first_seen":1499348052641,"flow_last_seen":1499348057914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35464,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":635,"flow_packet_id":6,"flow_first_seen":1499348055228,"flow_last_seen":1499348060913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35490,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":635,"flow_packet_id":6,"flow_first_seen":1499348055228,"flow_last_seen":1499348060913,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35490,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":636,"flow_packet_id":6,"flow_first_seen":1499348056534,"flow_last_seen":1499348061914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35504,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":636,"flow_packet_id":6,"flow_first_seen":1499348056534,"flow_last_seen":1499348061914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":637,"flow_packet_id":6,"flow_first_seen":1499348057789,"flow_last_seen":1499348062914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35518,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":637,"flow_packet_id":6,"flow_first_seen":1499348057789,"flow_last_seen":1499348062914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35518,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":638,"flow_packet_id":6,"flow_first_seen":1499348059068,"flow_last_seen":1499348064914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35532,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":638,"flow_packet_id":6,"flow_first_seen":1499348059068,"flow_last_seen":1499348064914,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35532,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":639,"flow_packet_id":6,"flow_first_seen":1499348060393,"flow_last_seen":1499348065915,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35546,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":639,"flow_packet_id":6,"flow_first_seen":1499348060393,"flow_last_seen":1499348065915,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35546,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":640,"flow_packet_id":6,"flow_first_seen":1499348061684,"flow_last_seen":1499348066915,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35560,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":640,"flow_packet_id":6,"flow_first_seen":1499348061684,"flow_last_seen":1499348066915,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35560,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":641,"flow_packet_id":6,"flow_first_seen":1499348064243,"flow_last_seen":1499348069916,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35586,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":641,"flow_packet_id":6,"flow_first_seen":1499348064243,"flow_last_seen":1499348069916,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35586,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":642,"flow_packet_id":6,"flow_first_seen":1499348065546,"flow_last_seen":1499348070917,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35600,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":642,"flow_packet_id":6,"flow_first_seen":1499348065546,"flow_last_seen":1499348070917,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35600,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":643,"flow_packet_id":133,"flow_first_seen":1499348068136,"flow_last_seen":1499348099366,"flow_tot_l4_data_len":103426,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1901,"flow_avg_l4_data_len":777,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35626,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":6,"flow_first_seen":1499348069426,"flow_last_seen":1499348074917,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35640,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":644,"flow_packet_id":6,"flow_first_seen":1499348069426,"flow_last_seen":1499348074917,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35640,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":645,"flow_packet_id":6,"flow_first_seen":1499348070791,"flow_last_seen":1499348075918,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35654,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":645,"flow_packet_id":6,"flow_first_seen":1499348070791,"flow_last_seen":1499348075918,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35654,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":646,"flow_packet_id":6,"flow_first_seen":1499348072088,"flow_last_seen":1499348077919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35668,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":646,"flow_packet_id":6,"flow_first_seen":1499348072088,"flow_last_seen":1499348077919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35668,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":647,"flow_packet_id":6,"flow_first_seen":1499348073365,"flow_last_seen":1499348078919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35682,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":647,"flow_packet_id":6,"flow_first_seen":1499348073365,"flow_last_seen":1499348078919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35682,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":648,"flow_packet_id":6,"flow_first_seen":1499348074670,"flow_last_seen":1499348079919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35696,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":648,"flow_packet_id":6,"flow_first_seen":1499348074670,"flow_last_seen":1499348079919,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35696,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":649,"flow_packet_id":6,"flow_first_seen":1499348077218,"flow_last_seen":1499348082920,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35722,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":649,"flow_packet_id":6,"flow_first_seen":1499348077218,"flow_last_seen":1499348082920,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35722,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":650,"flow_packet_id":6,"flow_first_seen":1499348078531,"flow_last_seen":1499348083921,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35736,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":650,"flow_packet_id":6,"flow_first_seen":1499348078531,"flow_last_seen":1499348083921,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35736,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":651,"flow_packet_id":6,"flow_first_seen":1499348081113,"flow_last_seen":1499348086921,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35762,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":651,"flow_packet_id":6,"flow_first_seen":1499348081113,"flow_last_seen":1499348086921,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35762,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":652,"flow_packet_id":6,"flow_first_seen":1499348082422,"flow_last_seen":1499348087922,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35776,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":652,"flow_packet_id":6,"flow_first_seen":1499348082422,"flow_last_seen":1499348087922,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35776,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":653,"flow_packet_id":6,"flow_first_seen":1499348083715,"flow_last_seen":1499348088922,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35790,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":653,"flow_packet_id":6,"flow_first_seen":1499348083715,"flow_last_seen":1499348088922,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35790,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":654,"flow_packet_id":6,"flow_first_seen":1499348086300,"flow_last_seen":1499348091923,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35816,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":654,"flow_packet_id":6,"flow_first_seen":1499348086300,"flow_last_seen":1499348091923,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35816,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":655,"flow_packet_id":6,"flow_first_seen":1499348087568,"flow_last_seen":1499348092924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35830,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":655,"flow_packet_id":6,"flow_first_seen":1499348087568,"flow_last_seen":1499348092924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35830,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":656,"flow_packet_id":6,"flow_first_seen":1499348090129,"flow_last_seen":1499348095924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35856,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":656,"flow_packet_id":6,"flow_first_seen":1499348090129,"flow_last_seen":1499348095924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35856,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":657,"flow_packet_id":6,"flow_first_seen":1499348091413,"flow_last_seen":1499348096924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35870,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":657,"flow_packet_id":6,"flow_first_seen":1499348091413,"flow_last_seen":1499348096924,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35870,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":658,"flow_packet_id":6,"flow_first_seen":1499348092675,"flow_last_seen":1499348097925,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35884,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":658,"flow_packet_id":6,"flow_first_seen":1499348092675,"flow_last_seen":1499348097925,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35884,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":659,"flow_packet_id":3,"flow_first_seen":1499348095258,"flow_last_seen":1499348095259,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35910,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":659,"flow_packet_id":3,"flow_first_seen":1499348095258,"flow_last_seen":1499348095259,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35910,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":660,"flow_packet_id":3,"flow_first_seen":1499348096595,"flow_last_seen":1499348096595,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35924,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":660,"flow_packet_id":3,"flow_first_seen":1499348096595,"flow_last_seen":1499348096595,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35924,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":661,"flow_packet_id":3,"flow_first_seen":1499348099359,"flow_last_seen":1499348099360,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35950,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test","flow_id":661,"flow_packet_id":3,"flow_first_seen":1499348099359,"flow_last_seen":1499348099360,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.0.1","dst_ip":"192.168.10.50","src_port":35950,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9374,"source":"WebattackXSS.pcap","alias":"nDPId-test"} diff --git a/test/results/aimini-http.pcap.out b/test/results/aimini-http.pcap.out index b29bdccc0..1a00eb1e9 100644 --- a/test/results/aimini-http.pcap.out +++ b/test/results/aimini-http.pcap.out @@ -1,3 +1,4 @@ +00388{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"aimini-http.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1614860229383,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28501,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"aimini-http.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1614860229,"pkt_ts_usec":383219,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"5kBKB+riApXG95NLCABFAAAwBPkAAIAGAAAKZQACCmYAAm9VAFCbu4XRAAAAAHACgAEU8QAAAgQFtAMDAQA="} 00422{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"aimini-http.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1614860229,"pkt_ts_usec":383751,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ApXG95WRWgXZu6TVCABFAAAwBPkAAH8GIgEKZQACCmYAAm9VAFCbu4XRAAAAAHACgAFeHQAAAgQFtAMDAQA="} @@ -64,3 +65,8 @@ 00422{"flow_id":4,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"aimini-http.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1614860229,"pkt_ts_usec":390687,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"5kBKB+riApXG95NLCABFAAAoBRoAAIAGAAAKZQACCmYAAm9YAFCbu\/qJm7v8dlAUgAEU6QAAAAAAAAAA"} 00422{"flow_id":4,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":138,"source":"aimini-http.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1614860229,"pkt_ts_usec":390688,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"WgXZu6TVApXG95WRCABFAAAoBSQAAIAGAAAKZgACCmUAAgBQb1ibu\/x2m7v6iVAUgAEU6QAAAAAAAAAA"} 00422{"flow_id":4,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1614860229,"pkt_ts_usec":390930,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ApXG95WRWgXZu6TVCABFAAAoBRoAAH8GIegKZQACCmYAAm9YAFCbu\/qJm7v8dlAUgAF84AAAAAAAAAAA"} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":72,"flow_first_seen":1614860229383,"flow_last_seen":1614860229388,"flow_tot_l4_data_len":62186,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":863,"midstream":0,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28501,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1614860229385,"flow_last_seen":1614860229388,"flow_tot_l4_data_len":3586,"flow_min_l4_data_len":20,"flow_max_l4_data_len":551,"flow_avg_l4_data_len":199,"midstream":0,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28502,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":1614860229388,"flow_last_seen":1614860229390,"flow_tot_l4_data_len":14200,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":473,"midstream":0,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28503,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":13,"flow_first_seen":1614860229389,"flow_last_seen":1614860229390,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":20,"flow_max_l4_data_len":562,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":28504,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":139,"source":"aimini-http.pcap","alias":"nDPId-test"} diff --git a/test/results/ajp.pcap.out b/test/results/ajp.pcap.out index 5ac96b154..2282f1038 100644 --- a/test/results/ajp.pcap.out +++ b/test/results/ajp.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ajp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00397{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"ajp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1505154584,"pkt_ts_usec":447407,"pkt_caplen":78,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":78,"pkt_l4_len":0,"pkt":"AFBWg47zAFBWg11YgQAABwgARQAAPLLIQABABhyUrB0JkqwdCZOXyB9JcsXbLwAAAACgAjkI5g0AAAIEBbQEAggKTpxp5wAAAAABAwMH"} 00153{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"ajp.pcap","alias":"nDPId-test","type":33024} 00397{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"ajp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1505154584,"pkt_ts_usec":447547,"pkt_caplen":78,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":78,"pkt_l4_len":0,"pkt":"AFBWg11YAFBWg47zgQAABwgARQAAPAAAQABABs9crB0Jk6wdCZIfSZfIk6AuuHLF2zCgEjiQFewAAAIEBbQEAggKHlfv2E6caecBAwMH"} @@ -74,3 +75,4 @@ 00154{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":37,"source":"ajp.pcap","alias":"nDPId-test","type":33024} 00390{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":38,"source":"ajp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1505154584,"pkt_ts_usec":618218,"pkt_caplen":70,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":70,"pkt_l4_len":0,"pkt":"AFBWg47zAFBWg11YgQAABwgARQAANLLOQABABhyWrB0JkqwdCZOXyB9KcsXfUJOgL6qAEAB7dmUAAAEBCApOnGqSHlfwgw=="} 00154{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":38,"source":"ajp.pcap","alias":"nDPId-test","type":33024} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"ajp.pcap","alias":"nDPId-test"} diff --git a/test/results/alexa-app.pcapng.out b/test/results/alexa-app.pcapng.out index b130e56ef..56bec3ab9 100644 --- a/test/results/alexa-app.pcapng.out +++ b/test/results/alexa-app.pcapng.out @@ -1,3 +1,4 @@ +00388{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"alexa-app.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00334{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976022,"pkt_ts_usec":526783,"pkt_caplen":20,"pkt_type":6,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":20,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/ePiC0\/vCAAYAAa+BAQA="} 00157{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"alexa-app.pcapng","alias":"nDPId-test","type":6} 00334{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976022,"pkt_ts_usec":526847,"pkt_caplen":20,"pkt_type":6,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":20,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/ePiC0\/vCAAYAAa+BAQA="} @@ -2286,3 +2287,86 @@ 00417{"flow_id":162,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3385,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976197,"pkt_ts_usec":618788,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoAuRAAEAGSnWsECrYSBXOebn2AbvarIqMGg6rWFAQAXnakgAA"} 00417{"flow_id":162,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3386,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976197,"pkt_ts_usec":618909,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AMDKkaPvePiC0\/vCCABFAAAoAuVAAEAGSnSsECrYSBXOebn2AbvarIqMGg6t0lAQAYTYDQAA"} 00591{"flow_id":162,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3387,"source":"alexa-app.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490976197,"pkt_ts_usec":632551,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"AMDKkaPvePiC0\/vCCABFAACmAuZAAEAGSfWsECrYSBXOebn2AbvarIqMGg6t0lAYAYRNaAAAFgMDAEYQAABCQQQJZBnvJnWA+MuEoBN0+HrOeSGGwWp\/lMUBpYesnGyEe8+EwOD1buwoY9PbYMqcEE2yeBvFpzQGBjY0\/Akn28BLFAMDAAEBFgMDACgAAAAAAAAAAKKmKckizYCC0IOZuaIZIUHBw\/f7WqAMKNzoOZNBC00Z"} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1490976041150,"flow_last_seen":1490976041151,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":54886,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":140,"flow_packet_id":18,"flow_first_seen":1490976177116,"flow_last_seen":1490976177850,"flow_tot_l4_data_len":6964,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":386,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50796,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":141,"flow_packet_id":25,"flow_first_seen":1490976177116,"flow_last_seen":1490976187290,"flow_tot_l4_data_len":10035,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50797,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":142,"flow_packet_id":7,"flow_first_seen":1490976177116,"flow_last_seen":1490976195547,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50798,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":142,"flow_packet_id":7,"flow_first_seen":1490976177116,"flow_last_seen":1490976195547,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50798,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":143,"flow_packet_id":37,"flow_first_seen":1490976177276,"flow_last_seen":1490976187754,"flow_tot_l4_data_len":13563,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":366,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50799,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":145,"flow_packet_id":17,"flow_first_seen":1490976186164,"flow_last_seen":1490976186790,"flow_tot_l4_data_len":5520,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":324,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":50800,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":127,"flow_packet_id":51,"flow_first_seen":1490976139642,"flow_last_seen":1490976140773,"flow_tot_l4_data_len":30946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":606,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51992,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":128,"flow_packet_id":26,"flow_first_seen":1490976139643,"flow_last_seen":1490976140772,"flow_tot_l4_data_len":13670,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":525,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51993,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":129,"flow_packet_id":21,"flow_first_seen":1490976139643,"flow_last_seen":1490976140745,"flow_tot_l4_data_len":8913,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":424,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51994,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":130,"flow_packet_id":47,"flow_first_seen":1490976139643,"flow_last_seen":1490976140773,"flow_tot_l4_data_len":32039,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":681,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51995,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":131,"flow_packet_id":28,"flow_first_seen":1490976139643,"flow_last_seen":1490976140773,"flow_tot_l4_data_len":14771,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":527,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":132,"flow_packet_id":30,"flow_first_seen":1490976139643,"flow_last_seen":1490976140781,"flow_tot_l4_data_len":16797,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":559,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.63.56","src_port":51997,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1490976023264,"flow_last_seen":1490976023264,"flow_tot_l4_data_len":646,"flow_min_l4_data_len":323,"flow_max_l4_data_len":323,"flow_avg_l4_data_len":323,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":149,"flow_packet_id":21,"flow_first_seen":1490976187511,"flow_last_seen":1490976190310,"flow_tot_l4_data_len":9629,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":458,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":38757,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":147,"flow_packet_id":33,"flow_first_seen":1490976186884,"flow_last_seen":1490976197347,"flow_tot_l4_data_len":16171,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":490,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.23.94","src_port":44912,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":126,"flow_packet_id":41,"flow_first_seen":1490976136930,"flow_last_seen":1490976140745,"flow_tot_l4_data_len":14534,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40871,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":133,"flow_packet_id":23,"flow_first_seen":1490976142629,"flow_last_seen":1490976148981,"flow_tot_l4_data_len":4083,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":177,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.253","src_port":40878,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00462{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1490976027958,"flow_last_seen":1490976030758,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.1","dst_ip":"172.16.42.216","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1490976027514,"flow_last_seen":1490976027560,"flow_tot_l4_data_len":129,"flow_min_l4_data_len":42,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":53188,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":115,"flow_packet_id":2,"flow_first_seen":1490976115835,"flow_last_seen":1490976115901,"flow_tot_l4_data_len":146,"flow_min_l4_data_len":65,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":28614,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":76,"flow_packet_id":24,"flow_first_seen":1490976076042,"flow_last_seen":1490976177233,"flow_tot_l4_data_len":4002,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":166,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":37113,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":161,"flow_packet_id":24,"flow_first_seen":1490976196942,"flow_last_seen":1490976198168,"flow_tot_l4_data_len":11559,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":481,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.121","src_port":47605,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":162,"flow_packet_id":28,"flow_first_seen":1490976197297,"flow_last_seen":1490976198043,"flow_tot_l4_data_len":9624,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":343,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"72.21.206.121","src_port":47606,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":74,"flow_packet_id":23,"flow_first_seen":1490976071392,"flow_last_seen":1490976176431,"flow_tot_l4_data_len":6144,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":267,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":59698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1490976031581,"flow_last_seen":1490976031687,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":42,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":41030,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":104,"flow_packet_id":2,"flow_first_seen":1490976107217,"flow_last_seen":1490976107359,"flow_tot_l4_data_len":114,"flow_min_l4_data_len":49,"flow_max_l4_data_len":65,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14476,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":155,"flow_packet_id":30,"flow_first_seen":1490976195983,"flow_last_seen":1490976196942,"flow_tot_l4_data_len":14926,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":497,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41912,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":156,"flow_packet_id":350,"flow_first_seen":1490976195984,"flow_last_seen":1490976198040,"flow_tot_l4_data_len":261612,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":747,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41913,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":157,"flow_packet_id":35,"flow_first_seen":1490976195985,"flow_last_seen":1490976196943,"flow_tot_l4_data_len":16954,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":484,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.84.62.115","src_port":41914,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":139,"flow_packet_id":2,"flow_first_seen":1490976177026,"flow_last_seen":1490976177105,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4312,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1490976027724,"flow_last_seen":1490976027725,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":10462,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1490976024847,"flow_last_seen":1490976024848,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":55,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":55619,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1490976043611,"flow_last_seen":1490976043811,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":43,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":43350,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":151,"flow_packet_id":65,"flow_first_seen":1490976195529,"flow_last_seen":1490976198776,"flow_tot_l4_data_len":36892,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":567,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.143","src_port":41828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00447{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1490976022741,"flow_last_seen":1490976022741,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00456{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1490976022731,"flow_last_seen":1490976022731,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ffd3:fbc2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":20,"flow_packet_id":29,"flow_first_seen":1490976030894,"flow_last_seen":1490976194743,"flow_tot_l4_data_len":14473,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":499,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.22.185","src_port":53682,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":134,"flow_packet_id":20,"flow_first_seen":1490976150029,"flow_last_seen":1490976164211,"flow_tot_l4_data_len":3390,"flow_min_l4_data_len":20,"flow_max_l4_data_len":718,"flow_avg_l4_data_len":169,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45750,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":135,"flow_packet_id":21,"flow_first_seen":1490976158680,"flow_last_seen":1490976164214,"flow_tot_l4_data_len":3261,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":155,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45751,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":109,"flow_packet_id":2,"flow_first_seen":1490976114879,"flow_last_seen":1490976114880,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":20922,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":138,"flow_packet_id":18,"flow_first_seen":1490976169531,"flow_last_seen":1490976175920,"flow_tot_l4_data_len":3271,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":45752,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":146,"flow_packet_id":2,"flow_first_seen":1490976186818,"flow_last_seen":1490976186879,"flow_tot_l4_data_len":146,"flow_min_l4_data_len":65,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":8669,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":70,"flow_packet_id":2,"flow_first_seen":1490976071312,"flow_last_seen":1490976071389,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":42,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":25081,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":154,"flow_packet_id":2,"flow_first_seen":1490976195921,"flow_last_seen":1490976195980,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":57,"flow_max_l4_data_len":163,"flow_avg_l4_data_len":110,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4612,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":148,"flow_packet_id":2,"flow_first_seen":1490976187242,"flow_last_seen":1490976187508,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":42,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":59908,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":18,"flow_packet_id":19,"flow_first_seen":1490976029756,"flow_last_seen":1490976171313,"flow_tot_l4_data_len":5432,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":285,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.0","src_port":33556,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":137,"flow_packet_id":19,"flow_first_seen":1490976165062,"flow_last_seen":1490976175921,"flow_tot_l4_data_len":3753,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1310,"flow_avg_l4_data_len":197,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.94.232.134","src_port":39750,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":136,"flow_packet_id":2,"flow_first_seen":1490976164994,"flow_last_seen":1490976165058,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":42,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":64073,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":150,"flow_packet_id":2,"flow_first_seen":1490976195484,"flow_last_seen":1490976195524,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":14934,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":160,"flow_packet_id":2,"flow_first_seen":1490976196840,"flow_last_seen":1490976196938,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":43,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":2707,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_first_seen":1490976093238,"flow_last_seen":1490976093355,"flow_tot_l4_data_len":135,"flow_min_l4_data_len":48,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":41639,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":158,"flow_packet_id":19,"flow_first_seen":1490976196016,"flow_last_seen":1490976196282,"flow_tot_l4_data_len":1903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":617,"flow_avg_l4_data_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.28.178","src_port":58048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":66,"flow_packet_id":56,"flow_first_seen":1490976067968,"flow_last_seen":1490976168824,"flow_tot_l4_data_len":27953,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":499,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"54.239.29.146","src_port":41691,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1490976032763,"flow_last_seen":1490976032763,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00469{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1490976023731,"flow_last_seen":1490976031750,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7af8:82ff:fed3:fbc2","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":119,"flow_packet_id":2,"flow_first_seen":1490976133936,"flow_last_seen":1490976134135,"flow_tot_l4_data_len":265,"flow_min_l4_data_len":47,"flow_max_l4_data_len":218,"flow_avg_l4_data_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":4920,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":153,"flow_packet_id":19,"flow_first_seen":1490976195633,"flow_last_seen":1490976195989,"flow_tot_l4_data_len":7206,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"216.58.194.78","src_port":49067,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1490976041806,"flow_last_seen":1490976041938,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":52077,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":96,"flow_packet_id":2,"flow_first_seen":1490976090796,"flow_last_seen":1490976090982,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":53,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":35726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1490976041770,"flow_last_seen":1490976041866,"flow_tot_l4_data_len":146,"flow_min_l4_data_len":65,"flow_max_l4_data_len":81,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":21391,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":13,"flow_packet_id":7,"flow_first_seen":1490976027733,"flow_last_seen":1490976027826,"flow_tot_l4_data_len":511,"flow_min_l4_data_len":32,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.217.9.142","src_port":35540,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1490976035502,"flow_last_seen":1490976035549,"flow_tot_l4_data_len":228,"flow_min_l4_data_len":66,"flow_max_l4_data_len":162,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":23559,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1490976029184,"flow_last_seen":1490976029244,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":48155,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":159,"flow_packet_id":62,"flow_first_seen":1490976196223,"flow_last_seen":1490976196880,"flow_tot_l4_data_len":26834,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":432,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.143","src_port":38483,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":8,"flow_packet_id":7,"flow_first_seen":1490976024857,"flow_last_seen":1490976024994,"flow_tot_l4_data_len":511,"flow_min_l4_data_len":32,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.217.9.142","src_port":60246,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":8,"flow_first_seen":1490976041428,"flow_last_seen":1490976168813,"flow_tot_l4_data_len":300,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40200,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":8,"flow_first_seen":1490976041428,"flow_last_seen":1490976168813,"flow_tot_l4_data_len":300,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40200,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":7,"flow_first_seen":1490976043609,"flow_last_seen":1490976168960,"flow_tot_l4_data_len":260,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40202,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":7,"flow_first_seen":1490976043609,"flow_last_seen":1490976168960,"flow_tot_l4_data_len":260,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40202,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1490976030681,"flow_last_seen":1490976030890,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":7358,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":84,"flow_packet_id":7,"flow_first_seen":1490976085883,"flow_last_seen":1490976149040,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40242,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":84,"flow_packet_id":7,"flow_first_seen":1490976085883,"flow_last_seen":1490976149040,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"10.201.126.241","src_port":40242,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":100,"flow_packet_id":41,"flow_first_seen":1490976093358,"flow_last_seen":1490976194991,"flow_tot_l4_data_len":8165,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":199,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"176.32.101.52","src_port":44001,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1490976024793,"flow_last_seen":1490976024844,"flow_tot_l4_data_len":138,"flow_min_l4_data_len":55,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":3440,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1490976027522,"flow_last_seen":1490976027523,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":52603,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":1490976067916,"flow_last_seen":1490976067965,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":60804,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":11,"flow_packet_id":17,"flow_first_seen":1490976027567,"flow_last_seen":1490976028006,"flow_tot_l4_data_len":2009,"flow_min_l4_data_len":32,"flow_max_l4_data_len":549,"flow_avg_l4_data_len":118,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"173.194.223.188","src_port":42878,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":63,"flow_packet_id":2,"flow_first_seen":1490976064333,"flow_last_seen":1490976064448,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":44475,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":16,"flow_packet_id":38,"flow_first_seen":1490976029248,"flow_last_seen":1490976152630,"flow_tot_l4_data_len":13618,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"52.85.209.197","src_port":55242,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":152,"flow_packet_id":2,"flow_first_seen":1490976195545,"flow_last_seen":1490976195628,"flow_tot_l4_data_len":144,"flow_min_l4_data_len":52,"flow_max_l4_data_len":92,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":40425,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1490976029669,"flow_last_seen":1490976029753,"flow_tot_l4_data_len":142,"flow_min_l4_data_len":50,"flow_max_l4_data_len":92,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.42.216","dst_ip":"172.16.42.1","src_port":19967,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3435,"source":"alexa-app.pcapng","alias":"nDPId-test"} diff --git a/test/results/among_us.pcap.out b/test/results/among_us.pcap.out index 7584213ca..e28d73386 100644 --- a/test/results/among_us.pcap.out +++ b/test/results/among_us.pcap.out @@ -1,3 +1,6 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"among_us.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"among_us.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":23,"flow_min_l4_data_len":23,"flow_max_l4_data_len":23,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.105.251.170","src_port":64260,"dst_port":22023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00405{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"among_us.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946681200,"pkt_ts_usec":0,"pkt_caplen":57,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":57,"pkt_l4_len":23,"pkt":"eJS0JASgYDjgxTWgCABFAAArJhEAAH8RqpAKAAABrGn7qvsEVgcAF2toCAABAIDZAgMGQUFBQUFB"} 00497{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"among_us.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":23,"flow_min_l4_data_len":23,"flow_max_l4_data_len":23,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.105.251.170","src_port":64260,"dst_port":22023,"l4_proto":"udp","ndpi": {"proto":"AmongUs","breed":"Fun","category":"Game"}} +00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"among_us.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":23,"flow_min_l4_data_len":23,"flow_max_l4_data_len":23,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.105.251.170","src_port":64260,"dst_port":22023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"among_us.pcap","alias":"nDPId-test"} diff --git a/test/results/amqp.pcap.out b/test/results/amqp.pcap.out index a755f3071..9d147f3e6 100644 --- a/test/results/amqp.pcap.out +++ b/test/results/amqp.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"amqp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00463{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"amqp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1490904166118,"flow_last_seen":0,"flow_tot_l4_data_len":73,"flow_min_l4_data_len":73,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.1.1","src_port":44205,"dst_port":5672,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00479{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"amqp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490904166,"pkt_ts_usec":118902,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"AAAAAAAAAAAAAAAACABFAABdxi1AAEAGdWt\/AAABfwABAaytFihPdGXjNxAmEoAYAV7\/UQAAAQEICgC+1cIAvtPNAQABAAAAIQA8ACgAAAhjZWxlcnlldhB3b3JrZXIuaGVhcnRiZWF0AM4="} 00491{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"amqp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1490904166118,"flow_last_seen":0,"flow_tot_l4_data_len":73,"flow_min_l4_data_len":73,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.1.1","src_port":44205,"dst_port":5672,"l4_proto":"tcp","ndpi": {"proto":"AMQP","breed":"Acceptable","category":"RPC"}} @@ -49,3 +50,7 @@ 00993{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"amqp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490904170,"pkt_ts_usec":135718,"pkt_caplen":491,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":491,"pkt_l4_len":457,"pkt":"AAAAAAAAAAAAAAAACABFAAHdAQtAAEAGOQ5\/AAEBfwAAARYorKyekqnxoHNntoAYAXcA0gAAAQEICgC+2a4AvtknAQABAAAAHwA8ADwBNAAAAAAAAb0ZAAdkZWZhdWx0B3Rhc2tzLiPOAgABAAAAhAA8AAAAAAAAAAAA7v4AHmFwcGxpY2F0aW9uL3gtcHl0aG9uLXNlcmlhbGl6ZQZiaW5hcnkAAAAAAgAkNTRhOTE1NGEtMTZiNC00NGFkLTg5OWYtNmMzNjI5YzNiNGVlJGFiZjI3YmI1LTAxNDktM2RiZC1hMmRiLWQzNTcyYzMwOTc5MM4DAAEAAADugAJ9cQEoVQdleHBpcmVzcQJOVQN1dGNxA4hVBGFyZ3NxBF1xBVgDAAAAMjYycQZhVQVjaG9yZHEHTlUJY2FsbGJhY2tzcQhOVQhlcnJiYWNrc3EJTlUHdGFza3NldHEKTlUCaWRxC1UkNTRhOTE1NGEtMTZiNC00NGFkLTg5OWYtNmMzNjI5YzNiNGVlcQxVB3JldHJpZXNxDUsAVQR0YXNrcQ5VH0NvZ25pdG9Db3JlLnRhc2tzLmV4ZWN1dGVQb2xpY3lxD1UJdGltZWxpbWl0cRBOToZVA2V0YXERTlUGa3dhcmdzcRJ9cRN1Ls4="} 00423{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"amqp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490904170,"pkt_ts_usec":135886,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAAAAAAAAAAAAAACABFAAA0HMhAAEAGHvp\/AAABfwABAaysFiigc2e2npKrmoAQDjX\/KAAAAQEICgC+2a4Avtmr"} 00993{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"amqp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1490904170,"pkt_ts_usec":155347,"pkt_caplen":491,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":491,"pkt_l4_len":457,"pkt":"AAAAAAAAAAAAAAAACABFAAHdAQxAAEAGOQ1\/AAEBfwAAARYorKyekquaoHNntoAYAXcA0gAAAQEICgC+2bMAvtmuAQABAAAAHwA8ADwBNAAAAAAAAb0aAAdkZWZhdWx0B3Rhc2tzLiPOAgABAAAAhAA8AAAAAAAAAAAA7v4AHmFwcGxpY2F0aW9uL3gtcHl0aG9uLXNlcmlhbGl6ZQZiaW5hcnkAAAAAAgAkOTJiZGYxYTItYjM4Ni00NDE3LWIzNTEtMzRlZDYyMDk2ODI3JGFiZjI3YmI1LTAxNDktM2RiZC1hMmRiLWQzNTcyYzMwOTc5MM4DAAEAAADugAJ9cQEoVQdleHBpcmVzcQJOVQN1dGNxA4hVBGFyZ3NxBF1xBVgDAAAAMjYxcQZhVQVjaG9yZHEHTlUJY2FsbGJhY2tzcQhOVQhlcnJiYWNrc3EJTlUHdGFza3NldHEKTlUCaWRxC1UkOTJiZGYxYTItYjM4Ni00NDE3LWIzNTEtMzRlZDYyMDk2ODI3cQxVB3JldHJpZXNxDUsAVQR0YXNrcQ5VH0NvZ25pdG9Db3JlLnRhc2tzLmV4ZWN1dGVQb2xpY3lxD1UJdGltZWxpbWl0cRBOToZVA2V0YXERTlUGa3dhcmdzcRJ9cRN1Ls4="} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":160,"source":"amqp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":22,"flow_first_seen":1490904166119,"flow_last_seen":1490904170242,"flow_tot_l4_data_len":4278,"flow_min_l4_data_len":32,"flow_max_l4_data_len":480,"flow_avg_l4_data_len":194,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.1.1","dst_ip":"127.0.0.1","src_port":5672,"dst_port":44204,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":160,"source":"amqp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":108,"flow_first_seen":1490904166118,"flow_last_seen":1490904170243,"flow_tot_l4_data_len":10751,"flow_min_l4_data_len":32,"flow_max_l4_data_len":361,"flow_avg_l4_data_len":99,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.1.1","src_port":44205,"dst_port":5672,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":160,"source":"amqp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":1490904169152,"flow_last_seen":1490904170195,"flow_tot_l4_data_len":3045,"flow_min_l4_data_len":32,"flow_max_l4_data_len":278,"flow_avg_l4_data_len":101,"midstream":1,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.1.1","src_port":44206,"dst_port":5672,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":160,"source":"amqp.pcap","alias":"nDPId-test"} diff --git a/test/results/android.pcap.out b/test/results/android.pcap.out index 6e1de9330..d62720b47 100644 --- a/test/results/android.pcap.out +++ b/test/results/android.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"android.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"android.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1582454769772,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"95.101.24.53","dst_ip":"192.168.2.17","src_port":443,"dst_port":50677,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"android.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454769,"pkt_ts_usec":772338,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"xGGLNYKpxiwDYGpkCABFAABMMy4AADUGGCtfZRg1wKgCEQG7xfVNnd4qbhnKg4AYAUXNDgAAAQEICmx+XigR4ZkoFwMDABMwxZA0Xbk6ucnG2OFNZYAG8R1y"} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"android.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1582454779631,"flow_last_seen":0,"flow_tot_l4_data_len":78,"flow_min_l4_data_len":78,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":78,"midstream":1,"l3_proto":"ip4","src_ip":"17.248.176.75","dst_ip":"192.168.2.17","src_port":443,"dst_port":50584,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -582,3 +583,60 @@ 00428{"flow_id":65,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"android.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454872,"pkt_ts_usec":38562,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TGr2n\/YnxiwDYGpkCABFAAA0OQUAAHYGhiOs2RYKwKgCEAG7rVbtvX7\/RY++1IAQAPAEwQAAAQEICrtH2Eb\/\/zev"} 02354{"flow_id":65,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454872,"pkt_ts_usec":47699,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"TGr2n\/YnxiwDYGpkCABFAAW+OQkAAHYGgJWs2RYKwKgCEAG7rVbtvX7\/RY++1IAQAPCMDgAAAQEICrtH2E7\/\/zevFgMDAHoCAAB2AwNCJ34CryLHwzvLQqJBIHrJFiNfsNaHdx1eR2uFmuClXyDedzf23GKLBGTQ\/F9lciqAnLFBg\/D1SaN73F0X8icbJxMBAAAuADMAJAAdACA2FiHMnasy913b\/QD8AjPxTZ158qLmXw3NSQ7+ASWrVgArAAIDBBQDAwABARcDAwtu16sEy92A95bKUEGLd6uicpFA4WHC4rLKfybgTNPAHyTLADrBTV5c4IIKEv9IFoc45M5PX8btWzY16aZOqr9LM9ELJYVm6X\/NDfYrhCBqLqj+riWcgSYwZ+a87+Wr7KJQYcBHr4lklP0JRGYmN9FY9Pz1zQQ48sT8KqOzvJ0cF\/JAIQKnwBHpMtHLaGUZ\/AtLTbEJ5MapLWvURb0h8ktlzQDAAyyVMGLxmlXKQbvRDTTGaOi5CRQCHs223cbhUa6u3log5zT0zUjjoRy17qxg5nrTzk3dUp40Fll8xM93DcVwPK7GwHM6j31lYumoMyhNNaSRd02qeAT6ELm7oNMScDTXUKa4IWeknB7YHVw0180XOo0+QRXMM9dqyeFI+4R21gSfJTJkx12AZNz7mQWhjq2j0qf3ka7sfKgu\/xYaYpYDINRThFNUN9qiNJ1Ok9kM7fotvxM7lnYPyduOq\/hH6njzgQAB1QAhgQBB\/Ywwymwk+K6ZgwkLcMdwV539FoVA9ZOdTPUZMiocSX2GFwF6Axz0ps+indbPd+e2VPfiNUqVEsdKalxJFe8oRsZHRlEQLVuC0w0ct0llQUXNoGtPNlZu5G3ZOOuyL0BB2h11I9fqm6LBkawbvW4+H\/78D+wJaqpbcA\/dQOnvblJ0fKDvN7l4RdRc\/+WUMZ1u\/B+czJbEfBrJq6OEklXn4SucgKv0r5\/8H3FCl2KQpcD6Hl6+7HBtGnr7cg9hk+x3mYa7eEmfBbmfzfihXHo++5dBPlVxTelhf1Ruizafsx2KiX52aCIQl\/c2JpK5kMJQSUv+kJKjQZAWVNk4Apg6V2Fv1FbBiDeaCCE6KOOh\/KehPJiM3lyEjZwAcY27OPZci8SOwVE5AH690QfqfV3D8SMcaIF2+8KSbTkUYTdFkrh\/N\/xI6iwNmWh1byxsv\/Hyc+yg69SOfJLNFnUanfcKem2HvTVukyYwaS8KgrHeeRF\/LVCY6K\/a0lnlR3cnuTZ\/bWCM5acFjYKYifWzzCCL8I3h0s472Efm9fUpYKUS13qSY36A+Qh6WLVsWyRDEcK9OAwLaj2aoQBMnGCknMZi5RtpIkPjWFYwBXc6f5Je3qRDSUhoGDwPgPudXuhgPwkqRtUedZ+cEsWxMRqSqmfSozG49RD7RJiX6P6n6N0WPDvH3XoXfmw9rQWLF0c0258EW0J68VUd48Mdh6\/rUomSl0OuwG6CtVc5llkzDAxm9w8yNAOt6EPYcyEpoq3nKfHxKt1w7PT2zByMG4ncV0956WhbAaWzEdxj5dxiH5LPT7E5OLyTQ8j\/RoTUi6z25S8qcGk0zEPA9GJ\/bVs9m8Uevoy1Mer667E1lotvxykUA5kife5GyuIZTUEcccJ4vcVoiCMwsDDIwobvPLzwqhKXcJIXKiKOFZslMNVEMiaJA7ge1eHItrLeXreKGEtL5GRXYRT0mSEe7vP9+IiBYsqmH5pmcEOqzh7eC0FLDfU3kJ7iRE43HMKPcTUnMAXhwXLSmQrqoi1rVwpZosz7ZlqJ7Rx3AHq9Ol4duCWaom7a3xmQ0b9RuXz3L2yhPzGA\/zvuDAQQltbhHtIv+NgZe8cEpXavPK2GyXPCvFnf9Nx3T6lkTwT8nyG1m0OdfUAY79bmd73qiCi1TsOxlGqZWD5F3kCQuQP2PydEUnDT8XKOtxhDg7M230TjFKoHV6Zy\/eZqfc\/tjHk="} 00875{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":6,"flow_first_seen":1582454871947,"flow_last_seen":1582454872047,"flow_tot_l4_data_len":2143,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.22.10","src_port":44374,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.GoogleServices","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"android.googleapis.com","ja3":"629b587f706aee60430ec3879c6edb66","ja3s":"eb1d94daa7e0344597e756a1fb6e7054","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1582454871115,"flow_last_seen":1582454871117,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":40580,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1582454871051,"flow_last_seen":1582454871090,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":32412,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":12,"flow_first_seen":1582454784313,"flow_last_seen":1582454866536,"flow_tot_l4_data_len":3680,"flow_min_l4_data_len":294,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":306,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1582454867034,"flow_last_seen":1582454867075,"flow_tot_l4_data_len":230,"flow_min_l4_data_len":43,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":52953,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1582454867637,"flow_last_seen":1582454867639,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":34540,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1582454870996,"flow_last_seen":1582454870998,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":52,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":36613,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":20,"flow_first_seen":1582454869517,"flow_last_seen":1582454872012,"flow_tot_l4_data_len":6050,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":302,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.168.206","src_port":50384,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":22,"flow_first_seen":1582454868348,"flow_last_seen":1582454870097,"flow_tot_l4_data_len":5736,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.74","src_port":52486,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":4,"flow_first_seen":1582454871741,"flow_last_seen":1582454872015,"flow_tot_l4_data_len":661,"flow_min_l4_data_len":32,"flow_max_l4_data_len":549,"flow_avg_l4_data_len":165,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.74","src_port":52514,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":6,"flow_first_seen":1582454871947,"flow_last_seen":1582454872047,"flow_tot_l4_data_len":2143,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.22.10","src_port":44374,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1582454871804,"flow_last_seen":1582454871805,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":50,"flow_max_l4_data_len":66,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":18379,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1582454868462,"flow_last_seen":1582454868503,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":55,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":47081,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":2,"flow_first_seen":1582454871827,"flow_last_seen":1582454871827,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":32832,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":11,"flow_first_seen":1582454867151,"flow_last_seen":1582454867312,"flow_tot_l4_data_len":1286,"flow_min_l4_data_len":32,"flow_max_l4_data_len":747,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"17.253.53.201","src_port":58338,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1582454866407,"flow_last_seen":1582454866538,"flow_tot_l4_data_len":616,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.16","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1582454869361,"flow_last_seen":1582454869363,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":42,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":39008,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1582454866448,"flow_last_seen":1582454868606,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4e6a:f6ff:fe9f:f627","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1582454868597,"flow_last_seen":1582454868597,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":51430,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1582454871496,"flow_last_seen":1582454871536,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":22850,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":23,"flow_first_seen":1582454867688,"flow_last_seen":1582454868211,"flow_tot_l4_data_len":6249,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32974,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":21,"flow_first_seen":1582454871042,"flow_last_seen":1582454871531,"flow_tot_l4_data_len":7312,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32986,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":15,"flow_first_seen":1582454871069,"flow_last_seen":1582454872035,"flow_tot_l4_data_len":5821,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":388,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32988,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":21,"flow_first_seen":1582454871075,"flow_last_seen":1582454871428,"flow_tot_l4_data_len":7490,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32990,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00443{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1582454865802,"flow_last_seen":1582454866026,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00440{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1582454865794,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ff9f:f627","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":32,"flow_first_seen":1582454871152,"flow_last_seen":1582454871906,"flow_tot_l4_data_len":12687,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":396,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":14,"flow_first_seen":1582454871321,"flow_last_seen":1582454871375,"flow_tot_l4_data_len":3978,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":32998,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":30,"flow_first_seen":1582454871623,"flow_last_seen":1582454871978,"flow_tot_l4_data_len":7356,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":245,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":33002,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":18,"flow_first_seen":1582454871839,"flow_last_seen":1582454872035,"flow_tot_l4_data_len":4973,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":33014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":1582454871823,"flow_last_seen":1582454871824,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":10677,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1582454871676,"flow_last_seen":1582454871677,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":33240,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":13,"flow_first_seen":1582454871094,"flow_last_seen":1582454871395,"flow_tot_l4_data_len":1942,"flow_min_l4_data_len":32,"flow_max_l4_data_len":490,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"173.194.79.114","src_port":36834,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":7,"flow_first_seen":1582454871745,"flow_last_seen":1582454871859,"flow_tot_l4_data_len":995,"flow_min_l4_data_len":32,"flow_max_l4_data_len":490,"flow_avg_l4_data_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"173.194.79.114","src_port":36848,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_first_seen":1582454871772,"flow_last_seen":1582454871808,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"173.194.79.114","src_port":36850,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Google","breed":"Unrated","category":"Web"},"http": {}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_first_seen":1582454871772,"flow_last_seen":1582454871808,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"173.194.79.114","src_port":36850,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":16,"flow_first_seen":1582454868511,"flow_last_seen":1582454870126,"flow_tot_l4_data_len":5393,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":337,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.18.3","src_port":36888,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":16,"flow_first_seen":1582454868527,"flow_last_seen":1582454869366,"flow_tot_l4_data_len":5369,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":335,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.18.3","src_port":36890,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1582454867323,"flow_last_seen":1582454867358,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.35.8","src_port":45863,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":2,"flow_first_seen":1582454871881,"flow_last_seen":1582454871920,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":39760,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":2,"flow_first_seen":1582454871343,"flow_last_seen":1582454871383,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":60,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":35689,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1582454867244,"flow_last_seen":1582454867284,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":42,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":35825,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_first_seen":1582454872021,"flow_last_seen":1582454872022,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":56312,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1582454869626,"flow_last_seen":1582454870649,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":49510,"dst_port":5228,"l4_proto":"tcp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1582454869626,"flow_last_seen":1582454870649,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"216.239.38.120","src_port":49510,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00465{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1582454866803,"flow_last_seen":1582454871058,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4e6a:f6ff:fe9f:f627","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00466{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1582454866803,"flow_last_seen":1582454866894,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4e6a:f6ff:fe9f:f627","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":14,"flow_first_seen":1582454871553,"flow_last_seen":1582454871667,"flow_tot_l4_data_len":3989,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.76","src_port":43634,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":14,"flow_first_seen":1582454871829,"flow_last_seen":1582454872026,"flow_tot_l4_data_len":4037,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":288,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.76","src_port":43646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1582454872031,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.76","src_port":43652,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1582454872031,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.20.76","src_port":43652,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1582454871292,"flow_last_seen":1582454871294,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":46359,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":27,"flow_first_seen":1582454871103,"flow_last_seen":1582454871450,"flow_tot_l4_data_len":6541,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":242,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.21.202","src_port":51928,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":24,"flow_first_seen":1582454871814,"flow_last_seen":1582454872019,"flow_tot_l4_data_len":4060,"flow_min_l4_data_len":32,"flow_max_l4_data_len":626,"flow_avg_l4_data_len":169,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"172.217.21.202","src_port":51944,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1582454871061,"flow_last_seen":1582454871100,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":50,"flow_max_l4_data_len":66,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":7660,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":1582454871600,"flow_last_seen":1582454871601,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":58892,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1582454867723,"flow_last_seen":1582454867761,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.16","dst_ip":"192.168.2.1","src_port":54837,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":500,"source":"android.pcap","alias":"nDPId-test"} diff --git a/test/results/anyconnect-vpn.pcap.out b/test/results/anyconnect-vpn.pcap.out index 0ce2b0ef8..b48b5b596 100644 --- a/test/results/anyconnect-vpn.pcap.out +++ b/test/results/anyconnect-vpn.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569687240992,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"184.25.56.53","src_port":56885,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00430{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687240,"pkt_ts_usec":992580,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"LH6BsEqhNDY7z3UoCABFAAA0AABAAEAGP5MKAADjuBk4Nd41AFDGVya80\/P93YAREABFkgAAAQEIChwNaWayL1Dq"} 00428{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687241,"pkt_ts_usec":9657,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"NDY7z3UoLH6BsEqhCABFAAA0BhtAADcGQni4GTg1CgAA4wBQ3jXT8\/3dxlcmvYARAOurFAAAAQEICrIv+nscDWlm"} @@ -548,3 +549,70 @@ 00476{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2723,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1569687287737,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"224.0.0.1","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} 00434{"flow_id":54,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2914,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687288,"pkt_ts_usec":158305,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"NDY7z3UoLH6BsEqhCABFAAA0aqNAAPMGolQIJWfECgAA4wG73ieGjW4CDCXQ8YARTdYJBAAAAQEICninjVgcDdF\/"} 00433{"flow_id":43,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2981,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569687288,"pkt_ts_usec":697648,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"2DE0IHf7NDY7z3UoCABFAAA0AABAAEAGJUsKAADjCgAAl94iH3wAQcGNmjQa94AREADS0wAAAQEIChwOIOcGksZO"} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":4,"flow_first_seen":1569687268559,"flow_last_seen":1569687271560,"flow_tot_l4_data_len":728,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"239.255.255.250","src_port":57547,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":19,"flow_first_seen":1569687249612,"flow_last_seen":1569687268122,"flow_tot_l4_data_len":4039,"flow_min_l4_data_len":20,"flow_max_l4_data_len":416,"flow_avg_l4_data_len":212,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"184.25.56.77","src_port":56884,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1569687240992,"flow_last_seen":1569687241009,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"184.25.56.53","src_port":56885,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1569687240992,"flow_last_seen":1569687241009,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"184.25.56.53","src_port":56885,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":4,"flow_first_seen":1569687269223,"flow_last_seen":1569687272080,"flow_tot_l4_data_len":1276,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.151","dst_ip":"10.0.0.227","src_port":1900,"dst_port":57547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":10,"flow_first_seen":1569687249612,"flow_last_seen":1569687268086,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":20,"flow_max_l4_data_len":416,"flow_avg_l4_data_len":166,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"184.25.56.77","src_port":56917,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00445{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1569687287737,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"224.0.0.1","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":15,"flow_first_seen":1569687277139,"flow_last_seen":1569687283186,"flow_tot_l4_data_len":1032,"flow_min_l4_data_len":58,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":4,"flow_first_seen":1569687260469,"flow_last_seen":1569687260521,"flow_tot_l4_data_len":198,"flow_min_l4_data_len":32,"flow_max_l4_data_len":70,"flow_avg_l4_data_len":49,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"35.201.124.9","src_port":56910,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":4,"flow_first_seen":1569687260469,"flow_last_seen":1569687260521,"flow_tot_l4_data_len":198,"flow_min_l4_data_len":32,"flow_max_l4_data_len":70,"flow_avg_l4_data_len":49,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"35.201.124.9","src_port":56910,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1569687260751,"flow_last_seen":1569687260767,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":67,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":64972,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1569687251177,"flow_last_seen":1569687251230,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":42,"flow_max_l4_data_len":123,"flow_avg_l4_data_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","src_port":54851,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1569687246891,"flow_last_seen":1569687246924,"flow_tot_l4_data_len":137,"flow_min_l4_data_len":31,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","src_port":63107,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1569687261035,"flow_last_seen":1569687261054,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":59,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":52879,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1569687245251,"flow_last_seen":1569687245288,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","src_port":52879,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":6,"flow_first_seen":1569687267677,"flow_last_seen":1569687268288,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":32,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.10.115.210","src_port":56879,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":6,"flow_first_seen":1569687267677,"flow_last_seen":1569687268288,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":32,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.10.115.210","src_port":56879,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":2441,"flow_first_seen":1569687268746,"flow_last_seen":1569687289262,"flow_tot_l4_data_len":809503,"flow_min_l4_data_len":56,"flow_max_l4_data_len":1477,"flow_avg_l4_data_len":331,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.102.91","src_port":54107,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1569687261486,"flow_last_seen":1569687261506,"flow_tot_l4_data_len":170,"flow_min_l4_data_len":59,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":85,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":57017,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":16,"flow_first_seen":1569687241656,"flow_last_seen":1569687287122,"flow_tot_l4_data_len":1920,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::2e7e:81ff:feb0:4aa1","dst_ip":"ff02::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":4,"flow_first_seen":1569687286917,"flow_last_seen":1569687286919,"flow_tot_l4_data_len":519,"flow_min_l4_data_len":48,"flow_max_l4_data_len":234,"flow_avg_l4_data_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.149","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":9,"flow_first_seen":1569687246981,"flow_last_seen":1569687272376,"flow_tot_l4_data_len":1142,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.213","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1569687261485,"flow_last_seen":1569687261501,"flow_tot_l4_data_len":170,"flow_min_l4_data_len":59,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":85,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":59222,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":2,"flow_first_seen":1569687267799,"flow_last_seen":1569687267819,"flow_tot_l4_data_len":206,"flow_min_l4_data_len":50,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":51060,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":1569687267477,"flow_last_seen":1569687267493,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":37,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":57253,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1569687261034,"flow_last_seen":1569687261050,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":59,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":57261,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":1569687241422,"flow_last_seen":1569687286460,"flow_tot_l4_data_len":3160,"flow_min_l4_data_len":32,"flow_max_l4_data_len":142,"flow_avg_l4_data_len":105,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.149","src_port":56320,"dst_port":8009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1569687245295,"flow_last_seen":1569687245320,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":48,"flow_max_l4_data_len":129,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":61387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":5,"flow_first_seen":1569687267797,"flow_last_seen":1569687267821,"flow_tot_l4_data_len":189,"flow_min_l4_data_len":20,"flow_max_l4_data_len":85,"flow_avg_l4_data_len":37,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"17.57.144.116","src_port":56886,"dst_port":5223,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":57,"flow_first_seen":1569687260591,"flow_last_seen":1569687262892,"flow_tot_l4_data_len":11015,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1400,"flow_avg_l4_data_len":193,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.96.194","src_port":56921,"dst_port":4287,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1569687247596,"flow_last_seen":1569687248620,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1569687260751,"flow_last_seen":1569687260772,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":63,"flow_max_l4_data_len":63,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":61613,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1569687267800,"flow_last_seen":1569687267818,"flow_tot_l4_data_len":347,"flow_min_l4_data_len":58,"flow_max_l4_data_len":289,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":59582,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":6,"flow_first_seen":1569687267841,"flow_last_seen":1569687288158,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.103.196","src_port":56871,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":6,"flow_first_seen":1569687267841,"flow_last_seen":1569687288158,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.103.196","src_port":56871,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":30,"flow_first_seen":1569687245379,"flow_last_seen":1569687245725,"flow_tot_l4_data_len":9034,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":301,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.102.91","src_port":56918,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":54,"flow_first_seen":1569687245688,"flow_last_seen":1569687268830,"flow_tot_l4_data_len":24196,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":448,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.102.91","src_port":56919,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":92,"flow_first_seen":1569687267035,"flow_last_seen":1569687288923,"flow_tot_l4_data_len":24648,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":267,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"8.37.102.91","src_port":56929,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":1569687267988,"flow_last_seen":1569687268026,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"74.125.197.188","src_port":56874,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":1569687267988,"flow_last_seen":1569687268026,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"74.125.197.188","src_port":56874,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":15,"flow_first_seen":1569687245576,"flow_last_seen":1569687267323,"flow_tot_l4_data_len":988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":65,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.37.243.173","src_port":56914,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":15,"flow_first_seen":1569687245576,"flow_last_seen":1569687267323,"flow_tot_l4_data_len":988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":65,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.37.243.173","src_port":56914,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":15,"flow_first_seen":1569687245576,"flow_last_seen":1569687268339,"flow_tot_l4_data_len":988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":65,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.37.243.173","src_port":56915,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":15,"flow_first_seen":1569687245576,"flow_last_seen":1569687268339,"flow_tot_l4_data_len":988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":65,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"52.37.243.173","src_port":56915,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":3,"flow_first_seen":1569687267453,"flow_last_seen":1569687267455,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.149","src_port":56865,"dst_port":8008,"l4_proto":"tcp","ndpi": {"proto":"CiscoVPN","breed":"Acceptable","category":"VPN"}} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":3,"flow_first_seen":1569687267453,"flow_last_seen":1569687267455,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.149","src_port":56865,"dst_port":8008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_first_seen":1569687241064,"flow_last_seen":1569687246096,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.151","src_port":56916,"dst_port":8009,"l4_proto":"tcp","ndpi": {"proto":"AJP","breed":"Acceptable","category":"Web"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_first_seen":1569687241064,"flow_last_seen":1569687246096,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.151","src_port":56916,"dst_port":8009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":9,"flow_first_seen":1569687267453,"flow_last_seen":1569687288697,"flow_tot_l4_data_len":288,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.151","src_port":56866,"dst_port":8060,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":9,"flow_first_seen":1569687267453,"flow_last_seen":1569687288697,"flow_tot_l4_data_len":288,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.151","src_port":56866,"dst_port":8060,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":7,"flow_first_seen":1569687269561,"flow_last_seen":1569687269570,"flow_tot_l4_data_len":1690,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1227,"flow_avg_l4_data_len":241,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.149","src_port":56954,"dst_port":8008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":9,"flow_first_seen":1569687246982,"flow_last_seen":1569687272377,"flow_tot_l4_data_len":1142,"flow_min_l4_data_len":98,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":126,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::408:3e45:3abc:1552","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1569687267831,"flow_last_seen":1569687267847,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":35,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":49781,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":11,"flow_first_seen":1569687269562,"flow_last_seen":1569687273580,"flow_tot_l4_data_len":1944,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1172,"flow_avg_l4_data_len":176,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.151","src_port":56955,"dst_port":8060,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":10,"flow_first_seen":1569687269094,"flow_last_seen":1569687286632,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.1","src_port":52595,"dst_port":192,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":10,"flow_first_seen":1569687269094,"flow_last_seen":1569687286632,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"10.0.0.1","src_port":52595,"dst_port":192,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_first_seen":1569687267805,"flow_last_seen":1569687267824,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":51,"flow_max_l4_data_len":158,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":64193,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":2,"flow_first_seen":1569687267851,"flow_last_seen":1569687267865,"flow_tot_l4_data_len":237,"flow_min_l4_data_len":41,"flow_max_l4_data_len":196,"flow_avg_l4_data_len":118,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":58074,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":27,"flow_first_seen":1569687256018,"flow_last_seen":1569687267492,"flow_tot_l4_data_len":3907,"flow_min_l4_data_len":32,"flow_max_l4_data_len":819,"flow_avg_l4_data_len":144,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"99.86.34.156","src_port":56920,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":12,"flow_first_seen":1569687262866,"flow_last_seen":1569687262912,"flow_tot_l4_data_len":750,"flow_min_l4_data_len":32,"flow_max_l4_data_len":258,"flow_avg_l4_data_len":62,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"162.222.43.153","src_port":56881,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":12,"flow_first_seen":1569687262866,"flow_last_seen":1569687262912,"flow_tot_l4_data_len":750,"flow_min_l4_data_len":32,"flow_max_l4_data_len":258,"flow_avg_l4_data_len":62,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"162.222.43.153","src_port":56881,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":1569687267812,"flow_last_seen":1569687267847,"flow_tot_l4_data_len":98,"flow_min_l4_data_len":41,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":51990,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1569687255989,"flow_last_seen":1569687256018,"flow_tot_l4_data_len":86,"flow_min_l4_data_len":35,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","src_port":58155,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1569687245321,"flow_last_seen":1569687245366,"flow_tot_l4_data_len":177,"flow_min_l4_data_len":48,"flow_max_l4_data_len":129,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.76.76","src_port":62322,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1569687267799,"flow_last_seen":1569687267814,"flow_tot_l4_data_len":229,"flow_min_l4_data_len":39,"flow_max_l4_data_len":190,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":60341,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1569687267481,"flow_last_seen":1569687267500,"flow_tot_l4_data_len":258,"flow_min_l4_data_len":50,"flow_max_l4_data_len":208,"flow_avg_l4_data_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.227","dst_ip":"75.75.75.75","src_port":62427,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3001,"source":"anyconnect-vpn.pcap","alias":"nDPId-test"} diff --git a/test/results/anydesk-2.pcap.out b/test/results/anydesk-2.pcap.out index 753ac41d4..995bebe2a 100644 --- a/test/results/anydesk-2.pcap.out +++ b/test/results/anydesk-2.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"anydesk-2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"anydesk-2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1613977585247,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.187","dst_ip":"192.168.1.1","src_port":59511,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"anydesk-2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1613977585,"pkt_ts_usec":247036,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"EBMx8Tl22MuK4S0uCABFAABM5C0AAIARAADAqAG7wKgBAeh3ADUAOIRW7CIBAAABAAAAAAAADnJlbGF5LTMxODVhODQ3A25ldAdhbnlkZXNrA2NvbQAAAQAB"} 00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"anydesk-2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1613977585247,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.187","dst_ip":"192.168.1.1","src_port":59511,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.AnyDesk","breed":"Acceptable","category":"RemoteAccess"},"dns": {"query":"relay-3185a847.net.anydesk.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -921,3 +922,7 @@ 00178{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":2511,"source":"anydesk-2.pcap","alias":"nDPId-test","l4_data_len":1581} 03252{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2513,"source":"anydesk-2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1613977618,"pkt_ts_usec":195735,"pkt_caplen":2180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":2180,"pkt_l4_len":0,"pkt":"KDc3AG3I2MuK4S0uCABFAAAAiTlAAIAGAADAqAG7wKgBstOUG56PNqDiWcRUSlAYIBKExAAAFwMDCElZ4hNO+msXh2bUnODOizPQiAddzId5s0L6Tw4B2tyJ0YG6Lk9xeCjCkk5iyV\/TcZ+MkCeyOMxeyKngR\/0L81CbJvcp2HY5+PJ99RjORMM0hFqL0M9FsClysAMVqzfPzL0uTI+AMuQYjmp2qqS3n0jD5Mc\/OI6AQf5alcy5blcc+SRlMpLpNTjaoZqhbqyN2OjZAQ0RCghY1jgDpcpPpjzXwFfM+eUtNLtomqzUozUMvSGBCPubR8ysHpKf08rz9nQsYe\/eQy1W+fGZ3UevRU4e0ziP\/Z4ImlVCjTNEZ4Q1m5e1dfxc\/2iPO\/xRUkfR9tTq5C7ck1L6BG5Sbs7srBImqkQCfZO0borStlxpNfdnOV3FAeKPjPu+OB0GQFdSoxU3ShgSCS+s3yhVPiImHbrFfcRtfPcymodIF1QSeUI\/b4QvFBs1xUsetwKnOpQQqQSJnJmm5p8kAXEr+E17QnDNbQ7YpszC1yHmy8ntEIl3A784f8yXufRNOYJFir+O43BaD0qfe\/E8ybQFEb\/wMzNxH0PbiaGM6fZuRxuetCSAU5wDWUE+emEiVkHNdRsVQGRAbJoutoRZnkFzwA6CyosjbLdzxuScaUYQtz\/x4oANzVRMAMzmVJ4c5nalbJW8JxLGB5MZQ9JCVYtUqHLLUdCfyU4E4HlGdK5rNarSj3ruUr+\/5kCGel2xiNIDS+c9xxjT8sS4zj8gfHVq5EP7LPuFyWrTkRmqr600UXyM+yqOFXwyU43fpvj4RXm\/bDgFfkcz2MeJFCky7zPaaOAskDznNnLRmqzyBHEcnqVNwNVWmZnSPzmAPX1eSxSk78DEv\/4pC1Zw33pmGNtPqwzbm4adGRSJMpXA1ESn83MO5nw2tlad\/f6XtHIDIIFcAd2ybubKHggF1GlVj0fZ3rkpkpXpbeP4HjVWCmpZlmt5hrqOnYKCXIoA9d5Q9eU9x0bDgEw8UsAs8Z2cGt7PGrb+Qv7bmsIIrtbYJoehXXLytxGqTyGFHgdtZ1iR39hZ3t83j6Mygm3lc680av6XxYpuCod\/9ENBc+yDd51\/4a1SVvyKfKpS1J1NPGkdCHXxqze5lGusMv4rpLextd++aXgXm4pp8tC9u7v0Y3ESoZOdsgdZjwRtBAwxPUuMR+bTiGlzmFAWnBxEgtA8qwqoeJ8fN2BBhxRSoyiJIjvIbrD\/ViWh8M6a5vCi9FaH2BHmTSkUujKoS4Ui05Uf0s+HwGa2T\/ncn+QF0sBjLTpC3akoGTkw2dqmGtGGg9JL9sxQrC3Z8P2+K0kklga\/87NYKb1gwl8HI5zrx04BnBtRZsYBSRVsc1GywvAc13NndpSo5neCnmnBd\/1I9+HIxUef4wi7p4C66Y0I2booJeN+ZoBGc\/1Y4vtaXbEsPJKJMDqB+BLCw0nSvSbDYYxB91phOhOel5GanFtMg+9nyM\/3XGQvKxO8noAo3CMoOyP7NgQIfjHvFH8Bz6xZMI7QqDGNnOF1uX5CACJ7YsOw8FPJLyQlYtZFFGiMTTrapto3gMpziUDCXvss50gfevS3poRlxl+s6OS85vpXalhuTHFjf8vGxSXfWFquDf1RFg9CUy8zk9PSl1vxgrx0OTqElj9oGT3+Vx3qZgn2bqf+592wbJFWx25hJrBNvBVEbn+OJNrZuuEh1HCoz98Rw4ULrJKM3qfOdDRZ2usK\/f4PyleqeEhwP7aUVZX0wKYFXL2UxfGiK7yY36SpPBq3Ln32t6dvMpaObtqNj+Kfr4ImRxmqQhe0B5zTHV67SrOYPC5E+e3BuEgNN6g9Xu7lBtLjFEUVfT\/s+OSTv0ASorfZmSXHEGDDlch1PtzQNW9Rg1xFAIoMDwxtBj3jiKEIJKWJ2FNgC2FjB+FshqIdc1deJTLE2ymgSABs\/nFAcJERH5Eh8SDc80l1fUqtgee0KKG7+UiEYG9HBLhxrjLYpW6nqwKOnP5iS5J75eSdcaJPQ2RCDoI48f54M\/u0C5mjF4KxZWfbF6W+LA7ItzNMe\/dXWOBsTFS8qH5T20g\/3IZenJtIlcn5ix8kqRSNhmkt78WK6PYEC8Frnz87GbQ2+TF1AIO24YEByT38EkpPfVZBJEKa7vsROTk\/wrD31hqsKtZVqrDC7NcjVOE7GiftEXF+1sA8Yo1W\/gcl71x2tP6c6oxG0OS7vSR61oZ9c4wtxmZsalZYl9wvy0wjtzOgCqQPbk69W7bNvn1ZXADwPJ8YWuzH9z1aPWM2csOqghu72ChTMW2zQtB\/qGY49wPVNjYcmbEB+443LWlsFCjcunDLVmzxVAIJIet9kbYse0PhUurR66Ele1UdzzsBsHU08\/5dPnbKk+8hDJCPyIztDNktODA9+bPmDu8JJ2UixUjK4TEzkxYFIQMx0hR4gryqlUJRl1sbbMr7VctjZdbpqLiiFuSagY+pSdIQ8GPFcdtrfWsXnDYoiBXJ\/5j+UKyYU4B2pUY38w+mhHW38VyltT030eEtueb0ipynzmIgzRdJZ\/W7TPMibiy2oykdpbb6SZ1ujx16jzA3iU7pPElUkIOkKOSxtREPgbzIlknPYKGoBQHdq0GpxSL0i9d7GU7NtI2fcQYpwP4X\/sj3JNdosmuOXAeEPYsSMWQmH+qrj6FSm9gE+WhZfWc2hGNRD7Y6OGdYaU0Q60pRVRul0FACZqyMrb5y97MpVuuqRxKzn2r7P+Z+KtgKO7S7rNMVQmOq0tVktiH\/Ws836Z6\/328nnzLauw2NXRu0qwbtytvVv0f2sBuTbqbURJET4ciDSSyF7wux7TlhQsY\/qPPlXKBUkVGHetfK0nSty5hsQc12nShr9kuLAog="} 00178{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":2513,"source":"anydesk-2.pcap","alias":"nDPId-test","l4_data_len":2146} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2521,"source":"anydesk-2.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":15,"flow_first_seen":1613977595407,"flow_last_seen":1613977595964,"flow_tot_l4_data_len":3652,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1306,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.187","src_port":52039,"dst_port":7070,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2521,"source":"anydesk-2.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1613977585542,"flow_last_seen":1613977585553,"flow_tot_l4_data_len":128,"flow_min_l4_data_len":56,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.187","dst_ip":"192.168.1.1","src_port":55376,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2521,"source":"anydesk-2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1613977585247,"flow_last_seen":1613977585260,"flow_tot_l4_data_len":128,"flow_min_l4_data_len":56,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.187","dst_ip":"192.168.1.1","src_port":59511,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2521,"source":"anydesk-2.pcap","alias":"nDPId-test"} diff --git a/test/results/anydesk.pcap.out b/test/results/anydesk.pcap.out index 063e03ef7..a12065665 100644 --- a/test/results/anydesk.pcap.out +++ b/test/results/anydesk.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"anydesk.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591342198821,"flow_last_seen":0,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":71,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":71,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.239.144","src_port":36351,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00479{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342198,"pkt_ts_usec":821353,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AFBW5dKtAAwplUdeCABFAABbtopAAEAGCwXAqJWBM1PvkI3\/AFB7i54qMVwSUlAY+DR5WwAAFwMDAC7mz9mv7V5op8uDzrVlyYzGPOa22i4SIRv\/ctzVUMWyqJzhwIdSdK\/Qd7DJrcKc"} 00414{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342198,"pkt_ts_usec":821804,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAwplUdeAFBW5dKtCABFAAAoe1AAAIAGRnIzU++QwKiVgQBQjf8xXBJSe4ueXVAQ+vBP7wAAAAAAAAAA"} @@ -33,3 +34,7 @@ 00483{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3394,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342229,"pkt_ts_usec":256699,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"AFBW5dKtAAwplUdeCABFAABbtpBAAEAGCv\/AqJWBM1PvkI3\/AFB7i57AMVwTU1AY+DR5WwAAFwMDAC7mz9mv7V5oqiGs9UmHGy59yVVeeA5lJVIYioWWJ6DRPZ7\/AKPnOzRdEdmukW2o"} 00418{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3395,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342229,"pkt_ts_usec":256927,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAwplUdeAFBW5dKtCABFAAAogvwAAIAGPsYzU++QwKiVgQBQjf8xXBNTe4ue81AQ+vBOWAAAAAAAAAAA"} 00481{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3423,"source":"anydesk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591342229,"pkt_ts_usec":454086,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"AAwplUdeAFBW5dKtCABFAABZgw0AAIAGPoQzU++QwKiVgQBQjf8xXBNTe4ue81AY+vB\/XQAAFwMDACwkrUQuni1bFlXQfhlbpM1ompEjuxnWze1GuQIrlqNjGlJEE1Ae4+mTb0GZcg=="} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1591342198821,"flow_last_seen":1591342244652,"flow_tot_l4_data_len":1007,"flow_min_l4_data_len":20,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":50,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.239.144","src_port":36351,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.AnyDesk","breed":"Acceptable","category":"RemoteAccess"},"http": {}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1591342198821,"flow_last_seen":1591342244652,"flow_tot_l4_data_len":1007,"flow_min_l4_data_len":20,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":50,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.239.144","src_port":36351,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6943,"flow_first_seen":1591342199201,"flow_last_seen":1591342255171,"flow_tot_l4_data_len":2556299,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.149.129","dst_ip":"51.83.238.219","src_port":43535,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6963,"source":"anydesk.pcap","alias":"nDPId-test"} diff --git a/test/results/bad-dns-traffic.pcap.out b/test/results/bad-dns-traffic.pcap.out index cdd1cd4a2..6fb011978 100644 --- a/test/results/bad-dns-traffic.pcap.out +++ b/test/results/bad-dns-traffic.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1486012623234,"flow_last_seen":0,"flow_tot_l4_data_len":99,"flow_min_l4_data_len":99,"flow_max_l4_data_len":99,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.91","dst_ip":"4.2.2.4","src_port":35966,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00526{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486012623,"pkt_ts_usec":234684,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"AhoR+f4q5LMYS\/DDCABFAAB3821AAEARVP\/AqCtbBAICBIx+ADUAYyoIa68BAAABAAAAAAAAODA1ZTEwMGE2MjFjMzYyMDAwMTYzNmY2ZTczNmY2YzY1MjAyODczNjk3Mjc2Njk2ZDY1NzMyOTAwDHNrdWxsc2VjbGFicwNvcmcAAA8AAQ=="} 00744{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1486012623234,"flow_last_seen":0,"flow_tot_l4_data_len":99,"flow_min_l4_data_len":99,"flow_max_l4_data_len":99,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.91","dst_ip":"4.2.2.4","src_port":35966,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"16":"Suspicious DGA domain name"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"05e100a621c3620001636f6e736f6c65202873697276696d65732900.skullseclabs.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":15,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -64,3 +65,6 @@ 00516{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":380,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486012732,"pkt_ts_usec":620037,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"pkt":"5LMYS\/DDAhoR+f4qCABFAABwAABAADMRVXQEAgIEwKgrWwA1t3EAXPaPLhSBgAABAAEAAAAAEjMzN2EwMWU2ZGE4M2JmNmVhMgxza3VsbHNlY2xhYnMDb3JnAAAQAAHADAAQAAEAAAA8ABMSMjEzZTAxZTZkYTZlYTI4M2Jm"} 00474{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486012733,"pkt_ts_usec":574897,"pkt_caplen":95,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":95,"pkt_l4_len":61,"pkt":"AhoR+f4q5LMYS\/DDCABFAABRMElAAEARGErAqCtbBAICBLdxADUAPeYHvL4BAAABAAAAAAAAEjU0NWIwMWU2ZGE4M2JmNmVhMgxza3VsbHNlY2xhYnMDb3JnAAAPAAE="} 00524{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486012733,"pkt_ts_usec":669835,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"5LMYS\/DDAhoR+f4qCABFAAB0AABAADMRVXAEAgIEwKgrWwA1t3EAYDm3vL6BgAABAAEAAAAAEjU0NWIwMWU2ZGE4M2JmNmVhMgxza3VsbHNlY2xhYnMDb3JnAAAPAAHADAAPAAEAAAA8ABcAChJhOGRkMDFlNmRhNmVhMjgzYmbAHw=="} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":382,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":14,"flow_first_seen":1486012730177,"flow_last_seen":1486012733669,"flow_tot_l4_data_len":1607,"flow_min_l4_data_len":61,"flow_max_l4_data_len":289,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.91","dst_ip":"4.2.2.4","src_port":46961,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":382,"source":"bad-dns-traffic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":19,"flow_first_seen":1486012623234,"flow_last_seen":1486012630741,"flow_tot_l4_data_len":1772,"flow_min_l4_data_len":61,"flow_max_l4_data_len":195,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.91","dst_ip":"4.2.2.4","src_port":35966,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":382,"source":"bad-dns-traffic.pcap","alias":"nDPId-test"} diff --git a/test/results/badpackets.pcap.out b/test/results/badpackets.pcap.out index 255c25318..b6e82aa98 100644 --- a/test/results/badpackets.pcap.out +++ b/test/results/badpackets.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"badpackets.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00667{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"badpackets.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495451029,"pkt_ts_usec":466717,"pkt_caplen":271,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":271,"pkt_l4_len":0,"pkt":"xDRrta3IeLr5aHlnCABFAAXcP1QgAOcRe9CDTlH+zLpQ5QA1zGcGtUqtAWiFkwABAAAADAABC3BobDFzcHJ0MTA4AmFkA2RsYQNtaWwAAAEAAcAbAAYAAQAAAh0ALQhlYWdsZWliMcAYC3JhbmR5LnNtaXRowBt3sikrAAAqMAAABDgACTqAAAADhMAbAC4AAQAAAh0AmwAGCAIAAAOEWS\/o5lkiq9Y2JANkbGEDbWlsAEPjY6zabVfm9vwk6mSh9m4kj9u7ZDlkxqtiglIZTh\/RONTC0jpNpQmC+rJg1+X5ptcybqG6dncq1KPvSJq3fG1w8VDIG7zJf7f6G9gikY9VMCGmBxLlsKtyxHORaw=="} 00175{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":1,"source":"badpackets.pcap","alias":"nDPId-test","l4_data_len":237} 00711{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"badpackets.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495451030,"pkt_ts_usec":401327,"pkt_caplen":305,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":305,"pkt_l4_len":0,"pkt":"xDRrta3IeLr5aHlnCABFAAXc9nogAOcRxKmDTlH+zLpQ5QA1PsIG13F6XwyFkwABAAAADAABC3BobDFzcHJ0MTA4BGRhYXMDZGxhA21pbAAAAQABwBgABgABAAAAbgAwCGVhZ2xlaWIxAmFkwB0LcmFuZHkuc21pdGjAHQExm5UAAAC0AAAAEgAJOoAAAAOEwBgALgABAAAAbgCgAAYIAwAAALRZLyttWSHuXTGGBGRhYXMDZGxhA21pbABfZgMcUaz74\/opjmPI6fIN7S4Ga9GN4s2JVqvb0uXXvbdLi9ee5JaFRYVlFB0RVerGRt3pX5esuSlY9ySHVHjOBX09ZI1nwdlSMxmFBY9ZemmmfYIR43tvzwqFnbufNVeL7\/vc0q83XBfNipWbDRE5bz+qVR8="} @@ -198,3 +199,4 @@ 00176{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":92,"source":"badpackets.pcap","alias":"nDPId-test","l4_data_len":452} 00672{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":93,"source":"badpackets.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495451915,"pkt_ts_usec":752227,"pkt_caplen":274,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":274,"pkt_l4_len":0,"pkt":"xDRrta3IeLr5aHlnCABFAAXcZssgAOcRVFmDTlH+zLpQ5QA1TRMGuBtHRUGFkwABAAAADAABCkhRMDFXRUYwMDEDRElSAkFEA0RMQQNNSUwAAAEAAcAeAAYAAQAAA2gALQhlYWdsZWliMcAbC3JhbmR5LnNtaXRowB53sikrAAAqMAAABDgACTqAAAADhMAeAC4AAQAAA2gAmwAGCAIAAAOEWS\/o5lkiq9Y2JANkbGEDbWlsAEPjY6zabVfm9vwk6mSh9m4kj9u7ZDlkxqtiglIZTh\/RONTC0jpNpQmC+rJg1+X5ptcybqG6dncq1KPvSJq3fG1w8VDIG7zJf7f6G9gikY9VMCGmBxLlsKtyxHORaw=="} 00176{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":93,"source":"badpackets.pcap","alias":"nDPId-test","l4_data_len":240} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":93,"source":"badpackets.pcap","alias":"nDPId-test"} diff --git a/test/results/bitcoin.pcap.out b/test/results/bitcoin.pcap.out index 71c489891..bd3a2f549 100644 --- a/test/results/bitcoin.pcap.out +++ b/test/results/bitcoin.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bitcoin.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1301327937725,"flow_last_seen":0,"flow_tot_l4_data_len":137,"flow_min_l4_data_len":137,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":137,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"188.165.213.169","src_port":55317,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00573{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bitcoin.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1301327937,"pkt_ts_usec":725033,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"pkt":"ACPrIpS0ACNshovhCABFAACdb3BAAEAGdmXAqAGOvKXVqdgVII1UFpaF9ORId4AY\/\/\/XwQAAAQEICicy22Mwkrss+b602XZlcnNpb24AAAAAAFUAAAABfQAAAQAAAAAAAABBsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/vKXVqSCNAQAAAAAAAAAAAAAAAAAAAAAA\/\/\/AqAGOII3ZMDrPGxAeDAD6vQEA"} 00570{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"bitcoin.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1301327937,"pkt_ts_usec":800894,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"pkt":"ACNshovhACPrIpS0CABFAACd8zJAADQG\/qK8pdWpwKgBjiCN2BX05Eh3VBaWhYAYAC7fMwAAAQEICjCSu0gnMttj+b602XZlcnNpb24AAAAAAFUAAACcfAAAAQAAAAAAAABqsJBNAAAAAAEAAAAAAAAAAAAAAAAAAAAAAP\/\/JmCEHtgVAQAAAAAAAAAAAAAAAAAAAAAA\/\/+8pdWpII1MLcnArv8XlgAGwwEA"} @@ -98,3 +99,12 @@ 01870{"flow_id":6,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":555,"source":"bitcoin.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1301329452,"pkt_ts_usec":712485,"pkt_caplen":1127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1127,"pkt_l4_len":1093,"pkt":"ACNshovhACPrIpS0CABFAARZDTBAAHQG1Ya4OqV3wKgBjiCN2L80MwsxLLUZT4AYAQHM7QAAAQEICgBWFqsnMxZ++n6+MXdJ4u+twdkAAAAAAAACAAAA4BAp+E5t3fS408bFqpE\/\/hkfWcf\/zfqjsSMAAAAAAAACAAAAIfi7dhvcEdCBSNSxRq5Hm6R9wZrQayfYcl4AAAAAAAACAAAAHMtkV8QTp9IoDHGKNgOG0XWJOUzCLcCG1ooAAAAAAAACAAAAspqp8Za6fkh6Z\/bk8M\/lDCL9JGw9rp2yIgMAAAAAAAACAAAANkOEl+sX7xUI3Nd0J07eBc7racPQUz3PEC4AAAAAAAACAAAAl5K8Hydtr+3R296ltOG1eAvrVsJab5yOV7IAAAAAAAACAAAA6f5FMFep8IMaloV0PabEOSL8qMJK+TrLHVoAAAAAAAACAAAA24myD4vHq\/HO6OzbjFefT\/YSFwl5pZF5qXgAAAAAAAACAAAAd9SYBXQsqh7m1St16FFO6Rg8EW\/SRSMgBE4AAAAAAAACAAAAyeoaNnxM6RcNDykulfymi3EoTRyecsgs4kwAAAAAAAACAAAAMBaoNlda28fwPeD55ImDakJDCofgRs7fGxcAAAAAAAACAAAAQ0zQpFBY+vD7A+MBLFWG2lHwGYE0AT5mZTQAAAAAAAACAAAAayK0b\/8KK0Ik6bTCIrR91I5J\/pqn6PJDA80AAAAAAAACAAAAOps8JKFEM7olbQ82oOr+msKxdCiS8Z9G6G0AAAAAAAACAAAAl4ulFuAOeouIhQvRHKZ51s0k1m9ntFNzkzAAAAAAAAACAAAAKrdbM40QuqIihsksc8BXhg4Eu70MzPZFoPEAAAAAAAACAAAAztQuJbCVvsVMJ2tPBuiN7I0HTV1\/kUqnYrQAAAAAAAACAAAAyW0FjhwgD\/VfNzGDGcXdN9ufgnALxTxNLUAAAAAAAAACAAAAohaiXHMEESUpOqZPu4KD+TAoztB2q6hvLioAAAAAAAACAAAA8Gn\/NdxL4xH\/hgO\/wfKa0bJ1nGjvVn0hWEYAAAAAAAACAAAAPWe2sZ66IMqkxTA\/4bmb62fFY5dtRACLcUkAAAAAAAACAAAARIHwm4wncIDZTlzJWkkMmEK6LcyGkmXREegAAAAAAAACAAAACieUYGaByb97j7\/Bv\/pr1clbrb6QxY+RHY8AAAAAAAACAAAAnIBUFcPI7oNWjreyJ6bdnFB04xA1Q\/hJ1oUAAAAAAAACAAAA\/vBv+voVdlPr8GRHgS6vEp\/UYi3gD3xDbEYAAAAAAAACAAAArecNbP5tNl6fBXg\/l6JeAj56WZCX17wue54AAAAAAAACAAAAXM8eXOjZ2Yo157oy9cd1Og7GkzRim899UrUAAAAAAAACAAAAy6P7Cxfs6k++VTFzmbisuT7u10INTy11WgUAAAAAAAACAAAA2a+CgrTYJEAL3z44pyE+y+tld\/QwzBgjwMYAAAAAAAA="} 00514{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":563,"source":"bitcoin.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1301329459,"pkt_ts_usec":907535,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"ACPrIpS0ACNshovhCABFAABx3JpAAEAGPgTAqAGOuDqld9i\/II0stRlPNDMPVoAY\/\/++0QAAAQEICiczFsgAVhar+b602WludgAAAAAAAAAAACUAAADz4eNcAQEAAAAYg4ufJ32yLdAwF+WR3fXVdidlMCL1gr70pTNlRjPDUw=="} 00510{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":568,"source":"bitcoin.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1301329480,"pkt_ts_usec":211491,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"ACPrIpS0ACNshovhCABFAABrS6VAAEAGzv\/AqAGOuDqld9i\/II0stRmMNDMPVoAY\/\/\/9ZgAAAQEICiczF5MAVhmU+b602WFkZHIAAAAAAAAAAB8AAAADTXMNASC2kE0BAAAAAAAAAAAAAAAAAAAAAAD\/\/206XacgjQ=="} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":172,"flow_first_seen":1301328319392,"flow_last_seen":1301329810648,"flow_tot_l4_data_len":157645,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":916,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":172,"flow_first_seen":1301328319392,"flow_last_seen":1301329810648,"flow_tot_l4_data_len":157645,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":916,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"74.89.181.229","src_port":55348,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":119,"flow_first_seen":1301328699728,"flow_last_seen":1301329807659,"flow_tot_l4_data_len":78705,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":661,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":119,"flow_first_seen":1301328699728,"flow_last_seen":1301329807659,"flow_tot_l4_data_len":78705,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":661,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"195.218.16.178","src_port":55400,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":27,"flow_first_seen":1301329304767,"flow_last_seen":1301329810839,"flow_tot_l4_data_len":3548,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1093,"flow_avg_l4_data_len":131,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":27,"flow_first_seen":1301329304767,"flow_last_seen":1301329810839,"flow_tot_l4_data_len":3548,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1093,"flow_avg_l4_data_len":131,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"184.58.165.119","src_port":55487,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":161,"flow_first_seen":1301328472925,"flow_last_seen":1301329809936,"flow_tot_l4_data_len":110136,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":684,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":161,"flow_first_seen":1301328472925,"flow_last_seen":1301329809936,"flow_tot_l4_data_len":110136,"flow_min_l4_data_len":52,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":684,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.142","dst_ip":"66.68.83.22","src_port":55383,"dst_port":8333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":637,"source":"bitcoin.pcap","alias":"nDPId-test"} diff --git a/test/results/bittorrent.pcap.out b/test/results/bittorrent.pcap.out index 952fbd250..4a0bf886c 100644 --- a/test/results/bittorrent.pcap.out +++ b/test/results/bittorrent.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bittorrent.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1455469967246,"flow_last_seen":0,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":100,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":100,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.58.216.115","src_port":52888,"dst_port":38305,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00523{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bittorrent.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455469967,"pkt_ts_usec":246718,"pkt_caplen":134,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":134,"pkt_l4_len":100,"pkt":"LFbcjDU0xCwDBkn+CABFAAB4eD1AAEAGAADAqAEDUjrYc86YlaHFzANOp3OTAoAY\/\/\/swwAAAQEIChnb8BkAhEMxE0JpdFRvcnJlbnQgcHJvdG9jb2wAAAAAABAABdz83M+55nDMw91Ax4wWHyvqJDEmLVVNMTg2MC1BjhgayboXmHFSZj4="} 00610{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1455469967246,"flow_last_seen":0,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":100,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":100,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.58.216.115","src_port":52888,"dst_port":38305,"l4_proto":"tcp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":"dcfcdccfb9e670ccc3dd40c78c161f2bea243126"}} @@ -158,3 +159,23 @@ 00587{"flow_id":24,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":121,"source":"bittorrent.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455469980,"pkt_ts_usec":390227,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"xCwDBkn+LFbcjDU0CABFAACocqBAAHMGfF5dQflkwKgBA3pozr4vdeJykJf4B4AYAMOuCwAAAQEICgAf9F4Z3CJSE0JpdFRvcnJlbnQgcHJvdG9jb2wAAAAAABAABdz83M+55nDMw91Ax4wWHyvqJDEmLVVUMzQ1MC3wogL0Pl3FbMgdQMAAAAEAFABkMTplaTBlNDppcHY0NDpdQflkNDppcHY2MTY6IAEAAF71ef0Mhifaor4="} 01292{"flow_id":24,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":123,"source":"bittorrent.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455469980,"pkt_ts_usec":488536,"pkt_caplen":614,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":614,"pkt_l4_len":580,"pkt":"xCwDBkn+LFbcjDU0CABFAAJYcqJAAHMGeqxdQflkwKgBA3pozr4vdeLmkJf4B4AZAMO1LAAAAQEICgAf9F8Z3CJSBpsxMjpjb21wbGV0ZV9hZ29pMmUxOm1kMTE6dXBsb2FkX29ubHlpM2UxMTpsdF9kb250aGF2ZWk3ZTEyOnV0X2hvbGVwdW5jaGk0ZTExOnV0X21ldGFkYXRhaTJlNjp1dF9wZXhpMWUxMDp1dF9jb21tZW50aTZlZTEzOm1ldGFkYXRhX3NpemVpMTkwMDllMTpwaTMxMzM2ZTQ6cmVxcWkyNTVlMTp2MTU6zrxUb3JyZW50IDMuNC41Mjp5cGk1MjkyNmU2OnlvdXJpcDQ6UjfNAWUAAAB0Bf\/\/\/\/\/\/\/\/\/\/\/99\/\/\/\/\/\/9\/\/+\/\/\/\/\/\/\/\/7\/\/3\/\/\/\/\/\/\/\/\/\/\/\/3\/\/\/\/\/\/\/\/\/7\/\/\/\/\/\/\/\/\/\/\/\/+\/\/\/\/\/v\/\/\/\/\/9\/\/\/\/\/\/3\/\/\/\/\/\/\/\/\/\/\/36\/\/\/\/\/93\/\/\/\/\/\/\/\/\/\/\/\/\/fv\/\/\/9P\/\/3\/\/\/\/\/f\/\/\/\/\/\/\/\/\/\/\/\/4AAAAAFBAAAAm0AAAAFBAAAApQAAAAFBAAAAI0AAAAFBAAAA0AAAAAFBAAAASAAAAAFBAAAAwgAAAAFBAAAAHoAAAAFBAAAAV0AAAAFBAAAAfQAAAAFBAAAAwsAAAAFBAAAAmsAAAAFBAAAAhwAAAAFBAAAAuYAAAAFBAAAAmQAAAAFBAAAApAAAAAFBAAAAFAAAAAFBAAAAc0AAAAFBAAAAa0AAAAFBAAAAx4AAAAFBAAAANIAAAAFBAAAAu0AAAAFBAAAAwoAAAAFBAAAAEoAAAAFBAAAAME="} 00470{"flow_id":23,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":136,"source":"bittorrent.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455469981,"pkt_ts_usec":133971,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"LFbcjDU0xCwDBkn+CABFAABQyXBAAEAGAADAqAEDU9i48c6\/yNUzq1rNBM6WrIAYL5vOtwAAAQEIChncJYd4G2hMAAAAAwmf\/wAAAAMUAwAAAAABAgAAAAUEAAAAOw=="} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_first_seen":1455469967550,"flow_last_seen":1455469968002,"flow_tot_l4_data_len":1031,"flow_min_l4_data_len":46,"flow_max_l4_data_len":559,"flow_avg_l4_data_len":206,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.57.97.83","src_port":52887,"dst_port":53137,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":5,"flow_first_seen":1455469974533,"flow_last_seen":1455469974889,"flow_tot_l4_data_len":1035,"flow_min_l4_data_len":51,"flow_max_l4_data_len":552,"flow_avg_l4_data_len":207,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.57.97.83","src_port":52906,"dst_port":53137,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1455469969259,"flow_last_seen":1455469973374,"flow_tot_l4_data_len":1286,"flow_min_l4_data_len":39,"flow_max_l4_data_len":614,"flow_avg_l4_data_len":160,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"83.216.184.241","src_port":52895,"dst_port":51413,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":5,"flow_first_seen":1455469980213,"flow_last_seen":1455469981133,"flow_tot_l4_data_len":1208,"flow_min_l4_data_len":60,"flow_max_l4_data_len":616,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"83.216.184.241","src_port":52927,"dst_port":51413,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":5,"flow_first_seen":1455469978422,"flow_last_seen":1455469978679,"flow_tot_l4_data_len":1035,"flow_min_l4_data_len":51,"flow_max_l4_data_len":552,"flow_avg_l4_data_len":207,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"95.237.193.34","src_port":52922,"dst_port":11321,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1455469975240,"flow_last_seen":1455469975394,"flow_tot_l4_data_len":476,"flow_min_l4_data_len":51,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":119,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"151.72.255.163","src_port":52912,"dst_port":59928,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":5,"flow_first_seen":1455469970233,"flow_last_seen":1455469971153,"flow_tot_l4_data_len":1111,"flow_min_l4_data_len":100,"flow_max_l4_data_len":559,"flow_avg_l4_data_len":222,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"151.26.95.30","src_port":52897,"dst_port":22673,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_first_seen":1455469975234,"flow_last_seen":1455469976169,"flow_tot_l4_data_len":1043,"flow_min_l4_data_len":51,"flow_max_l4_data_len":566,"flow_avg_l4_data_len":208,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"151.26.95.30","src_port":52911,"dst_port":22673,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":5,"flow_first_seen":1455469978413,"flow_last_seen":1455469978679,"flow_tot_l4_data_len":1042,"flow_min_l4_data_len":51,"flow_max_l4_data_len":553,"flow_avg_l4_data_len":208,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"95.234.159.16","src_port":52921,"dst_port":41205,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":3,"flow_first_seen":1455469980262,"flow_last_seen":1455469980488,"flow_tot_l4_data_len":828,"flow_min_l4_data_len":100,"flow_max_l4_data_len":580,"flow_avg_l4_data_len":276,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"93.65.249.100","src_port":52926,"dst_port":31336,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1455469980275,"flow_last_seen":0,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":100,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":100,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"93.65.227.100","src_port":52925,"dst_port":19116,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":4,"flow_first_seen":1455469971675,"flow_last_seen":1455469973590,"flow_tot_l4_data_len":478,"flow_min_l4_data_len":46,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":119,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"190.103.195.56","src_port":52902,"dst_port":46633,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":7,"flow_first_seen":1455469976582,"flow_last_seen":1455469980118,"flow_tot_l4_data_len":1312,"flow_min_l4_data_len":41,"flow_max_l4_data_len":616,"flow_avg_l4_data_len":187,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"190.103.195.56","src_port":52914,"dst_port":46633,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":5,"flow_first_seen":1455469969441,"flow_last_seen":1455469969689,"flow_tot_l4_data_len":1010,"flow_min_l4_data_len":46,"flow_max_l4_data_len":586,"flow_avg_l4_data_len":202,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"79.53.228.2","src_port":52896,"dst_port":14627,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1455469977285,"flow_last_seen":1455469977324,"flow_tot_l4_data_len":956,"flow_min_l4_data_len":51,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":239,"midstream":1,"l3_proto":"ip4","src_ip":"151.15.48.189","dst_ip":"192.168.1.3","src_port":47001,"dst_port":52917,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":6,"flow_first_seen":1455469971321,"flow_last_seen":1455469972136,"flow_tot_l4_data_len":1057,"flow_min_l4_data_len":46,"flow_max_l4_data_len":567,"flow_avg_l4_data_len":176,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"198.100.146.9","src_port":52903,"dst_port":60163,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":210,"flow_first_seen":1455469976336,"flow_last_seen":1455469982106,"flow_tot_l4_data_len":277999,"flow_min_l4_data_len":46,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":1323,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"198.100.146.9","src_port":52915,"dst_port":60163,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1455469967246,"flow_last_seen":1455469967465,"flow_tot_l4_data_len":690,"flow_min_l4_data_len":100,"flow_max_l4_data_len":590,"flow_avg_l4_data_len":345,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.58.216.115","src_port":52888,"dst_port":38305,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1455469974358,"flow_last_seen":1455469976244,"flow_tot_l4_data_len":1265,"flow_min_l4_data_len":79,"flow_max_l4_data_len":671,"flow_avg_l4_data_len":316,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.3","dst_ip":"82.58.216.115","src_port":52907,"dst_port":38305,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":299,"source":"bittorrent.pcap","alias":"nDPId-test"} diff --git a/test/results/bittorrent_ip.pcap.out b/test/results/bittorrent_ip.pcap.out index 1b3baa5b7..f5a3e0752 100644 --- a/test/results/bittorrent_ip.pcap.out +++ b/test/results/bittorrent_ip.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bittorrent_ip.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bittorrent_ip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1492508985380,"flow_last_seen":0,"flow_tot_l4_data_len":1480,"flow_min_l4_data_len":1480,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1480,"midstream":1,"l3_proto":"ip4","src_ip":"185.56.20.36","dst_ip":"10.0.0.14","src_port":53646,"dst_port":35030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 02401{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bittorrent_ip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492508985,"pkt_ts_usec":380744,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"GM9eF7izpL8BAjLCCABFKAXcnYlAADUGywC5OBQkCgAADtGOiNaC0hsOOk8HpoAQAQ9pDwAAAQEICnOGuIMAaon5wq2wH+fJAB37WaFc0xGrpC62Mk25YlmPUd6ck3UOPlnlmaLDK5iccRQxV6Lrpsvp\/uuH07fwJI5d7\/2xQsXKRbbf\/dZsog8rfXyOu4oWkiFqn16z1YOEpNojRPpe7v7oH86SIuoL3dpLCw3AXEVUNxwx2S7LDL5\/rfeDM8+Bcl\/\/R8Opw8m+od\/En5GEEzZ3xGrHEqfzxOcCFet4txleRVwSMtJGmJGEZlxnSc9bQojqyP8G3\/vCd1PweWLboTk+NjSajTAv1YG+aTAyluKRr0qFOpDKQmC3IVqzr4W9DmG3o93pWPJfaiwZdc0LXafyZIup0T3O+0SD+1KX\/MXVxLlbkrHIObYhG0KRzwzkIiO\/HR3aqzKcLzpGqVYzgATNkx6loBM2zXf8m\/XhjwgHW\/CGReGZFPmB8J6GzYgFDRMMKktYU5wo0oK4SF13YaHyFNIDAJL3DAyL5r+1U9G1+dr8PIMRJp4\/FwQSe6a94CTR4ZskCkdLrs8tj1RsuwrXTbzvqBJzUsQBm9rJfZm4y9w1pfULJ8D1TYjJjMzSDEl0T6hV8EZ4dmzL6IhYkOgH8tql6Y93Y0ddSoYv324931xWI\/bR1RKV7BANQbXUG2pG0h2KZpa6XgVabRUtP99Tr7\/5gqL\/IS2bD5xlSK1xPITsCAn7s7qmMuBYou\/b61yEnXpRH5c7+HPoOUXeVk4W9oZrQVAXk5BbSMEHW5RfTBUhNP++2i6eHn+vUbuL8UK5lLIATIcvvZI9dlyGFiLHDfDqqIZCrFy3RyOhH2X\/YORdIg7sw\/ndDLMFBseU\/KWeXwePK6mHg0z23nZaHdFSoeEOxwrWY0lgWUBWjSyZYzTSBwlfgqsQztiEM77xdLWOhbIlx8\/nuG0COEMh2y1lyIiYlKLCMQXTS7K\/j1FVuF\/8tvPyElMf3rWajnXt3EqUVmFpQ6LS9QxFLTpgEdeFnf2qL+AmoEuGUjU9kJweI25uL0Z9lzpQhvvCq8wd9I+ftZPKuA6dZ\/k3GrkabkYxGDbzhE5ROw\/DgJVMx8YTocrJYMUrgGEF+p9he2ru4LLtxOeShPq42CbnIGyZfsPr53QY+AEuNN1DHzxtN+wF\/8izHYs9Nm7vOWO5FyqA5I1eXm+bYBqxrutPktuKTr3AfJQHxFyberh\/WGaCmyY1JDhaxqT6lahZjq\/D+h\/+cEW317H+1sg6aF1yFTeoDuELtGhphh\/6RwybG6XySF4DX3+mdR3VpDjIljqG2zlOcw4y9GPTB0vD0AfEp6VvCyFfJDbXcmK3LpFLGEF5msQT5bCRePIl2ts6C5\/K71IHEGDPO2Pna8kfaM4QGJ2FEOm\/xWLLsagIQPw6MSeEcAjjO6xkOeOb7btfefPF4Kqyu4ZO6Dzvgl7z+p4BOxyjwIming13hAtv7syoCsUTcyEZ7qN3Z1aE0wB8ZLg5qK0FPpcYv5DNjm96suA59qoy4XiMdUVp7mB3au2pxK33YcDYQwNH4vEAMRMnaiZbwUYX7PyP2fmGyj4etY6\/bzsgqteorOb3gC0UWBkYEiO9kyElGbVXiYAbr+cNxxY6pf6owquBKfCW+9gNQM1Gf3JOhOZXrurW533Z43nBgLYv3+V+2tLwZ1ozPyKPrSjCuP15ektq6c1rgVAbemep1fdRC8ScYX38M92H9PR2+eGCsHtEDQpBXk5LKK8TFCIvKYqIOASd2UUU5JBJTDxPo8Dwxaolh1aYwuyIWd2Y0ZZS0MaxB03Gs37ZQEebCoytVUbaQ8N4pKz7QcsA+9kfdLFgkcDGaBaeG2k\/9sjsS9pkJk1hIC0qCshMy5uCV2qA5VPCarO85ASgoheRo5nDYkD5BXNn2XlPP\/DEADBYv466aYqeaVlkvH4VxCi5CTumh0poopX16s9g9P5WDW3G3znJwzFtdiZlOelig10="} 00428{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"bittorrent_ip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492508985,"pkt_ts_usec":380750,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"pL8BAjLCGM9eF7izCABFAAA0h3tAAEAG294KAAAOuTgUJIjW0Y46TwemgtIgtoAQCI+fXQAAAQEICgBqiw9zhriD"} @@ -32,3 +33,6 @@ 02399{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"bittorrent_ip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492508991,"pkt_ts_usec":662203,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"GM9eF7izpL8BAjLCCABFIAXcXPRAAFYGvAdN3q4UCgAADgsythIFgCBQyg3zkIAQAQQ3QgAAAQEIChotFWoAapAXYNOsn7lwbwgXErTPWnqHh1cl69dM2t2JJ4jmOcSnHYWJHX3dJ2IbVMw73tm6RhzQ37XmqEPvCmoYGyw69iDhYe+2b9SGubuLVyPTiKywe\/C92yKYICgV3TQzuGAnNC\/RYvE6WsIR+06b6F73RqsePJ7BFhgzUWaPSRSnwtsFtQZXlwaa2z7xMucEQfrw7PBKF6JXxhAcZgBDq9tGmnnt79PSPtGLNwCoGbMr7IlTUHvmiQbEF0BkjOIR9CREqChtHEtror7tBdmyzgsXX7d5B2lnP069nRDIyKxRbrIULeVH7iCXxLYpKQROdB5VUppMlSTgNGBOudBdcGCUtuFz7GbqdaxJCdv3x2GOP0a7t8+cYW1nWSXI3h5O1j3rNIXpzd4IvdndVS5FlQfsTTt0QHE74QtLqR\/O7Ft97z7lEGWS+WEIkSGTwUtrEOrpfUQ35NdK7TUod30ErQjccBRXTnv5Fz2ZBQ7fNLswuq5x8uVHKtSCpVmNt0+dZoZpJpg6L6x80UQEpBZepgbu94HM\/dJ\/hEMASN3wCswf8acbuHuYkWQYkFbuzdM9DnyYfKkxFx10BMEagMOhdYdRFV4PkEHTJQz+\/Fx7q5yngGQE6bRZ\/b3IBWul9igmEYFszK\/5b04G6C7hyE5cUOqtsSsIIR83HaX18R+H7pG8Hr1cEYLzI2oQ4gAxsLpLe\/ohICfLM4tSUNx1kqMgp\/lRs20I0vNSDnLy0omLjYc6SXbtCw7iCv8VTGLmfl+qnKOieBEurv\/36cS17VqM90Svc9MGGlAKh33+BXHiS6f9r2\/esj5e5mSiS1NPpBFUHiOzzyfbZm+oMIhtPCRkolGkSDQwqVRhFTf02\/qFunpdTBFN7c\/BH76diOgZPz+Rue2ziTL5NKv+jalBU7QjPQt2Rxduaz7NfMLZu35DJYutzypJioTmqNrYv4J8mOl6\/FPp2345\/6IGrYSjpGmTAQYDlW0QDu5iLD9TbgSE+svxuhBBd6vr0OwxaoSQqxbOLedBX+j8e2\/O3zd2pe+PuV1KoglCy8DyvSIR8d\/rezcejg9HwBuiSti1u83wn9jHghW96buN0BVyD3FeqcAADooPtJTFw8lcNOsHy6jxEBZCWKwhMLzNsN4yHt4+hRIDfkC5AyA55XsGoJ1Nko4yOewoN+WrXd0AewLO8Du2bSHPeoq2jMtOxc9UESatwsvIjPOR197ghQiUhBJVrNSkpMcjrbhPpEutm2Altzoi8gS7voI5iEg+DtP07gnzuTSC76hE5AsovHX8knu\/e5XxbHehHyc7jZ9GPR1l7xzC\/Y5sOIMV+jNxVIhBuvCEE5JrIIFJIbkEJqYyxE069rUf6UCpadFw5VhkcIjwSDPMwpU6TzNZ0yCdQSByLwH7\/jCujElqw3o1qHEttVlgR6KOEG4DKVm3bhbS6lRjvllQIrcfsDxztiYCDEfVqHa72Hhx0Eds+y\/wQCyQdVz\/FHnq8iYyTf\/GePJz1H4HKfILJqqcHRjtuT2odIv+Nm\/hELYDXaBYO3em2jmCNUvruQomTUZoOdkn24MD9503F9rQtW1BPYGzI9w93UNLkyKgQbq9qk5sALPFYAlQMCagNniGZhDXD35b3Vc2qjebOGhcz\/Hk+cCAaNmdm5KSGQQOqSNZsyhex\/ptVCJl5FVE2GPnyqG8SJRuMLzuL\/LRO+DCGcL3j38PzGcSNZg+qMnrfekvZEhgQfQFT\/BRHDsUExwBRHOZ6pKMLEV0PRJYOCMsV8U9fvq3suA+W++1Uf9beaH9QD7PptNameLfjiupm4iKR80Lt9MJbVdbycEMiMEE89BlhXTY83Y4EG\/l4R4OgIiMo4SXLhlDNY9\/4MM1p2UwOwo4gzZmV520IvMBJmkQE5hkEeSP+hUwb6AKm5XmcfeBbn865ZYi7j+Oz7xF97U="} 00589{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":303,"source":"bittorrent_ip.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1492508991649,"flow_last_seen":1492508992859,"flow_tot_l4_data_len":267352,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1048,"midstream":1,"l3_proto":"ip4","src_ip":"77.222.174.20","dst_ip":"10.0.0.14","src_port":2866,"dst_port":46610,"l4_proto":"tcp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} 00590{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":303,"source":"bittorrent_ip.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":255,"flow_first_seen":1492508991649,"flow_last_seen":1492508992859,"flow_tot_l4_data_len":267352,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1048,"midstream":1,"l3_proto":"ip4","src_ip":"77.222.174.20","dst_ip":"10.0.0.14","src_port":2866,"dst_port":46610,"l4_proto":"tcp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} +00586{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":479,"source":"bittorrent_ip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":48,"flow_first_seen":1492508985380,"flow_last_seen":1492508985594,"flow_tot_l4_data_len":36300,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":756,"midstream":1,"l3_proto":"ip4","src_ip":"185.56.20.36","dst_ip":"10.0.0.14","src_port":53646,"dst_port":35030,"l4_proto":"tcp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":479,"source":"bittorrent_ip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":48,"flow_first_seen":1492508985380,"flow_last_seen":1492508985594,"flow_tot_l4_data_len":36300,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":756,"midstream":1,"l3_proto":"ip4","src_ip":"185.56.20.36","dst_ip":"10.0.0.14","src_port":53646,"dst_port":35030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":479,"source":"bittorrent_ip.pcap","alias":"nDPId-test"} diff --git a/test/results/bittorrent_utp.pcap.out b/test/results/bittorrent_utp.pcap.out index 2e5f089ce..f8013b5bb 100644 --- a/test/results/bittorrent_utp.pcap.out +++ b/test/results/bittorrent_utp.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bittorrent_utp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bittorrent_utp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1456385034843,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"82.243.113.43","dst_ip":"192.168.1.5","src_port":64969,"dst_port":40959,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00542{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bittorrent_utp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1456385034,"pkt_ts_usec":843882,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"xCwDBkn+LFbcjDU0CABFCACEN6IAAHARjPNS83ErwKgBBf3Jn\/8AcJbNZDE6YWQyOmlkMjA69\/YAfOoTUG5RTefsvJTyrlFxFfg5OmluZm9faGFzaDIwOvf2AdimJ292LCw98nSvKCf40fHeZTE6cTk6Z2V0X3BlZXJzMTp0MjoOYTE6djQ6TFQBATE6eTE6cWU="} 00574{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"bittorrent_utp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1456385034843,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"82.243.113.43","dst_ip":"192.168.1.5","src_port":64969,"dst_port":40959,"l4_proto":"udp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} @@ -15,3 +16,5 @@ 00545{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"bittorrent_utp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1456385040,"pkt_ts_usec":747238,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"xCwDBkn+LFbcjDU0CABFCACEPltAAHARRjpS83ErwKgBBf3Jn\/8AcGQkZDE6YWQyOmlkMjA69\/YAfOoTUG5RTefsvJTyrlFxFfg5OmluZm9faGFzaDIwOvf2AKNLQi81\/RCcQj+jdmBNANVsZTE6cTk6Z2V0X3BlZXJzMTp0MjpdRzE6djQ6TFQBATE6eTE6cWU="} 02397{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"bittorrent_utp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1456385040,"pkt_ts_usec":805866,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"xCwDBkn+LFbcjDU0CABFCAXcPl4AAHARgN9S83ErwKgBBf3Jn\/8FyCGxAQBTAxD2SHQJ8T+lABAAAOf5Scj8LyukouNrwUcnHBaQa20z\/P8AHdLMNu2WZZdo9jx61Mq\/MnSVXq2PKIiIiIqkREqCICikREIiiqqIuK2Faz6fbus+dzXd1q9It9ttDyt2LCbJbJYs9CdF1xFJiOaAwo8M8oayXEFOzo+IFP1dXNRdtGgGqGm2re2HIpDt9sNzFq64iUaejM2EYOo84Mmc0StETZFHJE7\/ACeAwECbJTt\/vt3\/AOVaUZNedM9GsckX\/NrNbHLnkt4K2uymbDEVhDF0QROCIBeadJ1xFZbRQEkcUyRvn756mkPINsuPWTS+7XDPdx90ssKKdut2NSHzYn+3E58lW\/EDR+NAfIUbRwe\/RehNIfHQenrkm5SyauajYTrzZcolR5LKX2Lfrtw9BjSlNtHIsZ9sSZIXAfAkaadQGfbGItopHxfWlKVlX\/19f\/8Av\/RirVepjrHl+im1O9XXCm7hHutxmx7S7e7cSidnYd7KclSQC69uiMCfIKJyQITQ0FF+r0y7tOvWxzTCRcJkifIBmdGF2S6ThC01PktNNopKqoINgACP3CIiicIiJUK6EWxm0+sVrywwcgwPEgfVZMlx8uzg2hwkQnCJUFCNUEEXqAoICgiIinq+oprriupmGroNp4xZ9TNX79c24MezxmGp5WZUV4JEhTNo2WX2wbeZLsbbrAvE7yCBzVtdAdHLXt\/0axPT60Oe4iWOEjByepD7l8lVx9\/qRmoeR03HOnZUHv1T5IlZgbvNxczehuOk6M4xqvj+GaJQfAl0vtzuceNbprjBKb0kTcRo5HBuC23HFw23Cjg8ioP6xuNdddpGj2hWjzGdac7mLPlGouOvNSVh2i5Q\/NNdKW0LLkMGJCuxiYAicIuzykrfZPEiVrptV1S\/LTtx06zJy5\/GZ9yssf4jN9v4PJPbHxTPo6iicSG3k+kUFeOR+lUWpVr5LtNet1qmS48CRdJDDJutwYhNi9JIRVUbBXDAEIlThFMxHlU5JE5VMttN9g2oe+m+yNYNxmQ5BhsubNfiM4k1bEiyGoDY8MowrxksRoXScRG3GSI0AnFIle8i8\/Bn2H0st6Vsx+05\/IuOkGSMsFk0M0gzrnCdBh4WQlA2nmAWzktSUIG2lcbdURF5W17a6VnV6W2LWvBtfd2+N2SL7Ky2fJo9vgxvITnhYalXRtsOxqpFwIonJKqrx81VauBux\/CxrJ+5l5\/gXqir0uPwJ6Z\/6z\/3pLq1VKzV9TLe5p5d9Fc70WZjZA1n0maMJ+FKtisBB9rcGHRddMyRCakNN+VkmvJ2AwU0b7cVJfpvbpcq1gw3E8Jl6R3jG8Tx7EmY0POHn3XYN0dhqxEVttVjgCESo4XVHTUfEQ\/PhVS79YLaGbvL5pFs7uOlGmsm4BqnmGZvdStsM3JEeA7Eisp7YxXlJLzo+NvohkKC4qeM1aJba+llnOW6J6oZxtr1RlSLXfYTLN0sdjlTIz7MUiDzSmWXAcJSJxt9h9Gm1IURuQaoBd+1yd3m5y17S9GpOcT7d8bllNYt9vtHnKP719xVJQ8qNuI31aB5zkh4XxdeeSSqAaebLtct\/unEHP8AVPXzw2G9+K4Wu0w0+JxxMEcYUzisusxYzoiPHDfY+XHUcRtxDFeg2Aao5Ftu3aZHtUu+Vx85xMHpgWWbbkRxuFNbaWU4KKp8sirYvi8wnk6SR4Hjl0z1KpVSt8e\/7HdqGPDb7EVnyzUWS8UZMfOeqFbRWOrgyZQNiSoKEcfhoiaJ0XFUCRBJU+TXX1IsQ0M0O0\/y+ZZ\/iuZ5pZYN7g4XHnoJsMPtg4bj0jxr0aHsQCat8uGPAjwLhN8r6eO7nUvWXUfU7ANZ2Pg2Z27w3q22R+yuW+REhuLw6yoqKcNN+SIrfl5dJH1VTcROR4rcFuQ143Ka85Jo3trCRZLbijz1qyfKxdabZJXfEyZE48wjkUo7oyw="} 00440{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"bittorrent_utp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1456385040,"pkt_ts_usec":807007,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"LFbcjDU0xCwDBkn+CABFAAA2viAAAEARAADAqAEFUvNxK5\/\/\/ckAIoX\/IQFTAgcHYOz2ERRIAADwAEnJ5\/cABAEAAAA="} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":86,"source":"bittorrent_utp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":86,"flow_first_seen":1456385034843,"flow_last_seen":1456385054059,"flow_tot_l4_data_len":38565,"flow_min_l4_data_len":28,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":448,"midstream":0,"l3_proto":"ip4","src_ip":"82.243.113.43","dst_ip":"192.168.1.5","src_port":64969,"dst_port":40959,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":86,"source":"bittorrent_utp.pcap","alias":"nDPId-test"} diff --git a/test/results/bt_search.pcap.out b/test/results/bt_search.pcap.out index 109c484f1..ea236fb4a 100644 --- a/test/results/bt_search.pcap.out +++ b/test/results/bt_search.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"bt_search.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"bt_search.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1430752225251,"flow_last_seen":0,"flow_tot_l4_data_len":127,"flow_min_l4_data_len":127,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.102","dst_ip":"239.192.152.143","src_port":6771,"dst_port":6771,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00555{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"bt_search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430752225,"pkt_ts_usec":251619,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"AQBeQJiPABZEH1lmCABFAACTaOEAAP8RCRrAqABm78CYjxpzGnMAf8gHQlQtU0VBUkNIICogSFRUUC8xLjENCkhvc3Q6IDIzOS4xOTIuMTUyLjE0Mzo2NzcxDQpQb3J0OiA2MTE5Nw0KSW5mb2hhc2g6IEVENEYxMDg1RTg4NUY5OEY5QTY5QjcwRUU4OUVCOTg4QjhGRDkxMTUNCg0KDQo="} 00571{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"bt_search.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1430752225251,"flow_last_seen":0,"flow_tot_l4_data_len":127,"flow_min_l4_data_len":127,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.102","dst_ip":"239.192.152.143","src_port":6771,"dst_port":6771,"l4_proto":"udp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} @@ -5,3 +6,5 @@ 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"bt_search.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1430752525284,"flow_last_seen":0,"flow_tot_l4_data_len":127,"flow_min_l4_data_len":127,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.102","dst_ip":"239.192.152.143","src_port":6771,"dst_port":6771,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00556{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"bt_search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430752525,"pkt_ts_usec":284866,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"AQBeQJiPABZEH1lmCABFAACTCiwAAP8RZ8\/AqABm78CYjxpzGnMAf8gHQlQtU0VBUkNIICogSFRUUC8xLjENCkhvc3Q6IDIzOS4xOTIuMTUyLjE0Mzo2NzcxDQpQb3J0OiA2MTE5Nw0KSW5mb2hhc2g6IEVENEYxMDg1RTg4NUY5OEY5QTY5QjcwRUU4OUVCOTg4QjhGRDkxMTUNCg0KDQo="} 00571{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"bt_search.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1430752525284,"flow_last_seen":0,"flow_tot_l4_data_len":127,"flow_min_l4_data_len":127,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.102","dst_ip":"239.192.152.143","src_port":6771,"dst_port":6771,"l4_proto":"udp","ndpi": {"proto":"BitTorrent","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"bittorrent": {"hash":""}} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"bt_search.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1430752525284,"flow_last_seen":0,"flow_tot_l4_data_len":127,"flow_min_l4_data_len":127,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.102","dst_ip":"239.192.152.143","src_port":6771,"dst_port":6771,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"bt_search.pcap","alias":"nDPId-test"} diff --git a/test/results/capwap.pcap.out b/test/results/capwap.pcap.out index e2e423a4d..c226cc1d7 100644 --- a/test/results/capwap.pcap.out +++ b/test/results/capwap.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"capwap.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"capwap.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1422328949167,"flow_last_seen":0,"flow_tot_l4_data_len":73,"flow_min_l4_data_len":73,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.9","dst_ip":"192.168.10.10","src_port":5246,"dst_port":12379,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00482{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"capwap.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1422328949,"pkt_ts_usec":167396,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"uDhh8wWsJOmzR64gCABFwABdANlAAH8RZJPAqAoJwKgKChR+MFsASQAAAQAAABX+\/wABAAAAAAABADCRUl3gOBqBz\/u8XElQaHVuhYA4Oyehwv8gEXQ+BVAOU1L6bxnlZCgpb3mFtLC\/ZhI="} 00506{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"capwap.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1422328949167,"flow_last_seen":0,"flow_tot_l4_data_len":73,"flow_min_l4_data_len":73,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.9","dst_ip":"192.168.10.10","src_port":5246,"dst_port":12379,"l4_proto":"udp","ndpi": {"proto":"CAPWAP","breed":"Acceptable","category":"Network"}} @@ -64,3 +65,8 @@ 00572{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":359,"source":"capwap.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1422329136,"pkt_ts_usec":181810,"pkt_caplen":165,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":165,"pkt_l4_len":131,"pkt":"\/\/\/\/\/\/\/\/uDhh8wWsCABFwACXAGlAAP8Rr3rAqAoK\/\/\/\/\/zBcFH4AgwAAACACEAAAAAAGWAogaQ4g\/wAAABMAAGYAABQAAQEAJwAoAgIAAQBAlgAAAAAEAQAAAABAlgAAAQAEBwVmAABAlgAAAgAEDAQZAAApAAEEACwAAQEAJQAKAECWAADPAQAAAQAlABYAQJYAAAVBUGI4MzguNjFmMy4wNWFj"} 00818{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":378,"source":"capwap.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1422329141,"pkt_ts_usec":909488,"pkt_caplen":389,"pkt_type":375,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":389,"pkt_l4_len":0,"pkt":"AQAMzMzMuDhh8wWsAXeqqgMAAAwgAAK0KHQAAQAUQVBiODM4LjYxZjMuMDVhYwAFAPJDaXNjbyBJT1MgU29mdHdhcmUsIEMyNjAwIFNvZnR3YXJlIChBUDNHMi1LOVc4LU0pLCBWZXJzaW9uIDE1LjIoNClKQTEsIFJFTEVBU0UgU09GVFdBUkUgKGZjMikKVGVjaG5pY2FsIFN1cHBvcnQ6IGh0dHA6Ly93d3cuY2lzY28uY29tL3RlY2hzdXBwb3J0CkNvcHlyaWdodCAoYykgMTk4Ni0yMDEzIGJ5IENpc2NvIFN5c3RlbXMsIEluYy4KQ29tcGlsZWQgVHVlIDMwLUp1bC0xMyAyMjo1NyBieSBwcm9kX3JlbF90ZWFtAAYAG2Npc2NvIEFJUi1DQVAyNjAySS1RLUs5AAIAEQAAAAEBAcwABMCoCgoAAwAWR2lnYWJpdEV0aGVybmV0MC4xAAQACAAAAAMACwAFAQAQAAY8KAAZABCkjQABAAA8KAAAMsg="} 00156{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":378,"source":"capwap.pcap","alias":"nDPId-test","type":375} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":422,"source":"capwap.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1422328963915,"flow_last_seen":1422328966914,"flow_tot_l4_data_len":98,"flow_min_l4_data_len":49,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.10","dst_ip":"255.255.255.255","src_port":49259,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":422,"source":"capwap.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1422329005766,"flow_last_seen":1422329136181,"flow_tot_l4_data_len":524,"flow_min_l4_data_len":131,"flow_max_l4_data_len":131,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.10","dst_ip":"255.255.255.255","src_port":12380,"dst_port":5246,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":422,"source":"capwap.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":217,"flow_first_seen":1422329005767,"flow_last_seen":1422329174862,"flow_tot_l4_data_len":56296,"flow_min_l4_data_len":72,"flow_max_l4_data_len":1465,"flow_avg_l4_data_len":259,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.9","dst_ip":"192.168.10.10","src_port":5246,"dst_port":12380,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":422,"source":"capwap.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":173,"flow_first_seen":1422329017533,"flow_last_seen":1422329175528,"flow_tot_l4_data_len":28020,"flow_min_l4_data_len":59,"flow_max_l4_data_len":436,"flow_avg_l4_data_len":161,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.10.10","dst_ip":"192.168.10.9","src_port":12380,"dst_port":5247,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":422,"source":"capwap.pcap","alias":"nDPId-test"} diff --git a/test/results/check_mk_new.pcap.out b/test/results/check_mk_new.pcap.out index 105963f88..f77763384 100644 --- a/test/results/check_mk_new.pcap.out +++ b/test/results/check_mk_new.pcap.out @@ -1,3 +1,4 @@ +00389{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"check_mk_new.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"check_mk_new.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1512031663734,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.100.22","dst_ip":"192.168.100.50","src_port":58998,"dst_port":6556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"check_mk_new.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1512031663,"pkt_ts_usec":734797,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"RjIA9qTs8soKyPpECABFEAA8gwhAAEAGbgrAqGQWwKhkMuZ2GZzVcug3AAAAAKACchA4TQAAAgQFtAQCCAorDGs\/AAAAAAEDAwc="} 00439{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"check_mk_new.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1512031663,"pkt_ts_usec":734824,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8soKyPpERjIA9qTsCABFAAA8AABAAEAG8SLAqGQywKhkFhmc5nZuqQJN1XLoOKAScSBJyAAAAgQFtAQCCAoWUVydKwxrPwEDAwc="} @@ -15,3 +16,5 @@ 00429{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"check_mk_new.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1512031663,"pkt_ts_usec":739142,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"RjIA9qTs8soKyPpECABFEAA0gw5AAEAGbgzAqGQWwKhkMuZ2GZzVcug4bqkDeoAQAO1JwAAAAQEICisMa0AWUVye"} 01104{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"check_mk_new.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1512031663,"pkt_ts_usec":740312,"pkt_caplen":568,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":568,"pkt_l4_len":534,"pkt":"8soKyPpERjIA9qTsCABFAAIqXthAAEAGkFzAqGQywKhkFhmc5nZuqQN61XLoOIAYAONLtgAAAQEIChZRXJ8rDGtAdWRldiAgICAgICAgICAgZGV2dG1wZnMgICAgICA0OTQwOTIgICAgICAgMCAgICA0OTQwOTIgICAgICAgMCUgL2Rldgp0bXBmcyAgICAgICAgICB0bXBmcyAgICAgICAgIDEwMTAzNiAgICA2ODQ4ICAgICA5NDE4OCAgICAgICA3JSAvcnVuCi9kZXYveHZkYTEgICAgIGV4dDQgICAgICAgICA3MDM3MTc2IDIwNDkyNzIgICA0NjEwNzE2ICAgICAgMzElIC8KdG1wZnMgICAgICAgICAgdG1wZnMgICAgICAgICA1MDUxODAgICAgICAgMCAgICA1MDUxODAgICAgICAgMCUgL2Rldi9zaG0KdG1wZnMgICAgICAgICAgdG1wZnMgICAgICAgICAgIDUxMjAgICAgICAgMCAgICAgIDUxMjAgICAgICAgMCUgL3J1bi9sb2NrCnRtcGZzICAgICAgICAgIHRtcGZzICAgICAgICAgNTA1MTgwICAgICAgIDAgICAgNTA1MTgwICAgICAgIDAlIC9zeXMvZnMvY2dyb3VwCnRtcGZzICAgICAgICAgIHRtcGZzICAgICAgICAgMTAxMDM2ICAgICAgIDAgICAgMTAxMDM2ICAgICAgIDAlIC9ydW4vdXNlci8xMDAwCg=="} 00429{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"check_mk_new.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1512031663,"pkt_ts_usec":740384,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"RjIA9qTs8soKyPpECABFEAA0gw9AAEAGbgvAqGQWwKhkMuZ2GZzVcug4bqkFcIAQAPVJwAAAAQEICisMa0AWUVyf"} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":98,"source":"check_mk_new.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":98,"flow_first_seen":1512031663734,"flow_last_seen":1512031663775,"flow_tot_l4_data_len":16910,"flow_min_l4_data_len":32,"flow_max_l4_data_len":4128,"flow_avg_l4_data_len":172,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.100.22","dst_ip":"192.168.100.50","src_port":58998,"dst_port":6556,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":98,"source":"check_mk_new.pcap","alias":"nDPId-test"} diff --git a/test/results/coap_mqtt.pcap.out b/test/results/coap_mqtt.pcap.out index c5d96a0b1..1051c1b3c 100644 --- a/test/results/coap_mqtt.pcap.out +++ b/test/results/coap_mqtt.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"coap_mqtt.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00506{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1333957710293,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"2001:da8:215:1171:a10b:cb48:8f83:57f6","dst_ip":"2001:620:8:35d9::10","src_port":61043,"dst_port":5683,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"coap_mqtt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1333957710,"pkt_ts_usec":293035,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"ACOJtMwBSF1gwJdKht1gAAAAACARQCABDagCFRFxoQvLSI+DV\/YgAQYgAAg12QAAAAAAAAAQ7nMWMwAg\/RpDAQXKchYzKy53ZWxsLWtub3duBGNvcmU="} 00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1333957710293,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"2001:da8:215:1171:a10b:cb48:8f83:57f6","dst_ip":"2001:620:8:35d9::10","src_port":61043,"dst_port":5683,"l4_proto":"udp","ndpi": {"proto":"COAP","breed":"Safe","category":"RPC"}} @@ -177,3 +178,12 @@ 00530{"flow_id":16,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2463,"source":"coap_mqtt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455907276,"pkt_ts_usec":504810,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"CAAnmO\/hCAAnAERyCABFAAB6FSUAAIARM5fAqDgBwKg4ZcSPRFwAZtwsQQOAbEZyRFxBcghCdXMxN0NtZBEy\/3sibWVzc2FnZVR5cGUiOiJVUERBVEUiLCJtZXNzYWdlQ29udGVudCI6IkZyaSBGZWIgMTkgMjA6NDE6MTYgRUVUIDIwMTYifQ=="} 00422{"flow_id":16,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2481,"source":"coap_mqtt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455907276,"pkt_ts_usec":512120,"pkt_caplen":59,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":59,"pkt_l4_len":25,"pkt":"CAAnAERyCAAnmO\/hCABFAAAtX+dAAEAR6SHAqDhlwKg4AURcxI8AGfHhYUSAbEaLL3IvQnVzMTdDbWQ="} 00535{"flow_id":16,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2543,"source":"coap_mqtt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455907276,"pkt_ts_usec":636911,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"CAAnmO\/hCAAnAERyCABFAAB\/FUwAAIARM2vAqDgBwKg4ZcSPRFwAa923RgOAbRWOzuOZuXJEXEFyCEJ1czE3Q21kETL\/eyJtZXNzYWdlVHlwZSI6IlVQREFURSIsIm1lc3NhZ2VDb250ZW50IjoiRnJpIEZlYiAxOSAyMDo0MToxNiBFRVQgMjAxNiJ9"} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":200,"flow_first_seen":1455907271481,"flow_last_seen":1455907282686,"flow_tot_l4_data_len":13320,"flow_min_l4_data_len":25,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50311,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":200,"flow_first_seen":1455907274088,"flow_last_seen":1455907285181,"flow_tot_l4_data_len":13394,"flow_min_l4_data_len":25,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50312,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":200,"flow_first_seen":1455907272856,"flow_last_seen":1455907284046,"flow_tot_l4_data_len":13420,"flow_min_l4_data_len":25,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50318,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":200,"flow_first_seen":1455907275690,"flow_last_seen":1455907286608,"flow_tot_l4_data_len":13342,"flow_min_l4_data_len":25,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50319,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1922,"flow_first_seen":1455907243976,"flow_last_seen":1455907286855,"flow_tot_l4_data_len":100044,"flow_min_l4_data_len":20,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":52,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":53522,"dst_port":17501,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1926,"flow_first_seen":1455907258332,"flow_last_seen":1455907286855,"flow_tot_l4_data_len":100124,"flow_min_l4_data_len":20,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":51,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":53523,"dst_port":17501,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1919,"flow_first_seen":1455907271483,"flow_last_seen":1455907286855,"flow_tot_l4_data_len":99996,"flow_min_l4_data_len":20,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":52,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.56.101","dst_ip":"192.168.56.1","src_port":17501,"dst_port":53524,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1928,"flow_first_seen":1455907267002,"flow_last_seen":1455907286845,"flow_tot_l4_data_len":100439,"flow_min_l4_data_len":20,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":53528,"dst_port":17501,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":8516,"source":"coap_mqtt.pcap","alias":"nDPId-test"} diff --git a/test/results/cpha.pcap.out b/test/results/cpha.pcap.out index 698b23dd8..3827461b7 100644 --- a/test/results/cpha.pcap.out +++ b/test/results/cpha.pcap.out @@ -1,2 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cpha.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00426{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"cpha.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603354463,"pkt_ts_usec":286532,"pkt_caplen":96,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":96,"pkt_l4_len":0,"pkt":"AQBeFQMBAAAAAAEBgQAAFQgARQAATgAAAAD\/EQyKAAAAAKwVAwAftB+0ADpJ\/BqQDDEnhQABABZ5PgAB\/\/7gSgEAAAIAAQAACAoAAgADAAQAAAIECQAAAAkAAAAAAAIA"} 00154{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"cpha.pcap","alias":"nDPId-test","type":33024} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"cpha.pcap","alias":"nDPId-test"} diff --git a/test/results/dcerpc.pcap.out b/test/results/dcerpc.pcap.out index 2ecc3b746..6f7db0fc0 100644 --- a/test/results/dcerpc.pcap.out +++ b/test/results/dcerpc.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dcerpc.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1602860709979,"flow_last_seen":0,"flow_tot_l4_data_len":650,"flow_min_l4_data_len":650,"flow_max_l4_data_len":650,"flow_avg_l4_data_len":650,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.11","dst_ip":"192.168.1.20","src_port":49155,"dst_port":34964,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01262{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dcerpc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1602860709,"pkt_ts_usec":979607,"pkt_caplen":684,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":684,"pkt_l4_len":650,"pkt":"AA7wSJ4FABwGCybtCABFAAKeAX4AAB4RFWLAqAELwKgBFMADiJQCip8cBAAgAAAAAADeoAAAbJcR0YJxAAEBAQFN3qAAAWyXEdGCcQCgJELffTX9qQA1ihISgAQAHAYLJu0AAAAAAAAAAQAAAAAAAP\/\/\/\/8CMgAAAAAAAAMtAAACHgAAAy0AAAAAAAACHgEBAEQBAAABCfGlMMdfbUe2f4BzQ53qrQACABwGCybt3qAAAGyXEdGCcQBkAQ0AKgAAABECWIiSAA5wbGN4YmtvbnRyNzRiNwECAGgBAAABAAGIkgAAAAIAKIAAACAAAgABAAD\/\/\/\/\/AAMAA8AAAAAAAAAAAAEAAAAAAAcAAAABAAAAAIAAAAEAAIABAAIAAIACAAMAAQABAAQAAgABAAYAAwABAAkAAgACAAEACAAEAAEACwECAGgBAAACAAKIkgAAAAIAKIAQACAAAgABAAD\/\/\/\/\/AAMAA8AAAAAAAAAAAAEAAAAAAAIAAgABAAYABAABAAkABwAAAAEAAAAAgAAAAQAAgAEAAgAAgAIAAwABAAEABAACAAEABQADAAEACAEEAEoBAAABAAAAAAAAAAAEBgAAAAQAAQAAAAEAAAABAAABAYAAAAAAAgAAAAEAAAEBgAEAAAADAAAAAQAAAQGAAgAAAAMAAAABAAABAQEEACABAAABAAAAAAABAQAA2AAAAAEAAQAAAAEAAQABAAEBAQEEACYBAAABAAAAAAACCAgABAAAAAEAAQAAAAEAAwABAAEBAQACAAEBAQEEACABAAABAAAAAAADCAAAAgAAAAEAAQAAAAEAAQABAAEBAQEEACABAAABAAAAAAAEAAgAUgAAAAEAAQAAAAEAAgACAAEBAQEDABYBAAABiJIAAAAAAAEAAwAAAQDAAKAA"} 00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1602860709979,"flow_last_seen":0,"flow_tot_l4_data_len":650,"flow_min_l4_data_len":650,"flow_max_l4_data_len":650,"flow_avg_l4_data_len":650,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.11","dst_ip":"192.168.1.20","src_port":49155,"dst_port":34964,"l4_proto":"udp","ndpi": {"proto":"DCE_RPC","breed":"Acceptable","category":"RPC"}} @@ -22,3 +23,8 @@ 00572{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dcerpc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1602860710,"pkt_ts_usec":71384,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"AA7wSJ4FABwGCybtCABFAACgAYEAAB4RF13AqAELwKgBFMACwAoAjHUlBAIKAAAAAADeoAAAbJcR0YJxAGQBDQAq3qAAAmyXEdGCcQCgJELffUP7yIAAABAQgAAADvBIngUAJ7vVAAAAAQAAAAAABP\/\/\/\/8ANAAAAAAAAAAAAAAAIAAAAKAAAAAAAAAAIIESABwBAAAACfGlMMdfbUe2f4BzQ53qrQACAAAACAAA"} 00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1602860710071,"flow_last_seen":0,"flow_tot_l4_data_len":140,"flow_min_l4_data_len":140,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.11","dst_ip":"192.168.1.20","src_port":49154,"dst_port":49162,"l4_proto":"udp","ndpi": {"proto":"DCE_RPC","breed":"Acceptable","category":"RPC"}} 00572{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1602860710,"pkt_ts_usec":71385,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"AA7wSJ4FABwGCybtCABFAACgAYEAAB4RF13AqAELwKgBFMACwAoAjHUlBAIKAAAAAADeoAAAbJcR0YJxAGQBDQAq3qAAAmyXEdGCcQCgJELffUP7yIAAABAQgAAADvBIngUAJ7vVAAAAAQAAAAAABP\/\/\/\/8ANAAAAAAAAAAAAAAAIAAAAKAAAAAAAAAAIIESABwBAAAACfGlMMdfbUe2f4BzQ53qrQACAAAACAAA"} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1602860710071,"flow_last_seen":1602860710071,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":140,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.11","dst_ip":"192.168.1.20","src_port":49154,"dst_port":49162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1602860709993,"flow_last_seen":1602860710062,"flow_tot_l4_data_len":2260,"flow_min_l4_data_len":140,"flow_max_l4_data_len":812,"flow_avg_l4_data_len":376,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.20","dst_ip":"192.168.1.11","src_port":49161,"dst_port":49155,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1602860709979,"flow_last_seen":1602860710032,"flow_tot_l4_data_len":3502,"flow_min_l4_data_len":140,"flow_max_l4_data_len":961,"flow_avg_l4_data_len":583,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.11","dst_ip":"192.168.1.20","src_port":49155,"dst_port":34964,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1602860710063,"flow_last_seen":1602860710063,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":140,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.20","dst_ip":"192.168.1.11","src_port":49162,"dst_port":34964,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":16,"source":"dcerpc.pcap","alias":"nDPId-test"} diff --git a/test/results/diameter.pcap.out b/test/results/diameter.pcap.out index 5d0ad8d7d..b61fe837f 100644 --- a/test/results/diameter.pcap.out +++ b/test/results/diameter.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"diameter.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"diameter.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1263278878271,"flow_last_seen":0,"flow_tot_l4_data_len":364,"flow_min_l4_data_len":364,"flow_max_l4_data_len":364,"flow_avg_l4_data_len":364,"midstream":1,"l3_proto":"ip4","src_ip":"10.201.9.245","dst_ip":"10.201.9.11","src_port":50957,"dst_port":3868,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00870{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"diameter.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1263278878,"pkt_ts_usec":271686,"pkt_caplen":398,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":398,"pkt_l4_len":364,"pkt":"ABpk3ZWLACYYlIbACABFAAGABtlAAIAGAAAKyQn1CskJC8cNDxz34fq2+LwvkFAY+gQqBAAAAQABWIAAARAAAAAEAupJMCbwAAMAAAEHQAAAHW54bDthcGk7MTI2MzI3ODg3ODE0NwAAAAAAAc1AAAAUQ29tdmVyc2UuRENJAAABAkAAAAwAAAAEAAABCEAAABlueGwxLm5ldHhjZWxsLmNvbQAAAAAAAShAAAAUbmV0eGNlbGwuY29tAAABn0AAAAwAAAAAAAABJUAAABlkZ3UyLmNvbXZlcnNlLmNvbQAAAAAAARtAAAAUY29tdmVyc2UuY29tAAAAN0AAAAzO9pmeAAABu0AAACgAAAG8QAAAFDkxOTA4MDAwMDAxNgAAAcJAAAAMAAAAAAAAAbhAAAAkAAABuUAAAAwAAAACAAABukAAAA1kYmlsbAAAAAAAAaBAAAAMAAAAAQAAAbVAAAA0AAABnUAAACwAAAG9QAAAGAAAAb9AAAAQAAAAAAAAAAIAAAGpQAAADAAAAWQ="} 00726{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"diameter.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1263278878,"pkt_ts_usec":292831,"pkt_caplen":290,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":290,"pkt_l4_len":256,"pkt":"ACYYlIbAABpk3ZWLCABFAAEUlYlAAEAGe8kKyQkLCskJ9Q8cxw34vC+Q9+H8DlAYGSCUIQAAAQAA7EAAARAAAAAEAupJMCbwAAMAAAEHQAAAHW54bDthcGk7MTI2MzI3ODg3ODE0NwAAAAAAAQxAAAAMAAAH0QAAAQhAAAAaZHNsdTEuY29tdmVyc2UuY29tAAAAAAEoQAAAFGNvbXZlcnNlLmNvbQAAAQJAAAAMAAAABAAAAaBAAAAMAAAAAQAAAZ9AAAAMAAAAAAAAARZAAAAMAABBbQAAADdAAAAMzvaZ5QAAAcBAAAAMAAAABQAAAa9AAAA0AAABnUAAACwAAAG9QAAAGAAAAb9AAAAQAAAAAAAAAAIAAAGpQAAADAAAAWQ="} @@ -5,3 +6,6 @@ 00726{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"diameter.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1263278878,"pkt_ts_usec":344805,"pkt_caplen":290,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":290,"pkt_l4_len":256,"pkt":"ACYYlIbAABpk3ZWLCABFAAEUlYpAAEAGe8gKyQkLCskJ9Q8cxw34vDB89+H9dlAYHVCNmAAAAQAA7EAAARAAAAAEAupJMSbwAAUAAAEHQAAAHW54bDthcGk7MTI2MzI3ODg3ODE0NwAAAAAAAQxAAAAMAAAH0QAAAQhAAAAaZHNsdTEuY29tdmVyc2UuY29tAAAAAAEoQAAAFGNvbXZlcnNlLmNvbQAAAQJAAAAMAAAABAAAAaBAAAAMAAAAAgAAAZ9AAAAMAAAAAQAAARZAAAAMAABBbQAAADdAAAAMzvaZ5QAAAcBAAAAMAAAABQAAAa9AAAA0AAABnUAAACwAAAG9QAAAGAAAAb9AAAAQAAAAAAAAAAIAAAGpQAAADAAAAWQ="} 00822{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"diameter.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1263278878,"pkt_ts_usec":350601,"pkt_caplen":362,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":362,"pkt_l4_len":328,"pkt":"ABpk3ZWLACYYlIbACABFAAFcBttAAIAGAAAKyQn1CskJC8cNDxz34f12+LwxaFAY+Cwp4AAAAQABNIAAARAAAAAEAupJMibwAAcAAAEHQAAAHW54bDthcGk7MTI2MzI3ODg3ODE0NwAAAAAAAc1AAAAUQ29tdmVyc2UuRENJAAABAkAAAAwAAAAEAAABCEAAABlueGwxLm5ldHhjZWxsLmNvbQAAAAAAAShAAAAUbmV0eGNlbGwuY29tAAABn0AAAAwAAAACAAABJUAAABlkZ3UyLmNvbXZlcnNlLmNvbQAAAAAAARtAAAAUY29tdmVyc2UuY29tAAAAN0AAAAzO9pmeAAABu0AAACgAAAG8QAAAFDkxOTA4MDAwMDAxNgAAAcJAAAAMAAAAAAAAAaBAAAAMAAAAAwAAAb5AAAA0AAABnUAAACwAAAG9QAAAGAAAAb9AAAAQAAAAAAAAAAEAAAGpQAAADAAAAWQ="} 00642{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"diameter.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1263278878,"pkt_ts_usec":357703,"pkt_caplen":226,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":226,"pkt_l4_len":192,"pkt":"ACYYlIbAABpk3ZWLCABFAADUlYtAAEAGfAcKyQkLCskJ9Q8cxw34vDFo9+H+qlAYIYAUAQAAAQAArEAAARAAAAAEAupJMibwAAcAAAEHQAAAHW54bDthcGk7MTI2MzI3ODg3ODE0NwAAAAAAAQxAAAAMAAAH0QAAAQhAAAAaZHNsdTEuY29tdmVyc2UuY29tAAAAAAEoQAAAFGNvbXZlcnNlLmNvbQAAAQJAAAAMAAAABAAAAaBAAAAMAAAAAwAAAZ9AAAAMAAAAAgAAARZAAAAMAABBbQAAADdAAAAMzvaZ5Q=="} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":6,"source":"diameter.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1263278878271,"flow_last_seen":1263278878357,"flow_tot_l4_data_len":1776,"flow_min_l4_data_len":192,"flow_max_l4_data_len":380,"flow_avg_l4_data_len":296,"midstream":1,"l3_proto":"ip4","src_ip":"10.201.9.245","dst_ip":"10.201.9.11","src_port":50957,"dst_port":3868,"l4_proto":"tcp","ndpi": {"proto":"Diameter","breed":"Acceptable","category":"Network"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"diameter.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1263278878271,"flow_last_seen":1263278878357,"flow_tot_l4_data_len":1776,"flow_min_l4_data_len":192,"flow_max_l4_data_len":380,"flow_avg_l4_data_len":296,"midstream":1,"l3_proto":"ip4","src_ip":"10.201.9.245","dst_ip":"10.201.9.11","src_port":50957,"dst_port":3868,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"diameter.pcap","alias":"nDPId-test"} diff --git a/test/results/dlt_ppp.pcap.out b/test/results/dlt_ppp.pcap.out index 15fbf47d7..f96e632c2 100644 --- a/test/results/dlt_ppp.pcap.out +++ b/test/results/dlt_ppp.pcap.out @@ -1,2 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dlt_ppp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 01956{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"dlt_ppp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1,"pkt_ts_usec":31048,"pkt_caplen":1230,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":1230,"pkt_l4_len":0,"pkt":"ACFFAgTMQT1AAD8RDTPBpwD8wadkZKwzAbsEuAAAz\/8AAB0MtxIpOpsU8gzQWdyoBJhpwdcARJZ0OsZN0bl8VJfvOykoeuttM0eMWHJwpGpOPAqWh0GUfp9IIe82zPEOJxxbudM5\/pOWImGkMJYnZKC4oc+Wie817ZluT3qGlbT6FmvR7wgU3ZlqiJlO4+0DRHL4d\/DzL3RfCdhaKCfxoviWr9OOaF9xayHBTgloTkVIbSLderihnwr+mk7qqrStghVdXJFtnOWHTzAMdmPpzaY99oTPzZwWklZzjG9W5shdxiA8ok\/3pt2WMY3QJIDzbHzKP+7ZsLr5YGFFIYxx1JspmQXO5+U3jVl43o7+huGmMmGYHNdWbRYYgFoAkcV642cnCac+cZPVd9ar\/XFRGfd\/WaFVK+zvTNX+exQ7Y3ZIotGRLaPFvGpj3H1W9HNWBEKODu7hETU2OX\/NaZuNjAbfxxKVTC9o6LUxoTVjag4leuFawG3pE6XLxFh9fenfXyYspIGy40nX701+znmPySuhrrYghEKqHVTFz\/fjb5y59pxDqwfx2gz+0tLjNRNMLdNY1Ag+BpNZPQBZDxS1Q4nlCfUqLKWSJpEsd+mHyUC3pRaolG8Jpu68ULGXjJ4ZKS7952WY2QtbjEtiMSGVNPERp0foW+HREy8qKb+tFgJ65NsBWY0E9\/jJGGpFUnix\/C7BDjtX\/ZgK9gfyvVQabBdj7mBntuOhNmnilWaVEIOX7CKCv2V+0LQWQOOVtmTWBQy0XrnBP7R005Av3+pdvoITeQ2zEo762fyDmFlboLbmiVV7z4cyXPPQL6MPya78HzZSLTnm3Xxv8O87bNxZE+T0J9baS33P9HRocrLvAjLFAWSMQbXzM6RAx0uu2+2kxSt4LNQRr+Nvhj9iZm0i+9tU23DVWOg6UFW+uqUPF0ds+jp9XdVBP+b6UC3e79iGd\/QTg4M7OYt7pt75ojnbr+ZjxHE8B0GZ1bPhHUhQ\/439iohTEuvizuLosg\/9ETTUUdbasnXh9D\/+SO51ABAnZvM6SDJ1pj177GYIwa\/ZqyWvarQpS41HFFKu4RYpQHjOT56xqgSjrLEWXyerkTEX8shaJqUzTf0hupuyCJ\/APa3545+ZYzvcCDGD7g4mx1kJ6bCPcx5s\/v5xv0RJBodp9K1hK4v\/DTDZxZGtU5gN0XXnA0WlvhheGJ1S\/ZaCizvBvbTeu8i2DUwd4Wme2LeIVwWL1YRsoozl32VaoHYmsfd7GuS4nwcSIq7qOKc\/v0ngj3r3ND1Z2VcoyXNbqPLJo2kpXaoXlSfOfSzoS+BYoeB3qst\/3RnzIpMan+YfjUUqTAsAH+lgJatdqf9zS60Yl5fSUpCDIosbThj4VOLqNKWrLQjA8v+93FIA3\/NFEDMSuNxj605kSA9S9GRrTJHsR5osW14O2xZRF\/BiXyz77L3\/OW35KvEzzuGXD5Apmt9048cnckQ+W8pGZui61Z81+NpEDiVl5\/7woKFPqgJn9vKV42rT4DXlRToJ8qpzLeevd936RndwoN8DMGcbfT7BT7\/CndBaHTk\/Xoi\/g0FlSSofCargF+zZqnP61iuG15DY\/IC7bC0k3NnOEoXpUUSiCOrtQOJtDXQygOL8Gb9V"} 00158{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"dlt_ppp.pcap","alias":"nDPId-test","datalink":9} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"dlt_ppp.pcap","alias":"nDPId-test"} diff --git a/test/results/dnp3.pcap.out b/test/results/dnp3.pcap.out index 9102be64c..d66459137 100644 --- a/test/results/dnp3.pcap.out +++ b/test/results/dnp3.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dnp3.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00461{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dnp3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1097501938503,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.8","dst_ip":"10.0.0.3","src_port":2789,"dst_port":20000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dnp3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1097501938,"pkt_ts_usec":503079,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AAKzznBRAFAEk3BnCABFAAAwTFlAAIAGmmQKAAAICgAAAwrlTiBVHBrSAAAAAHAC\/\/+mIQAAAgQFtAEBBAI="} 00417{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"dnp3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1097501938,"pkt_ts_usec":503079,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AAKzznBRAFAEk3BnCABFAAAwTFlAAIAGmmQKAAAICgAAAwrlTiBVHBrSAAAAAHAC\/\/+mIQAAAgQFtAEBBAI="} @@ -141,3 +142,5 @@ 00415{"flow_id":8,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"dnp3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1097513177,"pkt_ts_usec":421231,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAKzznBRAFAEk3BnCABFAAAoAUxAAIAG5XgKAAAJCgAAAwQ8TiBc3qwgBtOdtlAQ\/+6b9QAAAAAAAAAA"} 00415{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"dnp3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1097513177,"pkt_ts_usec":421231,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAKzznBRAFAEk3BnCABFAAAoAUxAAIAG5XgKAAAJCgAAAwQ8TiBc3qwgBtOdtlAQ\/+6b9QAAAAAAAAAA"} 00415{"flow_id":8,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"dnp3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1097513177,"pkt_ts_usec":421231,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AAKzznBRAFAEk3BnCABFAAAoAUxAAIAG5XgKAAAJCgAAAwQ8TiBc3qwgBtOdtlAQ\/+6b9QAAAAAAAAAA"} +00478{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":543,"source":"dnp3.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":39,"flow_first_seen":1097513177295,"flow_last_seen":1097513185107,"flow_tot_l4_data_len":1023,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.9","dst_ip":"10.0.0.3","src_port":1084,"dst_port":20000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":543,"source":"dnp3.pcap","alias":"nDPId-test"} diff --git a/test/results/dns-tunnel-iodine.pcap.out b/test/results/dns-tunnel-iodine.pcap.out index 8586446aa..bab9ceb7c 100644 --- a/test/results/dns-tunnel-iodine.pcap.out +++ b/test/results/dns-tunnel-iodine.pcap.out @@ -1,3 +1,4 @@ +00394{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1282356640051,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.30","dst_ip":"10.0.2.20","src_port":44639,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1282356640,"pkt_ts_usec":51082,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"CAAnx266CAAnnOC0CABFAABEAABAAEARIngKAAIeCgACFK5fADUAMAHkErABAAABAAAAAAAAC3ZhYWFha2FyZGxpBnBpcmF0ZQNzZWEAAAoAAQ=="} 00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1282356640051,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.30","dst_ip":"10.0.2.20","src_port":44639,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"vaaaakardli.pirate.sea","num_queries":0,"num_answers":0,"reply_code":0,"query_type":10,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -21,3 +22,4 @@ 00557{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1282356640,"pkt_ts_usec":58974,"pkt_caplen":156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":156,"pkt_l4_len":122,"pkt":"CAAnnOC0CAAnx266CABFAACOAABAAEARIi4KAAIUCgACHgA1rl8AegzWx8qEAAABAAEAAAAAJHppMWFhQTAxMjM0NTY3ODm8vb6\/wMHCw8TFxsfIycrLzM3OzwZwaXJhdGUDc2VhAAAKAAHADAAKAAEAAAAAACV6aTFhYUEwMTIzNDU2Nzg5vL2+v8DBwsPExcbHyMnKy8zNzs8u"} 00531{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1282356640,"pkt_ts_usec":59078,"pkt_caplen":134,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":134,"pkt_l4_len":100,"pkt":"CAAnx266CAAnnOC0CABFAAB4AABAAEARIkQKAAIeCgACFK5fADUAZN9j5fkBAAABAAAAAAABNHppMWJhQdDR0tPU1dbX2Nna29zd3t\/g4eLj5OXm5+jp6uvs7e7v8PHy8\/T19vf4+fr7\/P0GcGlyYXRlA3NlYQAACgABAAApEAAAAIAAAAA="} 00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":259,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1282356640051,"flow_last_seen":1282356654812,"flow_tot_l4_data_len":37534,"flow_min_l4_data_len":48,"flow_max_l4_data_len":1478,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.30","dst_ip":"10.0.2.20","src_port":44639,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"16":"Suspicious DGA domain name","23":"Suspicious DNS traffic"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"yrbi02.pirate.sea","num_queries":1,"num_answers":1,"reply_code":0,"query_type":10,"rsp_type":10,"rsp_addr":"0.0.0.0"}} +00138{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":438,"source":"dns-tunnel-iodine.pcap","alias":"nDPId-test"} diff --git a/test/results/dns_doh.pcap.out b/test/results/dns_doh.pcap.out index 56fe60ef2..5b49d488e 100644 --- a/test/results/dns_doh.pcap.out +++ b/test/results/dns_doh.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dns_doh.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dns_doh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1571089200789,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.10.4","dst_ip":"104.16.248.249","src_port":49877,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dns_doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1571089200,"pkt_ts_usec":789290,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"WkBO7NFkeDHBvV4kCABFAABAAABAAEAGI5asFAoEaBD4+cLVAbuk7FgiAAAAALAC\/\/+OlwAAAgQFtAEDAwYBAQgKHZWyDQAAAAAEAgAA"} 00422{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"dns_doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1571089200,"pkt_ts_usec":876406,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eDHBvV4kWkBO7NFkCABFAAA0AAAAADAGc6JoEPj5rBQKBAG7wtXKYdwupOxYI4ASchB+OgAAAgQFFAEBBAIBAwMK"} @@ -16,3 +17,5 @@ 00644{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"dns_doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1571089200,"pkt_ts_usec":997105,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":224,"pkt_l4_len":190,"pkt":"WkBO7NFkeDHBvV4kCABFAADSAABAAEAGIwSsFAoEaBD4+cLVAbuk7FpoymHoGFAYEAAeoAAAFwMDAKVH6TqazYA7ng6LT4l7ICcI+zDrPqkD74EaZ6KlHesT55LnIvUipV2qXZpL8fzDqyEQhFLmXlLAQ93tMr6RsRmWGutBjX2OhZG68kQ4zzqatM7jcG4Y2nVphp4aNS7ac9Qo2\/v7IVdjtQB1CkeQwcFBtxuU+JEsGcEl4y5hc2GPOmwe\/WlOtwx06\/p3NlOkXM54GAVosDROpyIcNMw\/TJ\/7wU2Gazw="} 00738{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dns_doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1571089200,"pkt_ts_usec":997215,"pkt_caplen":297,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":297,"pkt_l4_len":263,"pkt":"WkBO7NFkeDHBvV4kCABFAAEbAABAAEAGIrusFAoEaBD4+cLVAbuk7FsSymHoGFAYEADbRgAAFwMDAO5\/vj0XEVnApHWZyVont16WzoBfdkAUmUbtIto2rVqakjpRrb9v2jurJwqyY\/z6UQZ3HmonNk14uRAJ2lvf9WUw3Lxqp7XnO9mc2Y0eGDeOQ78Bx7eTPAZJQY8jyiAoQ0jXnRqdThIktvVorw4e0Wm1AXUizW5CUhMfL\/E8EAZDMdczfxELdU1ZS42ZaZ+Phxpxn5fNufCX++USMGjMdp0Yzm2pqkSCVTURNOtV4CfYYOT0WamTvw9J8T9gizqAu6EOuMORP1Jd2wYehzjyC0fMtnDXpkcDrt5TeWwCR9SAmt3pp7M0dWeWWko8+S69"} 00518{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dns_doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1571089200,"pkt_ts_usec":997306,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"WkBO7NFkeDHBvV4kCABFAAB3AABAAEAGI1+sFAoEaBD4+cLVAbuk7FwFymHoGFAYEACdtAAAFwMDAEqnnHxUsCqmPBkBxfdKmS1LGWAClj9T3prwE3TeVTsVPs4vesfDED+gBYka+2qIBZHm9ndhgvy1QPO4+xzZ0FzqwIc8Gf+UTIjqXQ=="} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":142,"source":"dns_doh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":142,"flow_first_seen":1571089200789,"flow_last_seen":1571089204031,"flow_tot_l4_data_len":15534,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1320,"flow_avg_l4_data_len":109,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.10.4","dst_ip":"104.16.248.249","src_port":49877,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":142,"source":"dns_doh.pcap","alias":"nDPId-test"} diff --git a/test/results/dns_dot.pcap.out b/test/results/dns_dot.pcap.out index 4aff22721..0ce87dc67 100644 --- a/test/results/dns_dot.pcap.out +++ b/test/results/dns_dot.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dns_dot.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dns_dot.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1572783663234,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.185","dst_ip":"8.8.8.8","src_port":58290,"dst_port":853,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dns_dot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572783663,"pkt_ts_usec":234722,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"uCfrK5DxCAAnjau+CABFAAA8w6dAAEAGpKPAqAG5CAgICOOyA1VVRPv3AAAAAKAC+vDSnwAAAgQFtAQCCAoqL5UTAAAAAAEDAwc="} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"dns_dot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572783663,"pkt_ts_usec":269648,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"CAAnjau+uCfrK5DxCABFAAA8cqUAAHcG\/qUICAgIwKgBuQNV47LuO0vYVUT7+KAS6yDKxQAAAgQFZAQCCAqOOwAQKi+VEwEDAwg="} @@ -16,3 +17,5 @@ 00581{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"dns_dot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572783663,"pkt_ts_usec":362911,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":178,"pkt_l4_len":144,"pkt":"CAAnjau+uCfrK5DxCABFAACkcscAAHcG\/hsICAgIwKgBuQNV47LuO1jqVUT9aIAYAPA14wAAAQEICo47AG0qL5VpFwMDAGtCZAKYrlOw7p7Ypme9t\/jxCtE4s3HbB+oF3nvBhGolPit9CQPVOUDaPHWJ6Wddy5sdn+0b82cMnVdi1F6cKaM9dEhCKMWku7ZXhgF9LPwgwe31yVB9tI+mAU3oHSrmP6q7mlJnO5Q6OCmQ+g=="} 00424{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dns_dot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572783663,"pkt_ts_usec":363038,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"uCfrK5DxCAAnjau+CABFAAA0w65AAEAGpKTAqAG5CAgICOOyA1VVRP1o7jtZWoAQAfXSlwAAAQEICiovlZOOOwBj"} 00457{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dns_dot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572783664,"pkt_ts_usec":523258,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"uCfrK5DxCAAnjau+CABFAABLw69AAEAGpIzAqAG5CAgICOOyA1VVRP1o7jtZWoAYAfXSrgAAAQEICiovmhuOOwBjFwMDABI82N\/gUdWtanJsd6FACr8N0eU="} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"dns_dot.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":24,"flow_first_seen":1572783663234,"flow_last_seen":1572783666246,"flow_tot_l4_data_len":5053,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3101,"flow_avg_l4_data_len":210,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.185","dst_ip":"8.8.8.8","src_port":58290,"dst_port":853,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":24,"source":"dns_dot.pcap","alias":"nDPId-test"} diff --git a/test/results/dns_exfiltration.pcap.out b/test/results/dns_exfiltration.pcap.out index 8d3d4999e..2f085b840 100644 --- a/test/results/dns_exfiltration.pcap.out +++ b/test/results/dns_exfiltration.pcap.out @@ -1,3 +1,4 @@ +00393{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dns_exfiltration.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dns_exfiltration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1580978146717,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.220.56","dst_ip":"192.168.203.167","src_port":56373,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00634{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dns_exfiltration.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1580978146,"pkt_ts_usec":717893,"pkt_caplen":215,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":215,"pkt_l4_len":181,"pkt":"qqru7hERjNzURr7ECABFAADJegRAAD8RAADAqNw4wKjLp9w1ADUAtSn4OR0BAAABAAAAAAAABmRuc2NhdDw1NDZiMDNmNTAwMDAwMDAwMDBhNjAyM2VkNGRmMTg0ZDZhYzVjMjYyOGI0NzcxNGZkZWU1ODRmZWQ3Mzk8NWEwM2I1YjFlMWFhOGY4ZmRiMWJiZThkNWUwNDk1MjE0MWY3ZDRmODJjN2UzYjA2ZGNjOGI4N2ZhZDdhGjE5ZTRkMDk4ZGM4YzYxOGY4ZDgxY2ZlYjAyAAAPAAE="} 00840{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dns_exfiltration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1580978146717,"flow_last_seen":0,"flow_tot_l4_data_len":181,"flow_min_l4_data_len":181,"flow_max_l4_data_len":181,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.220.56","dst_ip":"192.168.203.167","src_port":56373,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"16":"Suspicious DGA domain name"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"dnscat.546b03f50000000000a6023ed4df184d6ac5c2628b47714fdee584fed739.5a03b5b1e1aa8f8fdb1bbe8d5e04952141f7d4f82c7e3b06dcc8b87fad7a.19e4d098dc8c618f8d81cfeb02","num_queries":0,"num_answers":0,"reply_code":0,"query_type":15,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -21,3 +22,4 @@ 00548{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dns_exfiltration.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1580978151,"pkt_ts_usec":802508,"pkt_caplen":148,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":148,"pkt_l4_len":114,"pkt":"jNzURr7Eqqru7hERCABFAACGPjJAAD8R1APAqMunwKjcOAA13DUAckeuXxmBgAABAAEAAAAABmRuc2NhdCJmYjhiMDFmNTAwMmZjMDE3ZTYxYmRhMDAwNWQ3YTZhZWFjAAAQAAHADAAQAAEAAAA8ACMiYTYzZjAxZjUwMDc0MjhjMzBlMWMwYWZmZmZmZmQzYWE0Yg=="} 00483{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dns_exfiltration.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1580978152,"pkt_ts_usec":810482,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"qqru7hERjNzURr7ECABFAABXezVAAD8RAADAqNw4wKjLp9w1ADUAQymG420BAAABAAAAAAAABmRuc2NhdCJjNGY5MDFmNTAwNDcxY2Q2ODNlZWQwMDAwNmY5MDdmMGY0AAAPAAE="} 00779{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":255,"source":"dns_exfiltration.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":255,"flow_first_seen":1580978146717,"flow_last_seen":1580978206666,"flow_tot_l4_data_len":50136,"flow_min_l4_data_len":67,"flow_max_l4_data_len":352,"flow_avg_l4_data_len":196,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.220.56","dst_ip":"192.168.203.167","src_port":56373,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"16":"Suspicious DGA domain name"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"dnscat.a35c00f5005703c8b1b8cd000118b52347aeb1d73340c97cca43c34b27cf.edf0dbda","num_queries":1,"num_answers":1,"reply_code":0,"query_type":15,"rsp_type":15,"rsp_addr":"0.0.0.0"}} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":300,"source":"dns_exfiltration.pcap","alias":"nDPId-test"} diff --git a/test/results/dns_long_domainname.pcap.out b/test/results/dns_long_domainname.pcap.out index 0f726ceee..2a87b4136 100644 --- a/test/results/dns_long_domainname.pcap.out +++ b/test/results/dns_long_domainname.pcap.out @@ -1,5 +1,8 @@ +00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dns_long_domainname.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dns_long_domainname.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1599686652555,"flow_last_seen":0,"flow_tot_l4_data_len":69,"flow_min_l4_data_len":69,"flow_max_l4_data_len":69,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.168","dst_ip":"8.8.8.8","src_port":65311,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00488{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dns_long_domainname.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1599686652,"pkt_ts_usec":555538,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"EBMx8Tl2KDc3AG3ICABFAABZsREAAEAR9yLAqAGoCAgICP8fADUARcOpi1QBAAABAAAAAAAABmdtcjAyYwIxNgEwDGZoa2Zoc2RrZmhzawZ0dW5uZWwHZXhhbXBsZQNjb20AAAEAAQ=="} 00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dns_long_domainname.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1599686652555,"flow_last_seen":0,"flow_tot_l4_data_len":69,"flow_min_l4_data_len":69,"flow_max_l4_data_len":69,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.168","dst_ip":"8.8.8.8","src_port":65311,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Unrated","category":"Web"},"dns": {"query":"gmr02c.16.0.fhkfhsdkfhsk.tunnel.example.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00562{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"dns_long_domainname.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1599686652,"pkt_ts_usec":578187,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"KDc3AG3IEBMx8Tl2CABFAACR3WoAAHYRlJEICAgIwKgBqAA1\/x8AfQAAi1SBgwABAAAAAQAABmdtcjAyYwIxNgEwDGZoa2Zoc2RrZmhzawZ0dW5uZWwHZXhhbXBsZQNjb20AAAEAAcAsAAYAAQAABcMALAJucwVpY2FubgNvcmcAA25vYwNkbnPATHhn+r4AABwgAAAOEAASdQAAAA4Q"} 00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2,"source":"dns_long_domainname.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1599686652555,"flow_last_seen":1599686652578,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":69,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.168","dst_ip":"8.8.8.8","src_port":65311,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Unrated","category":"Web"},"dns": {"query":"gmr02c.16.0.fhkfhsdkfhsk.tunnel.example.com","num_queries":1,"num_answers":1,"reply_code":3,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"dns_long_domainname.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1599686652555,"flow_last_seen":1599686652578,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":69,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.168","dst_ip":"8.8.8.8","src_port":65311,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00138{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"dns_long_domainname.pcap","alias":"nDPId-test"} diff --git a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out index 7dcdac182..8f9d83700 100644 --- a/test/results/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/test/results/dnscrypt-v1-and-resolver-pings.pcap.out @@ -1,3 +1,4 @@ +00407{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946735705348,"flow_last_seen":0,"flow_tot_l4_data_len":520,"flow_min_l4_data_len":520,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":520,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":38388,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01099{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946735705,"pkt_ts_usec":348929,"pkt_caplen":554,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":554,"pkt_l4_len":520,"pkt":"REREREREZmZmZmZmCABFAAIcCf9AAL0Rd68KAAABlTjkLZX0AbsCCDw8f0cBAAABAAAAAAABATINZG5zY3J5cHQtY2VydAhkbnNjcnlwdARjYS0yAAAQAAEAAAAAAAAAAAABxgAMAcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} 00524{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946735705348,"flow_last_seen":0,"flow_tot_l4_data_len":520,"flow_min_l4_data_len":520,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":520,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":38388,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"DNScrypt","breed":"Safe","category":"Network"}} @@ -1248,3 +1249,235 @@ 01198{"flow_id":251,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":607,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739861,"pkt_ts_usec":286767,"pkt_caplen":618,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":618,"pkt_l4_len":584,"pkt":"REREREREZmZmZmZmCABFAAJc8z5AAGQR70UKAAABMw8+QZ7jAbsCSDRmPBQECcRLqdjK1L0mf5PIChUIPitfU3P1xdue2oSi59s41xANmFlcDEDim3A5yf0wjjkn7c0KZ99+wsaC8Q0jJNdVtRyvQ4vttz57bauXWf7aWWZI9GXe13Bq\/1R6iUwT\/A0\/zRCc0Ayq9cmcu623YyCddihLAAMnrLyfM6t6rL27MiG1nzMzmCPyF28NwS5XqwjPRfHv4CZ99g0HmhnodYUO8q68IgHhgstyCXs7D74EPnDSNCXWvxBvHIE3vRmyPvunw0teioCjIqxqULRcggjd13KNSzhv65LTFQDOYbWOCn+rymPlyEaTGV8M85qpLCbZBx+P2mZMjdPflMOxEUQrHk9kdqOlL2mWcrX2tI9xOtQuzvv+NeAjtLGeixP59GGL75pvlLSdqyad1gu\/frI3Onyk042MoSYGJ6RwV3eaPNbZQCtEwb9AOFIXBmvRH9XM7npQUXePLACdz9iCTPKnV7Kw8ctrZrqQ4N6l7ZvcAG2rUT+Q9\/LXDXqKjl09ujD68NhiQh61LzaYdfK4i7pycnU4qJoDyh6wqXlEnhJrx33Uml0q43\/LZkKq6+gBtMyFx1G0t8TXOxdVJjjFCI6asgc8Kxe6G3w1FuEYOCYdPJ1BDXSvfQyl+xvLRdx79zlvjoh3CA3lgSqjekZ4r\/nVmPAWeluQHxO36OZiUmB2ai6gs8+TK+H6\/M45c1\/tfkqR+WeZABxv3Wq+MtDzkLR1Ba9KFIEFLcYA\/aPSp26qFfnJhX4KU8kKJXh\/RvHe"} 00659{"flow_id":251,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739861,"pkt_ts_usec":499384,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"ZmZmZmZmRERERERECABFAADMBL8AADQRT1YzDz5BCgAAAQG7nuMAuKxVcjZmbnZXajhA4ptwOcn9MI45J+2cfN20Dl9sTMp3rF67X\/jDpIVgb1a+3\/m31lpJBtYvfwV0B9vwzZtjNo+jG7GftQDbJaUY\/oveZ3k2CcZHOjICUKnGXvyF5yEl+85urFpytmNQcYoVHSk5XuOkfP++TbbcrYxYsDH+x2d1Xg60pF+BeHKLrLF0X3ik2Kl1hdwwJCMdJ5w1\/ra7TZUP4kyuPD6WApR9UYb+H+3yIn0="} 00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":2,"flow_first_seen":946739861286,"flow_last_seen":946739861499,"flow_tot_l4_data_len":768,"flow_min_l4_data_len":184,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":384,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":40675,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"DNScrypt","breed":"Safe","category":"Network"}} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337184,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":39816,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305214,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":34885,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":2,"flow_first_seen":946739402188,"flow_last_seen":946739402354,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":53045,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348917,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":51647,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305192,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":37595,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312183,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":40451,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304821,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":36668,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317493,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":53117,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305329,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":43505,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400550,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":46140,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":946739305348,"flow_last_seen":946739305453,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":38388,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312406,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":47432,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348917,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":47621,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400522,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":46314,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304362,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":35005,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":2,"flow_first_seen":946739725845,"flow_last_seen":946739725874,"flow_tot_l4_data_len":832,"flow_min_l4_data_len":248,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":416,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":36746,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317431,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":47257,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":2,"flow_first_seen":946739312105,"flow_last_seen":946739312130,"flow_tot_l4_data_len":1677,"flow_min_l4_data_len":197,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":838,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":38812,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396210,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":54375,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396108,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":50277,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317428,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":37035,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":2,"flow_first_seen":946739620053,"flow_last_seen":946739620112,"flow_tot_l4_data_len":768,"flow_min_l4_data_len":184,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":384,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":37711,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396110,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":44161,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318062,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":38511,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304818,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":38867,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":2,"flow_first_seen":946739380984,"flow_last_seen":946739381021,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":51826,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396218,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":42141,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348803,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":43540,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304627,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":37950,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":2,"flow_first_seen":946739380805,"flow_last_seen":946739380844,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":40775,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317810,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":43776,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396074,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":54204,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":2,"flow_first_seen":946739318169,"flow_last_seen":946739318205,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":49040,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400551,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":40209,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304399,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":59641,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318167,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":51935,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":2,"flow_first_seen":946739615603,"flow_last_seen":946739615628,"flow_tot_l4_data_len":896,"flow_min_l4_data_len":312,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":448,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":60393,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317822,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":52069,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304821,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":39007,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312400,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":55896,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":2,"flow_first_seen":946739318169,"flow_last_seen":946739318200,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":49115,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":2,"flow_first_seen":946739719617,"flow_last_seen":946739719664,"flow_tot_l4_data_len":1010,"flow_min_l4_data_len":426,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":505,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":59812,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337076,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":45375,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396071,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":54305,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":2,"flow_first_seen":946739317432,"flow_last_seen":946739317461,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"176.56.237.171","src_port":55046,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304362,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":53697,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311314,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":38278,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396109,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":38242,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":2,"flow_first_seen":946739402187,"flow_last_seen":946739402352,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":59587,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306435,"flow_tot_l4_data_len":1807,"flow_min_l4_data_len":327,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":903,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":41800,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318171,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":54096,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312103,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":52911,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":946739720236,"flow_last_seen":946739720266,"flow_tot_l4_data_len":832,"flow_min_l4_data_len":248,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":416,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":45234,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348800,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":45815,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":2,"flow_first_seen":946739317432,"flow_last_seen":946739317462,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"176.56.237.171","src_port":36676,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396073,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":48237,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311310,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":38349,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304361,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":37413,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_first_seen":946739317432,"flow_last_seen":946739317463,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"176.56.237.171","src_port":49008,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305189,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":50335,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348912,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":41895,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305220,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":53811,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396071,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":48300,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400520,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":54920,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337077,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":55768,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":946739305327,"flow_last_seen":946739305384,"flow_tot_l4_data_len":571,"flow_min_l4_data_len":51,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":285,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":57465,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400518,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":56988,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396215,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":36335,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305218,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":33369,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304821,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":59709,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":2,"flow_first_seen":946739727013,"flow_last_seen":946739727039,"flow_tot_l4_data_len":768,"flow_min_l4_data_len":184,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":384,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":33089,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":2,"flow_first_seen":946739391046,"flow_last_seen":946739391308,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":50601,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312407,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":35634,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304810,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":43365,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_first_seen":946739305328,"flow_last_seen":946739305354,"flow_tot_l4_data_len":571,"flow_min_l4_data_len":51,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":285,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":55482,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400553,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":50757,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":2,"flow_first_seen":946739617004,"flow_last_seen":946739617027,"flow_tot_l4_data_len":832,"flow_min_l4_data_len":248,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":416,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":50443,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312399,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":54112,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":2,"flow_first_seen":946739337184,"flow_last_seen":946739337214,"flow_tot_l4_data_len":723,"flow_min_l4_data_len":203,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":361,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"5.189.170.196","src_port":35734,"dst_port":465,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305326,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":52284,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318175,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":35903,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312179,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":43129,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304628,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":34324,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337078,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":53887,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305214,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":47865,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337183,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":38508,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348805,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":48159,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304397,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":39655,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":2,"flow_first_seen":946739317432,"flow_last_seen":946739317461,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"176.56.237.171","src_port":51363,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318170,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":40138,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318168,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":50387,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400553,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":57109,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":2,"flow_first_seen":946739380983,"flow_last_seen":946739381016,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":50403,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304788,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":43609,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":2,"flow_first_seen":946739318168,"flow_last_seen":946739318202,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":37328,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400519,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":59354,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312105,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":55409,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337077,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":49975,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348915,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":46363,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317493,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":60091,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318061,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":57636,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":2,"flow_first_seen":946739318169,"flow_last_seen":946739318201,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":33279,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317432,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":60334,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312405,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":40099,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":2,"flow_first_seen":946739402188,"flow_last_seen":946739402356,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":60113,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317434,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":48065,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":2,"flow_first_seen":946739312105,"flow_last_seen":946739312136,"flow_tot_l4_data_len":717,"flow_min_l4_data_len":197,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":43714,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304815,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":45767,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396214,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":55185,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304793,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":56043,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311308,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":38879,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306435,"flow_tot_l4_data_len":847,"flow_min_l4_data_len":327,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":423,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":38283,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":2,"flow_first_seen":946739312105,"flow_last_seen":946739312132,"flow_tot_l4_data_len":1677,"flow_min_l4_data_len":197,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":838,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":33521,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317432,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":46066,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":2,"flow_first_seen":946739305349,"flow_last_seen":946739305459,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":35228,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":946739299327,"flow_last_seen":946739299356,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"62.210.180.71","src_port":52636,"dst_port":1053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305217,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":44093,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":2,"flow_first_seen":946739611961,"flow_last_seen":946739612032,"flow_tot_l4_data_len":960,"flow_min_l4_data_len":376,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":480,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":47545,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318059,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":45497,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337079,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":39910,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":2,"flow_first_seen":946739312286,"flow_last_seen":946739312401,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"66.85.30.115","src_port":48448,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396113,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":49177,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":2,"flow_first_seen":946739614386,"flow_last_seen":946739614411,"flow_tot_l4_data_len":832,"flow_min_l4_data_len":248,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":416,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":38660,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304791,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":56177,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348804,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":44469,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":2,"flow_first_seen":946739305327,"flow_last_seen":946739305351,"flow_tot_l4_data_len":1531,"flow_min_l4_data_len":51,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":765,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":56022,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305330,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":60962,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304629,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":59367,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305194,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":59194,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":2,"flow_first_seen":946739380983,"flow_last_seen":946739381015,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":46646,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":2,"flow_first_seen":946739391046,"flow_last_seen":946739391308,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":59400,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":2,"flow_first_seen":946739380983,"flow_last_seen":946739381016,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":58948,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306435,"flow_tot_l4_data_len":1807,"flow_min_l4_data_len":327,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":903,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":56902,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":2,"flow_first_seen":946739312105,"flow_last_seen":946739312133,"flow_tot_l4_data_len":717,"flow_min_l4_data_len":197,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":45993,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":2,"flow_first_seen":946739317403,"flow_last_seen":946739317429,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.166.97","src_port":56494,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337184,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":36930,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304626,"flow_tot_l4_data_len":707,"flow_min_l4_data_len":187,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":32793,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":2,"flow_first_seen":946739337184,"flow_last_seen":946739337214,"flow_tot_l4_data_len":723,"flow_min_l4_data_len":203,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":361,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"5.189.170.196","src_port":44496,"dst_port":465,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317496,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":52221,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304360,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":50435,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":946739305192,"flow_last_seen":946739305220,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":44282,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318063,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":195,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":47729,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318059,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":53876,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":2,"flow_first_seen":946739318061,"flow_last_seen":946739318164,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.205.47","src_port":59011,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":2,"flow_first_seen":946739380804,"flow_last_seen":946739380834,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":52056,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":2,"flow_first_seen":946739305348,"flow_last_seen":946739305457,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":45722,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":2,"flow_first_seen":946739305348,"flow_last_seen":946739305460,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":35495,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348805,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":38482,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":2,"flow_first_seen":946739305327,"flow_last_seen":946739305349,"flow_tot_l4_data_len":571,"flow_min_l4_data_len":51,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":285,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":50035,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312102,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":55834,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337188,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":59589,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306434,"flow_tot_l4_data_len":1807,"flow_min_l4_data_len":327,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":903,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":50913,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312105,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":47685,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317494,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":52356,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":2,"flow_first_seen":946739318169,"flow_last_seen":946739318202,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":54215,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305331,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":46856,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":2,"flow_first_seen":946739380984,"flow_last_seen":946739381017,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":57090,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":2,"flow_first_seen":946739317432,"flow_last_seen":946739317460,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"176.56.237.171","src_port":41717,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":2,"flow_first_seen":946739305349,"flow_last_seen":946739305461,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":33565,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304806,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":46229,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304628,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":37123,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":946739299327,"flow_last_seen":946739299355,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"62.210.180.71","src_port":51004,"dst_port":1053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312105,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":55979,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":2,"flow_first_seen":946739318038,"flow_last_seen":946739318061,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":195,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"151.80.222.79","src_port":52040,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305187,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":59476,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396216,"flow_tot_l4_data_len":1680,"flow_min_l4_data_len":200,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":840,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":33143,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":2,"flow_first_seen":946739380805,"flow_last_seen":946739380837,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":56335,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348913,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":59224,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":2,"flow_first_seen":946739348805,"flow_last_seen":946739348916,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":57180,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400550,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":49568,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":2,"flow_first_seen":946739318169,"flow_last_seen":946739318200,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.191.187.107","src_port":35885,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":2,"flow_first_seen":946739402188,"flow_last_seen":946739402357,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":34024,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":2,"flow_first_seen":946739312402,"flow_last_seen":946739312464,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"93.95.226.165","src_port":42156,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":2,"flow_first_seen":946739312402,"flow_last_seen":946739312463,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"93.95.226.165","src_port":46255,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312181,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":45987,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317829,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":55267,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":2,"flow_first_seen":946739396111,"flow_last_seen":946739396216,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"107.170.57.34","src_port":37287,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":2,"flow_first_seen":946739337048,"flow_last_seen":946739337078,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":38310,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":2,"flow_first_seen":946739305327,"flow_last_seen":946739305348,"flow_tot_l4_data_len":1531,"flow_min_l4_data_len":51,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":765,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":40009,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":946739304628,"flow_last_seen":946739304804,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"41.79.69.13","src_port":38136,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312178,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":41913,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":2,"flow_first_seen":946739305349,"flow_last_seen":946739305457,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":60301,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396069,"flow_tot_l4_data_len":1671,"flow_min_l4_data_len":191,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":41108,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":2,"flow_first_seen":946739348756,"flow_last_seen":946739348800,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":38709,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304396,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":44491,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":2,"flow_first_seen":946739396047,"flow_last_seen":946739396074,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"144.91.106.227","src_port":55469,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311306,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":43528,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":2,"flow_first_seen":946739337184,"flow_last_seen":946739337218,"flow_tot_l4_data_len":723,"flow_min_l4_data_len":203,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":361,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"5.189.170.196","src_port":40748,"dst_port":465,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311312,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":55822,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396109,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":33246,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312179,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":46063,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":2,"flow_first_seen":946739312132,"flow_last_seen":946739312180,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":37890,"dst_port":4343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317496,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":58740,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":2,"flow_first_seen":946739312106,"flow_last_seen":946739312136,"flow_tot_l4_data_len":717,"flow_min_l4_data_len":197,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":60735,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":2,"flow_first_seen":946739311153,"flow_last_seen":946739311313,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"205.185.116.116","src_port":51770,"dst_port":553,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305189,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":47341,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":2,"flow_first_seen":946739396070,"flow_last_seen":946739396107,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.55","src_port":33293,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":2,"flow_first_seen":946739400522,"flow_last_seen":946739400551,"flow_tot_l4_data_len":720,"flow_min_l4_data_len":200,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":360,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"77.66.84.233","src_port":49732,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":2,"flow_first_seen":946739312105,"flow_last_seen":946739312132,"flow_tot_l4_data_len":1677,"flow_min_l4_data_len":197,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":838,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":56688,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":2,"flow_first_seen":946739402188,"flow_last_seen":946739402356,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":60852,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337186,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":45613,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306434,"flow_tot_l4_data_len":847,"flow_min_l4_data_len":327,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":423,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":59489,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317825,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":43224,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_first_seen":946739304789,"flow_last_seen":946739304821,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.122.250","src_port":38362,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304393,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":56997,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304394,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":44712,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400522,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":188,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":834,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":47971,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":2,"flow_first_seen":946739391046,"flow_last_seen":946739391306,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":45682,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":2,"flow_first_seen":946739400460,"flow_last_seen":946739400519,"flow_tot_l4_data_len":708,"flow_min_l4_data_len":188,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.193.127.244","src_port":50062,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304369,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":55123,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305326,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":32970,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":2,"flow_first_seen":946739337078,"flow_last_seen":946739337190,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":45747,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317819,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":59707,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":2,"flow_first_seen":946739380804,"flow_last_seen":946739380834,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":34228,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_first_seen":946739312402,"flow_last_seen":946739312466,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":191,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"93.95.226.165","src_port":58936,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":2,"flow_first_seen":946739380805,"flow_last_seen":946739380838,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":60885,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":2,"flow_first_seen":946739317496,"flow_last_seen":946739317819,"flow_tot_l4_data_len":710,"flow_min_l4_data_len":190,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":51589,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":946739304599,"flow_last_seen":946739304626,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":56035,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":2,"flow_first_seen":946739380804,"flow_last_seen":946739380832,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"212.47.228.136","src_port":38371,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":2,"flow_first_seen":946739305219,"flow_last_seen":946739305326,"flow_tot_l4_data_len":1674,"flow_min_l4_data_len":194,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":837,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"142.4.204.111","src_port":33071,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":2,"flow_first_seen":946739317462,"flow_last_seen":946739317496,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"178.216.201.222","src_port":38594,"dst_port":2053,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":946739304363,"flow_last_seen":946739304396,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.238.186.192","src_port":59261,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":2,"flow_first_seen":946739380984,"flow_last_seen":946739381017,"flow_tot_l4_data_len":1667,"flow_min_l4_data_len":187,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":833,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":39259,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":2,"flow_first_seen":946739306241,"flow_last_seen":946739306433,"flow_tot_l4_data_len":847,"flow_min_l4_data_len":327,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":423,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":49512,"dst_port":1443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":946739305155,"flow_last_seen":946739305191,"flow_tot_l4_data_len":1670,"flow_min_l4_data_len":190,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":835,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.59.200.116","src_port":43633,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":2,"flow_first_seen":946739660371,"flow_last_seen":946739660417,"flow_tot_l4_data_len":976,"flow_min_l4_data_len":392,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":488,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":40958,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":946739304328,"flow_last_seen":946739304367,"flow_tot_l4_data_len":714,"flow_min_l4_data_len":194,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":357,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":59405,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":2,"flow_first_seen":946739402188,"flow_last_seen":946739402354,"flow_tot_l4_data_len":712,"flow_min_l4_data_len":192,"flow_max_l4_data_len":520,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"23.111.74.205","src_port":44793,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":2,"flow_first_seen":946739861286,"flow_last_seen":946739861499,"flow_tot_l4_data_len":768,"flow_min_l4_data_len":184,"flow_max_l4_data_len":584,"flow_avg_l4_data_len":384,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.62.65","src_port":40675,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00511{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":946739311802,"flow_last_seen":946739312103,"flow_tot_l4_data_len":1672,"flow_min_l4_data_len":192,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":836,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"52.65.235.129","src_port":46313,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":2,"flow_first_seen":946739305327,"flow_last_seen":946739305350,"flow_tot_l4_data_len":1531,"flow_min_l4_data_len":51,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":765,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.112.112.10","src_port":42570,"dst_port":8443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00151{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":608,"source":"dnscrypt-v1-and-resolver-pings.pcap","alias":"nDPId-test"} diff --git a/test/results/dnscrypt-v2-doh.pcap.out b/test/results/dnscrypt-v2-doh.pcap.out index 0c3a58dee..20123fc38 100644 --- a/test/results/dnscrypt-v2-doh.pcap.out +++ b/test/results/dnscrypt-v2-doh.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946739298533,"flow_last_seen":0,"flow_tot_l4_data_len":303,"flow_min_l4_data_len":303,"flow_max_l4_data_len":303,"flow_avg_l4_data_len":303,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":53674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00800{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739298,"pkt_ts_usec":533748,"pkt_caplen":337,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":337,"pkt_l4_len":303,"pkt":"REREREREZmZmZmZmCABFAAFD4UdAAL0GsQQKAAABi2PeSNGqAbt5f9qX6vvArlAYAfYrngAAFgMBARYBAAESAwPY4R+kmwrmRkwkOvmL20MZvvmmXV\/QYaA6X4C5e+GFvyA2SDuI+F1GOq7qyiEw+aePhhElQVpDVzMYXSdiyok3WQAmwC\/AMMArwCzMqMypwBPACcAUwAoAnACdAC8ANcASAAoTARMDEwIBAACjAAAAEgAQAAANZG9oLTIuc2VieS5pbwAFAAUBAAAAAAAKAAoACAAdABcAGAAZAAsAAgEAAA0AGgAYCAQEAwgHCAUIBgQBBQEGAQUDBgMCAQID\/wEAAQAAEAAOAAwCaDIIaHR0cC8xLjEAEgAAACsACQgDBAMDAwIDAQAzACYAJAAdACA0hS9OEA\/J5twwMByNtSlpgrCPJW9Ooqwd+S9NxEdaCw=="} 00770{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946739298533,"flow_last_seen":0,"flow_tot_l4_data_len":303,"flow_min_l4_data_len":303,"flow_max_l4_data_len":303,"flow_avg_l4_data_len":303,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":53674,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.DoH_DoT","breed":"Fun","category":"Network"},"tls": {"version":"TLSv1.2","client_requested_server_name":"doh-2.seby.io","ja3":"d0ee3237a14bbd89ca4d2b5356ab20ba","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} @@ -584,3 +585,38 @@ 00808{"flow_id":34,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":575,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739879,"pkt_ts_usec":797498,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"ZmZmZmZmRERERERECABFAAFIIhpAADcGnMXR+vEZCgAAAQG7i56PZEchBaQGQ1AYAfXh1wAAFwMDARvtN4hu+Wj5UmDU\/NMvzW4ZaZqdIfuvzN649M3dg1IslZuV497wZdEWN18SPWfNvNW8q4xHtzKTRCxZAREEWQlp4nWAChN9Hf0WxJtC4IwpmzNwtcEChHWK9OqnFadz54IjXtGIgyjPtiP9fPB2F8WZ5zS+xv6fFfbEDAHBnShO4sPY76jns+QN2mo17OrzBGKkRb9cfJAt3iMizwZUpOlQOP2GiA85Nvlo6Yb9YkROjwvoZdV9nxmOZsEFjMzRr4OgXqZov\/LdhkmpLzhTBsID8buM\/NdEZejpGf0vO4i4denS\/k8t04Fc8guOCMoh6UEz6cm3PEl+vJqH8CPXw5T1kX6wZ8C7qcgMbHakCiCtWYQ2ONg2qedqPksX"} 00474{"flow_id":34,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":576,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739879,"pkt_ts_usec":797870,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"REREREREZmZmZmZmCABFAABScK5AAGQGIicKAAAB0frxGYueAbsFpAZDj2RIQVAYAfWEFQAAFwMDACUAAAAAAAAABVhjIGTs+\/AOgfYG19x5nx37HUS1BlwfDA6hyRYj"} 00461{"flow_id":34,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946739888,"pkt_ts_usec":204388,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"REREREREZmZmZmZmCABFAABHcK9AAGQGIjEKAAAB0frxGYueAbsFpAZtj2RIQlAYAfWECgAAFQMDABoAAAAAAAAABvrFh2UDsPRtvqC2sowvAB5faw=="} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":18,"flow_first_seen":946739400702,"flow_last_seen":946739407673,"flow_tot_l4_data_len":5927,"flow_min_l4_data_len":51,"flow_max_l4_data_len":2068,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":35714,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":22,"flow_first_seen":946739312203,"flow_last_seen":946739327905,"flow_tot_l4_data_len":5556,"flow_min_l4_data_len":44,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":252,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"116.203.179.248","src_port":41720,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":14,"flow_first_seen":946739879619,"flow_last_seen":946739888204,"flow_tot_l4_data_len":5165,"flow_min_l4_data_len":51,"flow_max_l4_data_len":2068,"flow_avg_l4_data_len":368,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"209.250.241.25","src_port":35742,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":20,"flow_first_seen":946739389936,"flow_last_seen":946739420902,"flow_tot_l4_data_len":7077,"flow_min_l4_data_len":44,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":353,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.76.113.31","src_port":52028,"dst_port":8443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":16,"flow_first_seen":946739390933,"flow_last_seen":946739421078,"flow_tot_l4_data_len":5644,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3131,"flow_avg_l4_data_len":352,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"217.169.20.23","src_port":34036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":17,"flow_first_seen":946739311566,"flow_last_seen":946739327918,"flow_tot_l4_data_len":6769,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":398,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.134.196.55","src_port":55322,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":15,"flow_first_seen":946739336955,"flow_last_seen":946739364937,"flow_tot_l4_data_len":6081,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":405,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.233.106.232","src_port":46658,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":18,"flow_first_seen":946739378577,"flow_last_seen":946739410674,"flow_tot_l4_data_len":5436,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2523,"flow_avg_l4_data_len":302,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.28.28.34","src_port":33724,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":16,"flow_first_seen":946739305650,"flow_last_seen":946739328075,"flow_tot_l4_data_len":6196,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2214,"flow_avg_l4_data_len":387,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"172.104.93.80","src_port":40938,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":17,"flow_first_seen":946739304846,"flow_last_seen":946739327879,"flow_tot_l4_data_len":6365,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3151,"flow_avg_l4_data_len":374,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.158.147.50","src_port":55962,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":24,"flow_first_seen":946739310980,"flow_last_seen":946739321153,"flow_tot_l4_data_len":6132,"flow_min_l4_data_len":51,"flow_max_l4_data_len":3023,"flow_avg_l4_data_len":255,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.43.135.1","src_port":38186,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":15,"flow_first_seen":946739317842,"flow_last_seen":946739327879,"flow_tot_l4_data_len":6292,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":419,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"195.30.94.28","src_port":60026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":17,"flow_first_seen":946739402059,"flow_last_seen":946739432187,"flow_tot_l4_data_len":6815,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"46.227.200.54","src_port":57058,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":16,"flow_first_seen":946739354159,"flow_last_seen":946739364932,"flow_tot_l4_data_len":5583,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3134,"flow_avg_l4_data_len":348,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.235.81.1","src_port":44640,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":17,"flow_first_seen":946739380697,"flow_last_seen":946739410804,"flow_tot_l4_data_len":5584,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2858,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"1.0.0.1","src_port":53802,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":17,"flow_first_seen":946739400581,"flow_last_seen":946739430677,"flow_tot_l4_data_len":5685,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":334,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"193.70.85.11","src_port":54164,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":16,"flow_first_seen":946739400294,"flow_last_seen":946739430460,"flow_tot_l4_data_len":5357,"flow_min_l4_data_len":21,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":334,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"146.255.56.98","src_port":43718,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":13,"flow_first_seen":946739661512,"flow_last_seen":946739691599,"flow_tot_l4_data_len":5030,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3134,"flow_avg_l4_data_len":386,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.235.81.1","src_port":44704,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":17,"flow_first_seen":946739374011,"flow_last_seen":946739404206,"flow_tot_l4_data_len":5852,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3145,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"116.202.176.26","src_port":43106,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":17,"flow_first_seen":946739311335,"flow_last_seen":946739327906,"flow_tot_l4_data_len":5468,"flow_min_l4_data_len":44,"flow_max_l4_data_len":1582,"flow_avg_l4_data_len":321,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"9.9.9.10","src_port":51770,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":12,"flow_first_seen":946739603327,"flow_last_seen":946739633413,"flow_tot_l4_data_len":4845,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3034,"flow_avg_l4_data_len":403,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"9.9.9.10","src_port":51846,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":18,"flow_first_seen":946739401864,"flow_last_seen":946739432023,"flow_tot_l4_data_len":7232,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":401,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"95.216.229.153","src_port":43888,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":18,"flow_first_seen":946739311703,"flow_last_seen":946739327879,"flow_tot_l4_data_len":5898,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":327,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"51.15.124.208","src_port":52386,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":23,"flow_first_seen":946739378281,"flow_last_seen":946739408545,"flow_tot_l4_data_len":6994,"flow_min_l4_data_len":26,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":304,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"85.5.93.230","src_port":59026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":16,"flow_first_seen":946739385090,"flow_last_seen":946739415188,"flow_tot_l4_data_len":5594,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3136,"flow_avg_l4_data_len":349,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"136.144.215.158","src_port":52176,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":21,"flow_first_seen":946739380870,"flow_last_seen":946739411017,"flow_tot_l4_data_len":5067,"flow_min_l4_data_len":44,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.90.28.0","src_port":33338,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":946739298533,"flow_last_seen":946739298798,"flow_tot_l4_data_len":3157,"flow_min_l4_data_len":50,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":789,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":53674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":946739299058,"flow_last_seen":946739299326,"flow_tot_l4_data_len":3155,"flow_min_l4_data_len":50,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":788,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"139.99.222.72","src_port":53676,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":19,"flow_first_seen":946739348407,"flow_last_seen":946739365024,"flow_tot_l4_data_len":5744,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3118,"flow_avg_l4_data_len":302,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"149.56.228.45","src_port":36012,"dst_port":453,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":20,"flow_first_seen":946739310588,"flow_last_seen":946739327990,"flow_tot_l4_data_len":5802,"flow_min_l4_data_len":44,"flow_max_l4_data_len":3120,"flow_avg_l4_data_len":290,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"167.114.220.125","src_port":37530,"dst_port":453,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":946739304432,"flow_last_seen":946739327879,"flow_tot_l4_data_len":8783,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":292,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.95.218.42","src_port":50614,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":18,"flow_first_seen":946739385216,"flow_last_seen":946739415379,"flow_tot_l4_data_len":5059,"flow_min_l4_data_len":44,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":281,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"104.28.0.106","src_port":39214,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":15,"flow_first_seen":946739348961,"flow_last_seen":946739364914,"flow_tot_l4_data_len":5760,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":384,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"45.153.187.96","src_port":38018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":17,"flow_first_seen":946739305016,"flow_last_seen":946739327879,"flow_tot_l4_data_len":5856,"flow_min_l4_data_len":44,"flow_max_l4_data_len":2924,"flow_avg_l4_data_len":344,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"185.253.154.66","src_port":59404,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":577,"source":"dnscrypt-v2-doh.pcap","alias":"nDPId-test"} diff --git a/test/results/doq.pcapng.out b/test/results/doq.pcapng.out index cdf11c863..621b8efbe 100644 --- a/test/results/doq.pcapng.out +++ b/test/results/doq.pcapng.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"doq.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00459{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"doq.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1606056093199,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":47826,"dst_port":784,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02094{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"doq.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1606056093,"pkt_ts_usec":199591,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"AAAAAAAAAAAAAAAAht1gJqqiBNgRQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAButIDEATYBOvN\/wAAIAhwsYltsps+WghOL+O5iCYx+QBEtgiJINLAj38+CB9CqAWNGDJ\/Ht0GdZPYPfPv0gkn+G7KypaOwXpeaLqP2vrcKno6\/xJHt9kjbL2TY4b\/m9R6nztt0oBs85JJhS7Tj\/KxdnJUR5x1KoMSoiK8Up0wKQjS6CJwz+096+5cglByj68BpzrUHMPeI6GM8BR\/Wl2qjunMufbT3ODI125lDdGTaTqNLCMEIjagI12Vrkh1+4q55QnPNmDSc9uNkJ0l5bhH58Gr3GA8HfFg35RCENcGDFpWMYVXiM4ZLQRFPmW9PqqUvAkPFdK1\/e6zKceMIWl6qFwaRZM+da6dEGVcJjr7Z+tAEETRp6uqCb9nnpAvg2AYmEND50nvVEnJ0vebAvnDE4IogXJzua2gFwFm7VLYd1uL79o4iJgu\/rwI3t1+Scpc6iAB46mZWFz3fE1WDQxwSMiil9o8+U4JW1BkjaBlJjEwDLig1LbtT\/HP47m8JDRgq00wdO+B2e1saSoPUtzWH02fRpSsRwHLssxWK\/GeM8n4na9wb14wVoOdjdGJ+KEHpdBBYTSNse3PnwWrKaaP0mh7odZYLBlgeNvTBLAUy7TPWKcxmhtN6bsS\/Yjh2568CzWxz8tWmprG6YblEP1vhUU2WDKbQBSh9+e7EH2JaN6LGpgUM6\/yeDE+g\/QCDKFbnXJHaC3VNe2EpDTrUSTzTJX2ScnDPI4dI01EvvWXSfxAJzcCmkKAUz3B\/F3DS8bS2lYESb9nSox1FCQUX1S8MhWCL4jSZ4wobqLA6VEQ7puZt\/yd5mc0snO7+JferPZwSQV1jN5hdBcuNb6kj\/JG4pzUoB7QTPQcjcnBLCPQDWDzw3nQ+Ebywtgt9T0aEFqJVOTfT95bWTz6VinV\/brwfnTHpSbkUgeBvFyaDcSzRz5tFZ0q4\/gUbfajms9qKrPFsufIU5NQtKyl5gUxP+4xC0KsglyEqg4DVy8vzlOpHC9Zo8AzpD2Cd9yZUaVpS3jLxre91YlfpTBViFMhAAL1N+wl47YhA2pgyB2GGbWg1O6K4C74tiA9XM\/lrGlbtuiyqqRmlQ+OfACiiCT0\/fwnridhEP9NjW3A9LNkp5ph6u81Z1emHsIGmFkXyP7nojGy2XKkTHlNA+eKBGol\/TUgCzHu7qPwHu5vMLlk5NNq3Od8+eHViQU1LY+OXeYFHuY2S+VSf848yXn0P1WZ\/Hf4jpB8WMcPpj0cXHyY46IsajmZ4uRB40h68eDc26RMlrZAfwBIGjks8KSh5b2f1BdJ6LJ4taZkNl8x+qPVYwRdc+lJsRkcGfu+BxMBIzhOPr2wg8uauRqGpIMGiSEXt5eLhu3VHEqTuhLQrFWRwEWEm+WzY4itmVZYx3CM7zWu6j3KhN5W5HEWKe61AmbunEuzKrb9KKf1hG4Uz72IU4aUy8+qV8fLyqPe7E\/Hm\/QiosHbq0whMHw6xHc0E9dDFb7\/w2jqW\/bhRCLrrZSTu8KDShAe9bkemwaFOWgs8zleXJrozrnvcOKNBpToZAop8FcA1V6SZ+05avECZK7qQ04Uc8xlehoG+3W27ZNgeNIiTH8MtU0A5kV6veOOCPQW7GGwaBK9iuORoisN7YKGMwzzN0ZIQ\/IailJpjg=="} 00715{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"doq.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1606056093199,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":47826,"dst_port":784,"l4_proto":"udp","ndpi": {"flow_risk": {"24":"SNI TLS extension was missing"},"proto":"QUIC.DoH_DoT","breed":"Fun","category":"Network"},"quic": {"version":"TLSv1.3","alpn":"doq-i00","ja3":"c0ce40fbb78cbf86a14e6a38b26d6ede","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft),TLSv1.3 (draft),TLSv1.3 (draft)"}} @@ -22,3 +23,6 @@ 00599{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"doq.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1606056094,"pkt_ts_usec":761968,"pkt_caplen":195,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":195,"pkt_l4_len":141,"pkt":"AAAAAAAAAAAAAAAAht1gAryMAI06QAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAQRDyQAAAABgJPSDAF0RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAxC60gBdAHBDTi\/juYgmMflRQ+5iHRbV0PH6VAD4ThaqZ1CAONxwoz6WhjCyy3b7S1XIRkGal+nrRIME3nHuB4Ws4VB9TKvtbvdiy1ZVtUUE7G\/BOwkfFiH9M8cl"} 00534{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"doq.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1606056096,"pkt_ts_usec":363686,"pkt_caplen":147,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":147,"pkt_l4_len":93,"pkt":"AAAAAAAAAAAAAAAAht1gJPSDAF0RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAxC60gBdAHBRTi\/juYgmMfk7fzjw3Vkk9LKBWcCW8JCljapCgvuQGIA4MlTOIZaNPxeCLfwxGo8OzSiugSvTVy7BU3rCif4Dtc3ePYXiNIKKXsDwOeyqUoLvTo8o"} 00598{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"doq.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1606056096,"pkt_ts_usec":363710,"pkt_caplen":195,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":195,"pkt_l4_len":141,"pkt":"AAAAAAAAAAAAAAAAht1gAryMAI06QAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAQT2OQAAAABgJPSDAF0RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAxC60gBdAHBRTi\/juYgmMfk7fzjw3Vkk9LKBWcCW8JCljapCgvuQGIA4MlTOIZaNPxeCLfwxGo8OzSiugSvTVy7BU3rCif4Dtc3ePYXiNIKKXsDwOeyqUoLvTo8o"} +00439{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"doq.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1606056093260,"flow_last_seen":1606056096363,"flow_tot_l4_data_len":846,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"doq.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":14,"flow_first_seen":1606056093199,"flow_last_seen":1606056096363,"flow_tot_l4_data_len":4032,"flow_min_l4_data_len":63,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":288,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":47826,"dst_port":784,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"doq.pcapng","alias":"nDPId-test"} diff --git a/test/results/doq_adguard.pcapng.out b/test/results/doq_adguard.pcapng.out index 058707867..ab47071ce 100644 --- a/test/results/doq_adguard.pcapng.out +++ b/test/results/doq_adguard.pcapng.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"doq_adguard.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"doq_adguard.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1608278425043,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"94.140.14.14","src_port":41070,"dst_port":784,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02073{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"doq_adguard.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1608278425,"pkt_ts_usec":43144,"pkt_caplen":1274,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1274,"pkt_l4_len":1240,"pkt":"CL6sCxdumt9Y+uvcCABFAATsXYdAAEARno7AqAypXowODqBuAxAE2E0Zwf8AAB0S1uV91ARNGaKcpPbuz4JRKRijEV3+fOp1xbl+o2VPCxw5C7F1AESjjIExuU1VGYMi3qR5FgZXmV5jW\/GS3bvPGESTCXlAOuaNPS4Z9rqb5GmZjOPu5h+dEeHCBQsH0bRQhppRcffIYyvfvxi5LNyq540e1YcNLgxwEYv9mwEEutsUSgLF8qQi1vATlbVLiQwhaXITCRD653klYnm9BoO04fUR8kaaf1qYfex026282Q5EvztDSyWuA6xW\/3D3I27VAQo2GbCoqYf0QIrZOfacQartZRA3xvw5C0Iz0S7jBboiOrSPOxbet7b4p4CBzdW+POAUSVXQZZS3xQkY5PXEeYGco5aUsp3O0lAaLfFFVll\/srPVtdJxYLG5mlTKam3NxBl9gHT9gkoJzUoEmtdaRDaxhP5yiedQs+JgoW4F1fDqHPMPnBtk1UezjBjE\/COENcHIEQq2HIfbQ9Lv+kS5CfcaSKs2mUQTuvs7\/voDRF2y7TFb+uqyMeAqq3doSDMB2jHa\/EojP\/f+RrMNy\/X7kDEEcbw43eMXD1tzHjBj\/ncaLMsfP3IPyZyF35MF8e+053ploy3mGcl5fW5eZxUFM6FDjn\/9\/9yB7HR5pdMyplGzzI1OpdByhfvbVWjVUlFgtm4LcbCFS9YXIuJWVQaT92LVmTrycmBpec\/NHPi6MerrZrFPH1cWAKJm6C\/35hd09a7vURbcj2Nwu+wvQEGek3M9LNpTgKAxfeLa6jR7yY8FRi9Fslx+40aTEwGgLY10PqSAVV873bY1HrjXgee+hInU5OzwDGisUkG1vjenUqCdXtWODZ9xJFrjxkNSBVsfWyX84bL4AH0cHSMH3bXpv8DZGk6dvuB1thnl5dRd79ArhxOkLRjIKU\/spE2xAqe+laOg7FDuovO8+vb44+p0a1tCIq75DbW5Z\/3eQHDpNFbf\/ZruNBwv0I6n5NxcgHEUQaffXIlX36W8Z8AD3YDD85hA4jZxmySge94o03q\/ZMGs+bJTnaK8KlLmSNMXuFjJ7F4SdWbAr+gE3KQqFqqYY9ZfiG2QbB9\/YTG+8SQBafYwX6k2J2OEpMyUilzmDTz3a5eH47iPLgq2nb2F+k0c4RMx6bB8xhJbOXMxEbB5OktMbojYZ5\/D7JZ6FArciEMMkyFIwplniDv\/bjNCRjIZzGWltVCRAQBZZf0ds2kXzLEOIGMUpx2oFRtwDgwesKJgy9be1woTT3HVmrfv8vUkkFOD253UN9bBIfIU4elVEm8DEZ93RQ8PGCnqpWPqKVclryY+VrRX6bBv\/eydiZowniNJyXmSTkGKfOGX30rdpMaFIjV9VAFWlq4kC1zIbyb3K46JC+I+XxrKEmMLqMbO6CesmtgLUC8vVTv7LWODOF1NIRzdEgb8Qn\/9qSY3t6c\/zKgfF8YyVeS6jf5EL3te6RDnB0wZsaBklSDaR66VSY+qB2O5PnaefdIKM\/htIG2nKmWB0tq+\/dxdUHWEvheHhEbmX4TUB3cfXIIesE+zpUW6KXqwY94WHHPEMe6voxs49AJ\/2IZiFohwbn6CjrWd2PilA\/\/N7kVyw58ilFGWokoGNIRgJ61vUDU8rgEdxFK12mR1bebXKhOpf+Sf7ekcBE2R4BLb6ThrQxQ="} 00692{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"doq_adguard.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1608278425043,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"94.140.14.14","src_port":41070,"dst_port":784,"l4_proto":"udp","ndpi": {"proto":"QUIC.DoH_DoT","breed":"Fun","category":"Network"},"quic": {"client_requested_server_name":"dns.adguard.com","version":"TLSv1.3","alpn":"doq-i00","ja3":"1e022f87823477abd6a79c31d70062d7","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 02084{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"doq_adguard.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1608278425,"pkt_ts_usec":433118,"pkt_caplen":1284,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1284,"pkt_l4_len":1250,"pkt":"mt9Y+uvcCL6sCxduCABFAAT2AbsAAD8RO1FejA4OwKgMqQMQoG4E4gBv5f8AAB0RXf586nXFuX6jZU8LHDkLsXUECv0qRES8jklNSP9hrfN4jT\/oyQHcSv678Q3HxgKkoiWZGDaBC9fuLqj43rzFbUWPQXOctpekdVNsG+sw2+UDf+j5N4NVeHiTBwygNKR87tBG6VGF+xe7HUhOzSJVrsJerfW8g2boHf63jFMqMCOX4mIJinnpnqF39WJH3QI7MUjoh2OjVCdRNsiqtu+BaNmL4A7qsIG9L1EcW4FcHFZWf74VHYFFpX5GBMd3DtHQ\/k7N+PRhSDjEBQEpBnpxNvfdpUkdr8+rJiuWCgKnaOhMoEaKk8bZqYDW5EtRRNEc1JJhGljj9Ai3+poWtmuCYM6blueibrDpzikCawKG8z5t6aeBBKHUotg8t9lnAkaHDir\/gnyQD+24HGJt5V3MowhSdsZq27BqutG00ruayP13yMnzxkRmKgwORdpWeKtFs1y3lBbqL35MwNRbHbpLNvJLXcf1l5Avjm6qAUfmBGdXXYv5hAuIG5bEzA\/4FFZ3S4AoYifkoSeKwWrwT2b\/UK577pWxO2lE\/hqFZxOEytWoksc4WLxAyV2AI2ivIPy7WCBk7hTDHvTIbf2TqrmF+KPEOAyMqtPWu1p2wUO6rxLdwkHaRk1qjv+XItfKwaQKvCEUbLyQfYGkvWu+gog6kDChkhP34xu9CnFLQwf0+TJGDbxBxpCHbI2r+Kl+q7VufCJCw\/rBb16\/ANyJp6nFt0TxTs5kj2yy1fGuQVV2P3oiuJ8yVQGZOliW0r9x+8sQBYiG09W4G0DaDbOyZUfkb7dWMABROT7oAHHSrGE3FZfrFPOwKd6i2V7nHb8fT8tx1YG4+cL6RJr52cgKSuLmy8T+RSSsmAVnrg\/3yC340z+PNexJSsSAPK\/Gq\/Voy894IB0FoDkAQd\/DuKm6L0Z6Bis6Q14E5Zd66vAyChxbnK1m\/nBnSjcLGfOsvzWgWcjqrnarhCd9nP1Ij5pZC4G9gNxiCYUp2Va1qFs3moAy7Pla8c+Ya2wO1lfOpuEsBU3crhGOzbQZ52w\/1OW09Rbof75DZjMAbbecCX0Sm9\/AGGyJrzLG+IEAM8xH4c2TMzKRQMxRjCxWngD7asrBmwW8rofjdnk4X\/l+xws9Xjnq++LbsjwY9soooCiuPRsKejOnwD+wv0fcsCl1NFnOK7uP9J39NSw5nkcxriUaHt\/rIF\/R9L+caChbdWFj3nzEfER+FdTX+T\/NRWxa\/V1WDyY7ajEsg0s0jKG4DlUpzFTqHklMr9UkDgJrTEjWZcX+kaGxfo5Wv3jz2kkN9Tfz0K+vwnF\/q8ZWRxxnLYDCcgvwHI+52Qu9a0p9nFv6o1frifR36oQ+Z5kfnpvSggh3acsGkJC7Rr\/0LWuYEIM1TrL0Hg2q62ewfYJz0J5Ejr9SG\/Y9iTBUOY66VIuXBOWufWEiWhk2GFD29XOrBjXB7jlK3AfQJWFHy7w5cBze+n754afVyeVnT8w9zvgyR6QNIxRvqns+0BvqK9Zclf8XVTwY4sVRAqbtu+7mSt0+wEAb+pG3MFUJ4mzT6T8KRY2XnzL4Mc8+9KVp5Bk7rxQmqgGLXWZOt36IpgRhHIfOuNBn1IJLD7cJ6ec7EvKFUb1wB3SvX\/bsEl9SzyWfyNgu9c54203uC55g"} 02084{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"doq_adguard.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1608278425,"pkt_ts_usec":433130,"pkt_caplen":1284,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1284,"pkt_l4_len":1250,"pkt":"mt9Y+uvcCL6sCxduCABFAAT2AbwAAD8RO1BejA4OwKgMqQMQoG4E4mLZ7v8AAB0RXf586nXFuX6jZU8LHDkLsXUECv0qRES8HGytFNakml4PzAwQaQZHc6jIBpQl61gKTaclBkH4l3lK3V26WShey\/TnsdSvKDKpXYJGGJjSSPz6xmEhdjXEAMBVaiKjETXFEOzDPRh+kQQJauoDKkCd0CQNrMhAmicwZKZ9inPEPTcitdqKPoItDvEVpKDzWn30RouaCWx0Ccaj3z30pphsLP9mmA+KzRva8myzrv5GvuishmfTYsSPOXeJe1fh4J4wfoyoFsnqFB+Rj6W+PS3WP3wlFg1ELNUK6FIRQTgFh+0sOM\/hh1pnp3QGgLuOvDO6aOeFjv8ayRYlMc1zLoSi0bJHeuqs5YENToAkzQAN\/SDhzdkft7JAolL\/cvx+82oCUXcS8NPngDaI3BOOxMlJuEliwhdAlSOQdO+FWWJweQ8\/fhateqpC+1G9wl8XvUQX8\/ljx3YJnKOvmmUG+SPCuuLNGecHoKK8AY4t9965\/YRUpnl7iCtuYexpaBXzvtdGBimVRlgDAjcJmavFlD6AkxsFnRP38YTbgm\/wcTnf+2CYkHkFS8+CJhNXsxaBXrxmRjoaWxccVEItR2FDbEPK9wy7VRD8Df+zNx+h2S5v9CUFigRwa1vGtZ2Z3Q+CYwWIf111cTy+\/GsjPZwr26hKiRQUyH7\/Au75L0uJN2BejTlIWvH+N\/aNaYn6NJ+ZFRCj2JWXv5VddGUEwh9CkQdti9buvBrvAhbSgJiKk60RyCRIWWhsxb0MQCFoPicAx8MkVopeJ9dmJW\/qa\/CYRehizNujeyQ4FJjGZm+h2OBIdsHXA4M3urzh51TBucmYcOyQzO8s3eGI6H22s73JCw3Yb8OPLtNLz\/l6own\/Tv7VrGrU5CJMEHjRWZG2lcJ7zSJt5g0E4KUi2o0caspq9HJkIT671OeDW55yNgJGKdRAtFE9B2LvuQWd\/U440TUqWCPe1i2nH5tEi5qQ4uwnAV2FNrRw7y6NzZ5GuNLzmfffcYi\/84cQkNgYe4Pwlcmdv9NW8qrwH8JdGojxVy410oHNENrZaepxULgnSVuPmqLfNhLp3Flo\/fCWou2M7DeW+9MYECvR2R9a945iMKHLbvx7lqs2Rl4ISPs8tpXLB3kvH+B5thX+jMs08Zix4fPWUXzBu8KLQLtQqmg8KLKaGSKwKZtyItXfGptVMu+M5tSJvaHHwwWOQ4o3kbftK+gvqEsFzoqdIowBF5DGabmWpL8nsANK0auN\/C5+5RzFO3ftzU2W6UlEy+cvv4LWxIKaPG2tImVo75bpC+W8VeUGoN\/xLjFX+sPAYBhewRVbO76GPWrk12jjKph7VUv6wija5t+9C17hKQmGyG9nxBLHoTLn4mIhl5Ai0d54tqw+wpXfuc4a\/PSM3DYc9DvribAwKi+wa+IE\/Uta2UvQUEZgeroX+qbGY23MpOrFQ6xsR1XBQBHPcAnKEh21lh1MGzqOg9p38iaZtfQWeUBkredgJV85jgzzWY2xkBlReo\/xFP9qXhC3e5zLKid17nylp5VgRbLAehvboaHsLbSANdUdKGvWJQuCmIWpgQ2LOTMJkEc5ryNX8QPHdRD7x9HDttgDv+QJTM8CjnxJF45XgiTNZjfrhjB0Y7J7BLK14uTv6MNSe\/St9r+Z"} 00714{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"doq_adguard.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1608278425,"pkt_ts_usec":552488,"pkt_caplen":269,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":269,"pkt_l4_len":235,"pkt":"CL6sCxdumt9Y+uvcCABFAAD\/XadAAEARolvAqAypXowODqBuAxAA63Wt4f8AAB0ECv0qRBFd\/nzqdcW5fqNlTwscOQuxdUBAFgVCbN\/RWlf92Bi4xbsmestxwaOWzmLs0UOVup1GWKiJ0THmdCSxOUYMjjJQlUfCJ\/s8QbJV\/u5t7rXjjRFpv18K\/SpED3H7Bx4sBoyGtGJqEQTxS\/oeZBY\/wYowmf3EpJiUs1hRtfh+uoDwfq87X5glE18OQjoYidfBw7A4Umc8TkwRbDOR+jZ7zQbXe3U2zDrO2LQieDEhB+\/tUlVyGsn2PAgQPNlwZczAYXjqFOGeUuxU1TZ4wjfK6+evSSxkFUfwNAg="} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":296,"source":"doq_adguard.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":296,"flow_first_seen":1608278425043,"flow_last_seen":1608278463119,"flow_tot_l4_data_len":34381,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"94.140.14.14","src_port":41070,"dst_port":784,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":296,"source":"doq_adguard.pcapng","alias":"nDPId-test"} diff --git a/test/results/dos_win98_smb_netbeui.pcap.out b/test/results/dos_win98_smb_netbeui.pcap.out index 7ea55f891..5cbf456ae 100644 --- a/test/results/dos_win98_smb_netbeui.pcap.out +++ b/test/results/dos_win98_smb_netbeui.pcap.out @@ -1,3 +1,4 @@ +00398{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00394{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576409796,"pkt_ts_usec":586005,"pkt_caplen":61,"pkt_type":47,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":61,"pkt_l4_len":0,"pkt":"AwAAAAABAFBWM3ieAC\/w8AMsAP\/vAQAAAAAACQAAAAAAAAAAAAAAAAAAAAAATURKUjk4ICAgICAgICAgAw=="} 00168{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","type":47} 00394{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576409796,"pkt_ts_usec":586078,"pkt_caplen":61,"pkt_type":47,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":61,"pkt_l4_len":0,"pkt":"AwAAAAABAFBWM3ieAC\/w8AMsAP\/vAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAV09SS0dST1VQICAgICAgAA=="} @@ -377,3 +378,7 @@ 00170{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":214,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","type":47} 00501{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":215,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576409926,"pkt_ts_usec":557294,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"AFBW6YlWAFBWM3ieCABFAABgPwAAAIARm7fAqO+BwKjvAgCJAIkATOGIAC4pAAABAAAAAAABIEVORUJGQ0ZFRUpFT0NBRkNFUEZERUZFT0VCRkZDQUFEAAAgAAHADAAgAAEABJPgAAYAAMCo74E="} 00500{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":216,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1576409928,"pkt_ts_usec":60524,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"AFBW6YlWAFBWM3ieCABFAABgQAAAAIARmrfAqO+BwKjvAgCJAIkATOGIAC4pAAABAAAAAAABIEVORUJGQ0ZFRUpFT0NBRkNFUEZERUZFT0VCRkZDQUFEAAAgAAHADAAgAAEABJPgAAYAAMCo74E="} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":220,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":32,"flow_first_seen":1576409800543,"flow_last_seen":1576409931837,"flow_tot_l4_data_len":2432,"flow_min_l4_data_len":76,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.239.129","dst_ip":"192.168.239.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":220,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":14,"flow_first_seen":1576409797553,"flow_last_seen":1576409928060,"flow_tot_l4_data_len":1064,"flow_min_l4_data_len":76,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.239.129","dst_ip":"192.168.239.2","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":220,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":12,"flow_first_seen":1576409867606,"flow_last_seen":1576409923353,"flow_tot_l4_data_len":2358,"flow_min_l4_data_len":185,"flow_max_l4_data_len":215,"flow_avg_l4_data_len":196,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.239.129","dst_ip":"192.168.239.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00142{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":220,"source":"dos_win98_smb_netbeui.pcap","alias":"nDPId-test"} diff --git a/test/results/drda_db2.pcap.out b/test/results/drda_db2.pcap.out index 639d2818d..536324137 100644 --- a/test/results/drda_db2.pcap.out +++ b/test/results/drda_db2.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"drda_db2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"drda_db2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1175543772220,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.106.1","dst_ip":"192.168.106.128","src_port":4847,"dst_port":50000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00422{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":220609,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AAwpfMZqAFBWwAABCABFAAAwIqBAAIAGglXAqGoBwKhqgBLvw1AKtGewAAAAAHAC\/\/\/kqAAAAgQFtAEBBAI="} 00420{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":221098,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AFBWwAABAAwpfMZqCABFAAAwAABAAEAG5PXAqGqAwKhqAcNQEu\/9XlZHCrRnsXASFtB6IQAAAgQFtAEBBAI="} @@ -15,3 +16,5 @@ 01049{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":834282,"pkt_caplen":524,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":524,"pkt_l4_len":490,"pkt":"AFBWwAABAAwpfMZqCABFAAH+el1AAEAGaMrAqGqAwKhqAcNQEu\/9XlekCrRr\/1AYJEI2HgAAAAvQUwABAAUkCP8AL9BDAAEAKSQU\/wAAAAAfU0VUIENVUlJFTlQgU0NIRU1BID0gIlNDICAgICAgIgAL0EMAAgAFJAj\/ALHQQwADAKskEQAAAAAAMDAwMDBTUUwwODAyNAAAAAAAAAAAAAEAAAABAAAAIf\/\/\/wAAAAAgICAgICAgICAgIAASTVlEQjJEQiAgICAgICAgICAgAAAAAP8AAQAAAAAAAABVAAAAAAAAAAAAAQAAAAAAgAAAAAAAAADAAQMzAAEAAAAAATEAAAAAAAAAAP8AAAAAAAAAAAAAB01ZREIyREIAAAAAAAAAAAAAAAAAAAAAACzQUgAEACYiBQAGEUkAAAAGIQIkFwAFIR\/xAAUhUAEADCFbAAAAAAAAAAAAH9BTAAQAGSQaBnbQMgCACXHgVAAB0AABBnHw4AAAABbQUwAEABAkG\/8AAAhTQyAgICAgIAAm0FIABAAgIgsABhFJAAQAFiEQ1OjEwvLEwkBAQEBAQEBAQEBAAFnQAwAEAFMkCABkAAAAMDIwMDBTUUxSSTAxRgABAASAAQAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAgICAgIAASTVlEQjJEQiAgICAgICAgICAgAAAAAP8="} 00428{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":898122,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"AAwpfMZqAFBWwAABCABFAAAyI31AAIAGgXbAqGoBwKhqgBLvw1AKtGv\/\/V5ZelAY\/M3JNgAAAArQAQABAAQgDg=="} 00485{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":898676,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"AFBWwAABAAwpfMZqCABFAABeel9AAEAGamjAqGqAwKhqAcNQEu\/9Xll6CrRsCVAYJEI06gAAACvQUgABACUiDAAGEUkABAAFIRUBABYhENToxMLyxMJAQEBAQEBAQEBAQAAL0AMAAQAFJAj\/"} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"drda_db2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":38,"flow_first_seen":1175543772220,"flow_last_seen":1175543810683,"flow_tot_l4_data_len":5399,"flow_min_l4_data_len":20,"flow_max_l4_data_len":683,"flow_avg_l4_data_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.106.1","dst_ip":"192.168.106.128","src_port":4847,"dst_port":50000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"drda_db2.pcap","alias":"nDPId-test"} diff --git a/test/results/dropbox.pcap.out b/test/results/dropbox.pcap.out index 3e6c13ed1..0c88bcc49 100644 --- a/test/results/dropbox.pcap.out +++ b/test/results/dropbox.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dropbox.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dropbox.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1455907271481,"flow_last_seen":0,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":104,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50311,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00524{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dropbox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1455907271,"pkt_ts_usec":481938,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"CAAnmO\/hCAAnAERyCABFAAB8EMQAAIARN\/bAqDgBwKg4ZcSHRFwAaLRJQwM1AW9STXJEXEFyCEJ1czE3Q21kETL\/eyJtZXNzYWdlVHlwZSI6IlVQREFURSIsIm1lc3NhZ2VDb250ZW50IjoiRnJpIEZlYiAxOSAyMDo0MToxMSBFRVQgMjAxNiJ9"} 00512{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dropbox.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1455907271481,"flow_last_seen":0,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":104,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.101","src_port":50311,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -167,3 +168,6 @@ 00627{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"dropbox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1535391652,"pkt_ts_usec":507202,"pkt_caplen":205,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":205,"pkt_l4_len":171,"pkt":"\/\/\/\/\/\/\/\/eJKcD6iOCABFAAC\/SaBAAEARa\/7AqAFAwKgB\/0RcRFwAqxz2eyJuYW1lc3BhY2VzIjogWzE5MDc2MDQwLCAyMDYwMzE0MCwgMTY3MTU2ODYsIDEyMzUzNTAzMF0sICJwb3J0IjogMTc1MDAsICJob3N0X2ludCI6IDMzMzEzOTY5NzEzOTU2MTA4MDE1Mzk5Mjk4MTIxOTY3OTIyMTUzNiwgImRpc3BsYXluYW1lIjogIiIsICJ2ZXJzaW9uIjogWzIsIDBdfQ=="} 00630{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"dropbox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1535391682,"pkt_ts_usec":513859,"pkt_caplen":205,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":205,"pkt_l4_len":171,"pkt":"\/\/\/\/\/\/\/\/eJKcD6iOCABFAAC\/nwpAAEAR2TvAqAFA\/\/\/\/\/0RcRFwAq9+deyJuYW1lc3BhY2VzIjogWzE5MDc2MDQwLCAyMDYwMzE0MCwgMTY3MTU2ODYsIDEyMzUzNTAzMF0sICJwb3J0IjogMTc1MDAsICJob3N0X2ludCI6IDMzMzEzOTY5NzEzOTU2MTA4MDE1Mzk5Mjk4MTIxOTY3OTIyMTUzNiwgImRpc3BsYXluYW1lIjogIiIsICJ2ZXJzaW9uIjogWzIsIDBdfQ=="} 00626{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":848,"source":"dropbox.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1535391682,"pkt_ts_usec":514087,"pkt_caplen":205,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":205,"pkt_l4_len":171,"pkt":"\/\/\/\/\/\/\/\/eJKcD6iOCABFAAC\/ZDZAAEARUWjAqAFAwKgB\/0RcRFwAqxz2eyJuYW1lc3BhY2VzIjogWzE5MDc2MDQwLCAyMDYwMzE0MCwgMTY3MTU2ODYsIDEyMzUzNTAzMF0sICJwb3J0IjogMTc1MDAsICJob3N0X2ludCI6IDMzMzEzOTY5NzEzOTU2MTA4MDE1Mzk5Mjk4MTIxOTY3OTIyMTUzNiwgImRpc3BsYXluYW1lIjogIiIsICJ2ZXJzaW9uIjogWzIsIDBdfQ=="} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":848,"source":"dropbox.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":3,"flow_first_seen":1535391651168,"flow_last_seen":1535391682513,"flow_tot_l4_data_len":513,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.64","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":848,"source":"dropbox.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":3,"flow_first_seen":1535391651170,"flow_last_seen":1535391682514,"flow_tot_l4_data_len":513,"flow_min_l4_data_len":171,"flow_max_l4_data_len":171,"flow_avg_l4_data_len":171,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.64","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":848,"source":"dropbox.pcap","alias":"nDPId-test"} diff --git a/test/results/dtls.pcap.out b/test/results/dtls.pcap.out index 695a5b09c..925494544 100644 --- a/test/results/dtls.pcap.out +++ b/test/results/dtls.pcap.out @@ -1,4 +1,7 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dtls.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dtls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1545143424891,"flow_last_seen":0,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":163,"flow_max_l4_data_len":163,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.13.203","dst_ip":"192.168.13.57","src_port":40739,"dst_port":56515,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00599{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dtls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1545143424,"pkt_ts_usec":891780,"pkt_caplen":197,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":197,"pkt_l4_len":163,"pkt":"WLEPD4fwhLVBbZhoCABFAAC3FtBAAEARhxHAqA3LwKgNOZ8j3MMAozuLFv7\/AAAAAAAAAAAAjgEAAIIAAAAAAAAAgv79zrBtKgTLKhUXwuJm7W22k25ueldyqs3Q4tvQaM4mc34AAAAYwCvAL8ypzKjACcATwArAFACcAC8ANQAKAQAAQP8BAAEAABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEADgAFAAIAAQAACwACAQAACgAIAAYAHQAXABg="} 00760{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dtls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1545143424891,"flow_last_seen":0,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":163,"flow_max_l4_data_len":163,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.13.203","dst_ip":"192.168.13.57","src_port":40739,"dst_port":56515,"l4_proto":"udp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"DTLS","breed":"Safe","category":"Web"},"tls": {"version":"DTLSv1.2","client_requested_server_name":"","ja3":"bd743610892cec1efed851b2b5efd4f5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00599{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"dtls.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1545143424,"pkt_ts_usec":891780,"pkt_caplen":197,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":197,"pkt_l4_len":163,"pkt":"WLEPD4fwhLVBbZhoCABFAAC3FtBAAEARhxHAqA3LwKgNOZ8j3MMAozuLFv7\/AAAAAAAAAAAAjgEAAIIAAAAAAAAAgv79zrBtKgTLKhUXwuJm7W22k25ueldyqs3Q4tvQaM4mc34AAAAYwCvAL8ypzKjACcATwArAFACcAC8ANQAKAQAAQP8BAAEAABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEADgAFAAIAAQAACwACAQAACgAIAAYAHQAXABg="} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"dtls.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1545143424891,"flow_last_seen":1545143424891,"flow_tot_l4_data_len":326,"flow_min_l4_data_len":163,"flow_max_l4_data_len":163,"flow_avg_l4_data_len":163,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.13.203","dst_ip":"192.168.13.57","src_port":40739,"dst_port":56515,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"dtls.pcap","alias":"nDPId-test"} diff --git a/test/results/dtls2.pcap.out b/test/results/dtls2.pcap.out index 676cde87b..489af3a50 100644 --- a/test/results/dtls2.pcap.out +++ b/test/results/dtls2.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dtls2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dtls2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1507911659748,"flow_last_seen":0,"flow_tot_l4_data_len":89,"flow_min_l4_data_len":89,"flow_max_l4_data_len":89,"flow_avg_l4_data_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"61.68.110.153","dst_ip":"212.32.214.39","src_port":53045,"dst_port":61457,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00501{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dtls2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1507911659,"pkt_ts_usec":748597,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":123,"pkt_l4_len":89,"pkt":"AAAAjZtQSEb7zh73CABFAABta10AAD8Ruf09RG6Z1CDWJ8818BEAWUhKFv7\/AAAAAAAAAAAARAEAADgAAAAAAAAAOP7\/xZOd2weR7n4d5xLXjiJT803Vm2GyIJyqcktro0p9KtUAAAAQADUALwAFAAQACgD7APwA\/QEA"} 00756{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dtls2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1507911659748,"flow_last_seen":0,"flow_tot_l4_data_len":89,"flow_min_l4_data_len":89,"flow_max_l4_data_len":89,"flow_avg_l4_data_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"61.68.110.153","dst_ip":"212.32.214.39","src_port":53045,"dst_port":61457,"l4_proto":"udp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"DTLS","breed":"Safe","category":"Web"},"tls": {"version":"DTLSv1.0","client_requested_server_name":"","ja3":"1b45c913a0c0fde5f263502e65999485","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} @@ -16,3 +17,5 @@ 00546{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"dtls2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1507911691,"pkt_ts_usec":269254,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"pkt":"AAAAjZtQSEb7zh73CABFAACJ8X0AAD8RM8E9RG6Z1CDWJ8818BEAdfPJF\/7\/AAEAAAAAAAMAYBsxJbxcmazMF1yZgVTjATb6Zon2xvveF2DtWggeNJLukjO4pdn+D\/5eRo12Wd7\/4LZ3qt\/WbDF9H1pWcnP1HjOf9Qg27QHN1pgBe8RKEE74PJevpF0HOEG9Oj0Qqtc73g=="} 00498{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dtls2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1507911691,"pkt_ts_usec":484678,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"AAAAjZtQSEb7zh73CABFAABpFWtAAHIRnPPUINYnPURumfARzzUAVb+bF\/7\/AAEAAAAAAAQAQEAOtAoAQz3o001yodc3wtrR1khwhq9qQtJWfE5XJAcqfJdAJLX8pS9nHegbomNdxzflcV6TIhGRgTVvDEGTAX0="} 00546{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dtls2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1507911706,"pkt_ts_usec":647553,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"pkt":"AAAAjZtQSEb7zh73CABFAACJ2GUAAD8RTNk9RG6Z1CDWJ8818BEAdWojF\/7\/AAEAAAAAAAQAYPlR045oqJCgSMh7ALVP58tRoxRJJZfJelm4LrwIvz5OUnOverhJu\/z67oZASGIM5zE03Z8YpZZX+V95itxyIN8Rawc56lHbJd\/wSy1wkJnsupWPJbKTGAml7J4a\/LW8KA=="} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"dtls2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":30,"flow_first_seen":1507911659748,"flow_last_seen":1507912041896,"flow_tot_l4_data_len":3971,"flow_min_l4_data_len":68,"flow_max_l4_data_len":833,"flow_avg_l4_data_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"61.68.110.153","dst_ip":"212.32.214.39","src_port":53045,"dst_port":61457,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"dtls2.pcap","alias":"nDPId-test"} diff --git a/test/results/dtls_certificate_fragments.pcap.out b/test/results/dtls_certificate_fragments.pcap.out index be6362b04..dce894c17 100644 --- a/test/results/dtls_certificate_fragments.pcap.out +++ b/test/results/dtls_certificate_fragments.pcap.out @@ -1,3 +1,4 @@ +00403{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1556606275726,"flow_last_seen":0,"flow_tot_l4_data_len":320,"flow_min_l4_data_len":320,"flow_max_l4_data_len":320,"flow_avg_l4_data_len":320,"midstream":0,"l3_proto":"ip4","src_ip":"10.186.198.149","dst_ip":"35.210.59.134","src_port":39347,"dst_port":44443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00832{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1556606275,"pkt_ts_usec":726225,"pkt_caplen":354,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":354,"pkt_l4_len":320,"pkt":"AAAAp2BiAAAAtzPNCABFAAFUW5tAAD4Rr1YKusaVI9I7hpmzrZsBQKk0Fv7\/AAAAAAAAAAABKwEAAR8AAAAAAAABH\/79XLdFN6Sz4OQy2sCEjyxqziIlNS85zlQeFiYi19pl1vEAAACgwDDALMAowCTAFMAKAKUAowChAJ8AawBqAGkAaAA5ADgANwA2AIgAhwCGAIXAMsAuwCrAJsAPwAUAnQA9ADUAhMAvwCvAJ8AjwBPACQCkAKIAoACeAGcAQAA\/AD4AMwAyADEAMACaAJkAmACXAEUARABDAELAMcAtwCnAJcAOwAQAnAA8AC8AlgBBAAfAEsAIABYAEwAQAA3ADcADAAoA\/wEAAFUACwAEAwABAgAKABwAGgAXABkAHAAbABgAGgAWAA4ADQALAAwACQAKACMAAAANACAAHgYBBgIGAwUBBQIFAwQBBAIEAwMBAwIDAwIBAgICAwAPAAEB"} 00782{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1556606275726,"flow_last_seen":0,"flow_tot_l4_data_len":320,"flow_min_l4_data_len":320,"flow_max_l4_data_len":320,"flow_avg_l4_data_len":320,"midstream":0,"l3_proto":"ip4","src_ip":"10.186.198.149","dst_ip":"35.210.59.134","src_port":39347,"dst_port":44443,"l4_proto":"udp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"DTLS","breed":"Safe","category":"Web"},"tls": {"version":"DTLSv1.2","client_requested_server_name":"","ja3":"3c3d129780d0066cd8936a6291a8d44f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} @@ -16,3 +17,5 @@ 00672{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1556606276,"pkt_ts_usec":387758,"pkt_caplen":231,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":231,"pkt_l4_len":197,"pkt":"AAAAp2BiAAAAtzPNCABFIADZ4WJAAD4RKeoj0juGCrrGla2bmbMAxbChF\/7\/AAEAAAAAAAEAsKOaNTjAgsTjXGffOf5e6kLpRuzzr7ka\/PR7CUHZuK8VNdXrkV1W06A+1tn0237G0C5cdaB5n5EllSJwXcHb2nHT\/XUVs8pP4enU1DNtdnnoKdnYbPodN01annfE0UbDAiDRUdECfRLF26BsmXy\/cY+9YosZUzWAyy0\/fDAg4rgR9Wf5i9Cz4+JyeHQ+ZRZGSUfakeFjkqX98r9W8mmvznQOaHeKhlpFTuam8Xs3Bt6w"} 00607{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1556606276,"pkt_ts_usec":388073,"pkt_caplen":183,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":183,"pkt_l4_len":149,"pkt":"AAAAp2BiAAAAtzPNCABFIACp4WNAAD4RKhkj0juGCrrGla2bmbMAlUz7F\/7\/AAEAAAAAAAIAgF7X9rlHDap9CZLTo4tXGcTqwQ2WiFJEXTqSfAc28aXOrC7SUyG\/BB7vUo+G2AG4V453rc8KT3IGeWmOK1Ytt8oWOXU9OGIN39kkVlMttVkl1sMV+SQQj3ORu402RcTbM1wMCAB\/Q9NpTysQO\/19jKpxELJ4mD0GCGmJxRgN0ChV"} 00714{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1556606276,"pkt_ts_usec":388085,"pkt_caplen":263,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":263,"pkt_l4_len":229,"pkt":"AAAAp2BiAAAAtzPNCABFIAD54WRAAD4RKcgj0juGCrrGla2bmbMA5bs6F\/7\/AAEAAAAAAAMA0GXW0AV0AJtu0HPaz6RfzO9CZWHXd94kCiafP4nVscZ0fN+GHYFWd\/lv6OnyFN1LFbq1Hc1un3I8EQgIV9EyEXZymewAmNVoOpK44k\/X58OiRLTx0ka7NyiK8sq6JLUl1H2lAnGTrfQLPNzkrlc7KU7sQx922PVFO2GshX19R+IBXtxhY3LuWx5UHxgtU0Mm+AyZx3mijZlUhGlL7LgNUEQgZvTq+RIFlr5mZGDSlKzsQb3ZBrh4wmALuEwSh0ZOoyYhNEc53O0hzv2UAoIYxmQ="} +00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1556606275726,"flow_last_seen":1556606278645,"flow_tot_l4_data_len":5298,"flow_min_l4_data_len":56,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":264,"midstream":0,"l3_proto":"ip4","src_ip":"10.186.198.149","dst_ip":"35.210.59.134","src_port":39347,"dst_port":44443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00146{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"dtls_certificate_fragments.pcap","alias":"nDPId-test"} diff --git a/test/results/dtls_session_id_and_coockie_both.pcap.out b/test/results/dtls_session_id_and_coockie_both.pcap.out index 5d9546b38..a6a4b4827 100644 --- a/test/results/dtls_session_id_and_coockie_both.pcap.out +++ b/test/results/dtls_session_id_and_coockie_both.pcap.out @@ -1,3 +1,4 @@ +00409{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00508{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388499775,"flow_last_seen":0,"flow_tot_l4_data_len":107,"flow_min_l4_data_len":107,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":107,"midstream":0,"l3_proto":"ip4","src_ip":"185.196.113.239","dst_ip":"223.116.105.247","src_port":50257,"dst_port":44443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00553{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388499,"pkt_ts_usec":775130,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"AAAAAAAAAAEAvpsKCABFAAB\/T3sAAH8RdtO5xHHv33Rp98RRrZsAazO3Fv79AAAAAAAAAAAAVgEAAEoAAAAAAAAASv79P8FbOXt8ZkgBLvoC72ni+sdFNMYxwEb+hvs\/sv9L1B0gODIAL4OTx2HjtkquDfJ\/XJtXFrGeH36FJxKlpF5tST4AAALALAEA"} 00791{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388499775,"flow_last_seen":0,"flow_tot_l4_data_len":107,"flow_min_l4_data_len":107,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":107,"midstream":0,"l3_proto":"ip4","src_ip":"185.196.113.239","dst_ip":"223.116.105.247","src_port":50257,"dst_port":44443,"l4_proto":"udp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"DTLS","breed":"Safe","category":"Web"},"tls": {"version":"DTLSv1.2","client_requested_server_name":"","ja3":"e15c510766789ed8f49de0e37951c1da","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} @@ -5,3 +6,5 @@ 00580{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388499,"pkt_ts_usec":813030,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"AAAAAAAAAAEAvpsKCABFAACTT3wAAH8Rdr65xHHv33Rp98RRrZsAf9dAFv79AAAAAAAAAAEAagEAAF4AAQAAAAAAXv79P8FbOXt8ZkgBLvoC72ni+sdFNMYxwEb+hvs\/sv9L1B0gODIAL4OTx2HjtkquDfJ\/XJtXFrGeH36FJxKlpF5tST4UHA78IXAQBJ4GgFMdNk7gXqpCpp4AAsAsAQA="} 00649{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388499,"pkt_ts_usec":833900,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"AAAAAAAAAAcAwedSCABFAADGx3wAAPMRiorfdGn3ucRx762bxFEAspnDFv79AAAAAAAAAAEAUgIAAEYAAQAAAAAARv79h9MldvGqD4L7eTZa2NHhRQF1vlik3WVyEyjxpUYtENcgODIAL4OTx2HjtkquDfJ\/XJtXFrGeH36FJxKlpF5tST7ALAAU\/v0AAAAAAAAAAgABARb+\/QABAAAAAAAAADBhiqTy6UqwzhCYCPtl5aoUaCDaK6eEDLWKYD9PQuzP3fUrM48czQrGX1gmubwFx64="} 00858{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":4,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1592388499775,"flow_last_seen":1592388499833,"flow_tot_l4_data_len":468,"flow_min_l4_data_len":56,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"185.196.113.239","dst_ip":"223.116.105.247","src_port":50257,"dst_port":44443,"l4_proto":"udp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"DTLS","breed":"Safe","category":"Web"},"tls": {"version":"DTLSv1.2","client_requested_server_name":"","ja3":"e15c510766789ed8f49de0e37951c1da","ja3s":"a1d48eca741e476d8ee735578a26bdbd","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1592388499775,"flow_last_seen":1592388499833,"flow_tot_l4_data_len":468,"flow_min_l4_data_len":56,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"185.196.113.239","dst_ip":"223.116.105.247","src_port":50257,"dst_port":44443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00151{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"dtls_session_id_and_coockie_both.pcap","alias":"nDPId-test"} diff --git a/test/results/encrypted_sni.pcap.out b/test/results/encrypted_sni.pcap.out index f0bf845d9..1e62c910d 100644 --- a/test/results/encrypted_sni.pcap.out +++ b/test/results/encrypted_sni.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"encrypted_sni.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 01380{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"encrypted_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590680386,"pkt_ts_usec":576239,"pkt_caplen":770,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":770,"pkt_l4_len":736,"pkt":"EBMx8Tl2KDc3AG3ICABFAAL0AABAAEAGjOfAqAEMaBuBTcLeAbt3Q5LX\/48DFVAYIACwHgAAFgMBAscBAALDAwOTwM86TEdZaYZx77QiKeLaOUyI6FPS+J3L+0S3MA31OCDtrXy2AkmiC5EC8aXH8NKs5TG5ofTGvlsmIWUcTFlOhgAkEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAMwA5AC8ANQAKAQACVgAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAMwBrAGkAHQAg9C+VXLX0pUAYcvwRMlm2BfjMFL+A2Ha+teHeYm8XszAAFwBBBKhP+5j\/iIqKULsVEv1xkLdgIoxwczB5EVKfTq\/0aLaIOqqUx255GoGIKzaHGdYeWvgG2FTscntynOjMKiH+1xMAKwAJCAMEAwMDAgMBAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAf\/OAW4TAQAdACAoJey8d6KdccaSJO2lCYt20kw0EEYFyldVNE\/b+wVlLQAgHyQSymUyoBaYNvGbjOJlOzPcW4r7yiRdTxErCb+vUsgBJJYkyzxOIwgn94z1v2QNIt6jP8xZjqajLZOZBVhvvpl7nmhmH4lW1IkwcuGd4kzR+4ip9x\/EzAG6tckU\/flqZH1nG16JhZuu6rEiIYaISW303wwyjD1flAsQnOsqJ0PVy+NZQoiiKbjH4viDA+P+GiaonlAB8r2TaJD+948G4F7MBjpovbjBjfrBFM8f7NuL4fwv7ssjFdJ5mNaCsSn9Hj6115hdy9xFKhCCzMA44L9pVw\/vrGvG+5UfibZ5LK2nZAPALOtdzhzm7d0W1ff7a4XSuSSFRI3gCI5CHoPx4osmf747Wa4ElvuEUhPCcdTFrF6efl9qMHJEUwf8zrcwZxBFmZHEDMTcH8MlFUx5dN14A3E5eAVFahmuI+6IR1wd8HaXtmYAHAACQAE="} 00766{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"e5ef852e686954ba9fe060fbfa881e15","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} @@ -7,3 +8,7 @@ 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 01378{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590680391,"pkt_ts_usec":590254,"pkt_caplen":770,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":770,"pkt_l4_len":736,"pkt":"EBMx8Tl2KDc3AG3ICABFAAL0AABAAEAGxnTAqAEMaBZHxcLpAbsLJg40SW6gUlAYIAANXgAAFgMBAscBAALDAwMJLl9l\/OldUJYbpqd0xOpts3Kv4zg2hroTXcdX9KeB2CBjkfBVUTqX532YPuVZHQd0J5lIK2OZH9nsSRBnWwKDWwAkEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAMwA5AC8ANQAKAQACVgAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAMwBrAGkAHQAgsbxhJX9IcnjB7rdgEb2YIBohnnxEhKIToNk1er8CIioAFwBBBLtlLNXLCuP0okhISXwuyj6tgeyLGZ5yaSZ9uT3zAbum2y5l1gYjS6RGBBL9dNcuY2pA4Ze582sOuuo0cAvw2TsAKwAJCAMEAwMDAgMBAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAf\/OAW4TAQAdACCgcq\/jSZGFwhXJHl9nfU84W9RHblecX+XHXi+knd++egAgHyQSymUyoBaYNvGbjOJlOzPcW4r7yiRdTxErCb+vUsgBJM1prHJ\/+qDqcKEqpG5xU365kjS5loGMkTxyoKwRhL+l3TthfgE+TKCSsunPt4vNjTPLrxKpdN+3jkm4v5pXmXQY7xTIeDCWHjyEgNKkvyfWHZEc70MAkkqfNhBXSLrthF\/1heQEBlRbs1xtqteJZDPsTf1rb0lyjahdcH23rHhPVaZljcat4wh7Hka7vt+kTz6HVLMaa8+FGdKR02KYBfqCbkN5nqbjMCHPCoPKBXF7APN9aYQZNPW1vyVMZGeIilksOKMAfbO31cu423QrZX+PlzwFC6qBeqVxOTzYpLwLIxJGCnfdBRD0u85D1TvPM05OjHVwJVu9F3FEA\/S2klQ0zWf5b6ngXXAHdoEO61eGscgYik1z+CCLYUuTKEqAk5KVlL4AHAACQAE="} 00766{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"e5ef852e686954ba9fe060fbfa881e15","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1590680387847,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.16.125.175","src_port":49887,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3,"source":"encrypted_sni.pcap","alias":"nDPId-test"} diff --git a/test/results/ethereum.pcap.out b/test/results/ethereum.pcap.out index 6acc8666b..f3d1b8c96 100644 --- a/test/results/ethereum.pcap.out +++ b/test/results/ethereum.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ethereum.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1578508362274,"flow_last_seen":0,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":136,"flow_max_l4_data_len":136,"flow_avg_l4_data_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"87.14.222.25","dst_ip":"192.168.1.184","src_port":56693,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00570{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ethereum.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578508362,"pkt_ts_usec":274369,"pkt_caplen":170,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":170,"pkt_l4_len":136,"pkt":"KDc3AG3IEBMx8Tl2CABFAACc0mBAADURe2hXDt4ZwKgBuN11dl8AiEJtHMys6Q29AOp21rwpZSDXERjTbIzhwNph0idC5kCkV\/FDnhOUP\/GMZC9pQ1ikY4tKfgVohRJdDV\/jhdY3JkNQ8nfjTjeSnG7Ixlzbx1L2txMkADCUTD6WfRXFuzz03\/IfAAHdBMuEfwAAAYJ2X4J2X8mETxbOvYLp94CEXhYgXgU="} 00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1578508362274,"flow_last_seen":0,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":136,"flow_max_l4_data_len":136,"flow_avg_l4_data_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"87.14.222.25","dst_ip":"192.168.1.184","src_port":56693,"dst_port":30303,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"Mining","breed":"Unsafe","category":"Mining"}} @@ -930,3 +931,99 @@ 00718{"flow_id":72,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1989,"source":"ethereum.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578508366,"pkt_ts_usec":133177,"pkt_caplen":274,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":274,"pkt_l4_len":240,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEE\/xtAAC4GafgzU+0swKgBuHZf3WzP3gb0HaeOqIAYAOy\/HwAAAQEICmlUxcQi2JnjOWodgF8zqqT3ux8u1K\/g6U6QBmyPDWBUcKgtfjzQ8ZlvmNh1rnQ0\/PjijhpEydaVIxPYRaibF5WEb1KrRVfkRhE5xHjp+CWzD39yD5ssUUl0J1JfqZGOmgi9deNFDOPhY+vWdzzZzmwC1A5nNc7kk8dUVJrtrtv373RjRw25qIqq\/0+\/hFZW00NdV0znJoUGJE91KNHYPMi7wCtFEj6Ucp0mi8GwDXYDJrWFHthe7h6\/TwY2K3iLjVuLLfeXN76lHvSq1nVFTCIT67e9N28wUg=="} 00429{"flow_id":72,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1990,"source":"ethereum.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578508366,"pkt_ts_usec":133281,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGV+TAqAG4M1PtLN1sdl8dp49Yz94HxIAQEBq\/WwAAAQEICiLYmgdpVMXE"} 00474{"flow_id":72,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1991,"source":"ethereum.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578508366,"pkt_ts_usec":133434,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"EBMx8Tl2KDc3AG3ICABFAABUAABAAEAGV8TAqAG4M1PtLN1sdl8dp49Yz94HxIAYEBrpfQAAAQEICiLYmgdpVMXEsbvcLYadChRphbpgRufGc3E5TGLY9wr\/00\/QEFUd68g="} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":33,"flow_first_seen":1578508365226,"flow_last_seen":1578508366012,"flow_tot_l4_data_len":2246,"flow_min_l4_data_len":20,"flow_max_l4_data_len":571,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"138.75.171.190","src_port":56657,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":4,"flow_first_seen":1578508365852,"flow_last_seen":1578508366055,"flow_tot_l4_data_len":595,"flow_min_l4_data_len":32,"flow_max_l4_data_len":479,"flow_avg_l4_data_len":148,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"138.59.17.58","src_port":56680,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":4,"flow_first_seen":1578508365852,"flow_last_seen":1578508366055,"flow_tot_l4_data_len":595,"flow_min_l4_data_len":32,"flow_max_l4_data_len":479,"flow_avg_l4_data_len":148,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"138.59.17.58","src_port":56680,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":61,"flow_first_seen":1578508365045,"flow_last_seen":1578508365241,"flow_tot_l4_data_len":3436,"flow_min_l4_data_len":20,"flow_max_l4_data_len":442,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"185.219.133.62","src_port":56645,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":61,"flow_first_seen":1578508365045,"flow_last_seen":1578508365241,"flow_tot_l4_data_len":3436,"flow_min_l4_data_len":20,"flow_max_l4_data_len":442,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"185.219.133.62","src_port":56645,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":54,"flow_first_seen":1578508365153,"flow_last_seen":1578508365387,"flow_tot_l4_data_len":3296,"flow_min_l4_data_len":20,"flow_max_l4_data_len":494,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.228.250.140","src_port":56650,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":7,"flow_first_seen":1578508365189,"flow_last_seen":1578508365942,"flow_tot_l4_data_len":2265,"flow_min_l4_data_len":136,"flow_max_l4_data_len":1065,"flow_avg_l4_data_len":323,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"18.219.167.159","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":30,"flow_first_seen":1578508365846,"flow_last_seen":1578508366076,"flow_tot_l4_data_len":2164,"flow_min_l4_data_len":20,"flow_max_l4_data_len":418,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.228.158.52","src_port":56679,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":30,"flow_first_seen":1578508365846,"flow_last_seen":1578508366076,"flow_tot_l4_data_len":2164,"flow_min_l4_data_len":20,"flow_max_l4_data_len":418,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.228.158.52","src_port":56679,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":50,"flow_first_seen":1578508365741,"flow_last_seen":1578508366031,"flow_tot_l4_data_len":3327,"flow_min_l4_data_len":20,"flow_max_l4_data_len":579,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"94.68.55.162","src_port":56674,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":37,"flow_first_seen":1578508364832,"flow_last_seen":1578508365305,"flow_tot_l4_data_len":2254,"flow_min_l4_data_len":20,"flow_max_l4_data_len":445,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"162.228.29.160","src_port":56635,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":37,"flow_first_seen":1578508364832,"flow_last_seen":1578508365305,"flow_tot_l4_data_len":2254,"flow_min_l4_data_len":20,"flow_max_l4_data_len":445,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"162.228.29.160","src_port":56635,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":30,"flow_first_seen":1578508365885,"flow_last_seen":1578508366042,"flow_tot_l4_data_len":2228,"flow_min_l4_data_len":20,"flow_max_l4_data_len":534,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"207.180.206.216","src_port":56681,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":30,"flow_first_seen":1578508365295,"flow_last_seen":1578508365885,"flow_tot_l4_data_len":1808,"flow_min_l4_data_len":20,"flow_max_l4_data_len":455,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.229.232.19","src_port":56662,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":30,"flow_first_seen":1578508365295,"flow_last_seen":1578508365885,"flow_tot_l4_data_len":1808,"flow_min_l4_data_len":20,"flow_max_l4_data_len":455,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.229.232.19","src_port":56662,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_first_seen":1578508364925,"flow_last_seen":1578508364954,"flow_tot_l4_data_len":1677,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1065,"flow_avg_l4_data_len":559,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.180.246.169","src_port":30303,"dst_port":30301,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":3,"flow_first_seen":1578508364697,"flow_last_seen":1578508364773,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1144,"flow_avg_l4_data_len":558,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"54.36.160.211","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1578508365567,"flow_last_seen":0,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":136,"flow_max_l4_data_len":136,"flow_avg_l4_data_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"106.12.39.168","src_port":30303,"dst_port":30333,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":4,"flow_first_seen":1578508366073,"flow_last_seen":1578508366119,"flow_tot_l4_data_len":555,"flow_min_l4_data_len":32,"flow_max_l4_data_len":439,"flow_avg_l4_data_len":138,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"206.189.107.35","src_port":56686,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":4,"flow_first_seen":1578508366073,"flow_last_seen":1578508366119,"flow_tot_l4_data_len":555,"flow_min_l4_data_len":32,"flow_max_l4_data_len":439,"flow_avg_l4_data_len":138,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"206.189.107.35","src_port":56686,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":42,"flow_first_seen":1578508364522,"flow_last_seen":1578508364664,"flow_tot_l4_data_len":2467,"flow_min_l4_data_len":20,"flow_max_l4_data_len":527,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.158.244.151","src_port":56615,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1578508365038,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"13.230.108.42","src_port":56644,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining.Amazon","breed":"Acceptable","category":"Web"}} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1578508365038,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"13.230.108.42","src_port":56644,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":38,"flow_first_seen":1578508364632,"flow_last_seen":1578508364787,"flow_tot_l4_data_len":2169,"flow_min_l4_data_len":20,"flow_max_l4_data_len":453,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"51.38.60.79","src_port":56629,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":38,"flow_first_seen":1578508364632,"flow_last_seen":1578508364787,"flow_tot_l4_data_len":2169,"flow_min_l4_data_len":20,"flow_max_l4_data_len":453,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"51.38.60.79","src_port":56629,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":41,"flow_first_seen":1578508364682,"flow_last_seen":1578508364899,"flow_tot_l4_data_len":2422,"flow_min_l4_data_len":20,"flow_max_l4_data_len":511,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"51.38.81.180","src_port":56632,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":30,"flow_first_seen":1578508364523,"flow_last_seen":1578508364743,"flow_tot_l4_data_len":2328,"flow_min_l4_data_len":20,"flow_max_l4_data_len":505,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"89.38.99.34","src_port":56624,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":31,"flow_first_seen":1578508365189,"flow_last_seen":1578508365331,"flow_tot_l4_data_len":2363,"flow_min_l4_data_len":20,"flow_max_l4_data_len":540,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"85.214.108.52","src_port":56654,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1578508364272,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip4","src_ip":"3.112.138.57","dst_ip":"192.168.1.184","src_port":25516,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":45,"flow_first_seen":1578508364522,"flow_last_seen":1578508365440,"flow_tot_l4_data_len":2554,"flow_min_l4_data_len":20,"flow_max_l4_data_len":606,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"165.22.107.33","src_port":56610,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1578508362274,"flow_last_seen":1578508363333,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":136,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"87.14.222.25","dst_ip":"192.168.1.184","src_port":56693,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":64,"flow_first_seen":1578508365239,"flow_last_seen":1578508365961,"flow_tot_l4_data_len":3718,"flow_min_l4_data_len":20,"flow_max_l4_data_len":615,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"157.230.152.87","src_port":56658,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":29,"flow_first_seen":1578508365021,"flow_last_seen":1578508365192,"flow_tot_l4_data_len":2124,"flow_min_l4_data_len":20,"flow_max_l4_data_len":447,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"178.62.10.218","src_port":56642,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":29,"flow_first_seen":1578508365021,"flow_last_seen":1578508365192,"flow_tot_l4_data_len":2124,"flow_min_l4_data_len":20,"flow_max_l4_data_len":447,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"178.62.10.218","src_port":56642,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":54,"flow_first_seen":1578508365029,"flow_last_seen":1578508365211,"flow_tot_l4_data_len":3043,"flow_min_l4_data_len":20,"flow_max_l4_data_len":501,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"178.62.29.183","src_port":56643,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":30,"flow_first_seen":1578508365588,"flow_last_seen":1578508365744,"flow_tot_l4_data_len":2134,"flow_min_l4_data_len":20,"flow_max_l4_data_len":421,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"167.86.122.50","src_port":56670,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":30,"flow_first_seen":1578508365588,"flow_last_seen":1578508365744,"flow_tot_l4_data_len":2134,"flow_min_l4_data_len":20,"flow_max_l4_data_len":421,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"167.86.122.50","src_port":56670,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1578508364732,"flow_last_seen":1578508365736,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":136,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"111.229.0.180","src_port":30303,"dst_port":20182,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":41,"flow_first_seen":1578508364523,"flow_last_seen":1578508364723,"flow_tot_l4_data_len":2418,"flow_min_l4_data_len":20,"flow_max_l4_data_len":544,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"34.255.23.113","src_port":56627,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508365220,"flow_tot_l4_data_len":2439,"flow_min_l4_data_len":20,"flow_max_l4_data_len":485,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"52.231.165.108","src_port":56618,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508365220,"flow_tot_l4_data_len":2439,"flow_min_l4_data_len":20,"flow_max_l4_data_len":485,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"52.231.165.108","src_port":56618,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":37,"flow_first_seen":1578508365712,"flow_last_seen":1578508366123,"flow_tot_l4_data_len":3058,"flow_min_l4_data_len":32,"flow_max_l4_data_len":599,"flow_avg_l4_data_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"78.47.147.155","src_port":56673,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":2,"flow_first_seen":1578508365919,"flow_last_seen":1578508365951,"flow_tot_l4_data_len":291,"flow_min_l4_data_len":136,"flow_max_l4_data_len":155,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"167.86.122.50","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1578508364776,"flow_last_seen":1578508365781,"flow_tot_l4_data_len":315,"flow_min_l4_data_len":136,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"209.97.143.1","src_port":30303,"dst_port":50000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1578508364382,"flow_last_seen":1578508364651,"flow_tot_l4_data_len":3354,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1065,"flow_avg_l4_data_len":559,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"52.231.165.108","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1578508363692,"flow_last_seen":0,"flow_tot_l4_data_len":137,"flow_min_l4_data_len":137,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":137,"midstream":0,"l3_proto":"ip4","src_ip":"60.191.32.71","dst_ip":"192.168.1.184","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":4,"flow_first_seen":1578508365408,"flow_last_seen":1578508365790,"flow_tot_l4_data_len":586,"flow_min_l4_data_len":136,"flow_max_l4_data_len":158,"flow_avg_l4_data_len":146,"midstream":0,"l3_proto":"ip4","src_ip":"183.129.242.164","dst_ip":"192.168.1.184","src_port":1024,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":69,"flow_first_seen":1578508364523,"flow_last_seen":1578508364687,"flow_tot_l4_data_len":4026,"flow_min_l4_data_len":20,"flow_max_l4_data_len":578,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"178.128.195.220","src_port":56626,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":24,"flow_first_seen":1578508365194,"flow_last_seen":1578508366069,"flow_tot_l4_data_len":2114,"flow_min_l4_data_len":32,"flow_max_l4_data_len":526,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"202.112.28.106","src_port":56655,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1578508364523,"flow_last_seen":1578508365619,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"5.1.83.226","src_port":56625,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1578508364523,"flow_last_seen":1578508365619,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"5.1.83.226","src_port":56625,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508364937,"flow_tot_l4_data_len":2401,"flow_min_l4_data_len":20,"flow_max_l4_data_len":502,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"3.209.45.79","src_port":56628,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508364937,"flow_tot_l4_data_len":2401,"flow_min_l4_data_len":20,"flow_max_l4_data_len":502,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"3.209.45.79","src_port":56628,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":29,"flow_first_seen":1578508364523,"flow_last_seen":1578508365656,"flow_tot_l4_data_len":2255,"flow_min_l4_data_len":20,"flow_max_l4_data_len":504,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"34.97.172.22","src_port":56617,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1578508364922,"flow_last_seen":1578508366029,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.233.197.131","src_port":56637,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1578508364922,"flow_last_seen":1578508366029,"flow_tot_l4_data_len":88,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.233.197.131","src_port":56637,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":65,"flow_first_seen":1578508365271,"flow_last_seen":1578508365838,"flow_tot_l4_data_len":3718,"flow_min_l4_data_len":20,"flow_max_l4_data_len":605,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"51.161.23.12","src_port":56660,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":53,"flow_first_seen":1578508365279,"flow_last_seen":1578508366038,"flow_tot_l4_data_len":3248,"flow_min_l4_data_len":20,"flow_max_l4_data_len":504,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"52.9.128.68","src_port":56661,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":32,"flow_first_seen":1578508364714,"flow_last_seen":1578508364919,"flow_tot_l4_data_len":2080,"flow_min_l4_data_len":20,"flow_max_l4_data_len":474,"flow_avg_l4_data_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"82.145.220.249","src_port":56633,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":32,"flow_first_seen":1578508364714,"flow_last_seen":1578508364919,"flow_tot_l4_data_len":2080,"flow_min_l4_data_len":20,"flow_max_l4_data_len":474,"flow_avg_l4_data_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"82.145.220.249","src_port":56633,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":22,"flow_first_seen":1578508365300,"flow_last_seen":1578508366073,"flow_tot_l4_data_len":1901,"flow_min_l4_data_len":32,"flow_max_l4_data_len":577,"flow_avg_l4_data_len":86,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"124.217.235.180","src_port":56663,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":36,"flow_first_seen":1578508365154,"flow_last_seen":1578508365257,"flow_tot_l4_data_len":2088,"flow_min_l4_data_len":20,"flow_max_l4_data_len":449,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"138.201.12.87","src_port":56651,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":36,"flow_first_seen":1578508365154,"flow_last_seen":1578508365257,"flow_tot_l4_data_len":2088,"flow_min_l4_data_len":20,"flow_max_l4_data_len":449,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"138.201.12.87","src_port":56651,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1578508364654,"flow_last_seen":1578508364729,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1063,"flow_avg_l4_data_len":558,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"128.0.51.140","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":52,"flow_first_seen":1578508365079,"flow_last_seen":1578508365297,"flow_tot_l4_data_len":3274,"flow_min_l4_data_len":20,"flow_max_l4_data_len":506,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"172.105.94.62","src_port":56646,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":35,"flow_first_seen":1578508365169,"flow_last_seen":1578508365272,"flow_tot_l4_data_len":2271,"flow_min_l4_data_len":20,"flow_max_l4_data_len":563,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"176.9.136.209","src_port":56652,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":2,"flow_first_seen":1578508365461,"flow_last_seen":1578508365899,"flow_tot_l4_data_len":293,"flow_min_l4_data_len":136,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"202.112.28.106","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508365331,"flow_tot_l4_data_len":2373,"flow_min_l4_data_len":20,"flow_max_l4_data_len":563,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"18.138.108.67","src_port":56622,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":43,"flow_first_seen":1578508364523,"flow_last_seen":1578508365354,"flow_tot_l4_data_len":2449,"flow_min_l4_data_len":20,"flow_max_l4_data_len":503,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"18.138.81.28","src_port":56623,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":5,"flow_first_seen":1578508364522,"flow_last_seen":1578508364841,"flow_tot_l4_data_len":609,"flow_min_l4_data_len":32,"flow_max_l4_data_len":461,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"66.42.82.246","src_port":56612,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":5,"flow_first_seen":1578508364522,"flow_last_seen":1578508364841,"flow_tot_l4_data_len":609,"flow_min_l4_data_len":32,"flow_max_l4_data_len":461,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"66.42.82.246","src_port":56612,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_first_seen":1578508364382,"flow_last_seen":1578508364519,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1063,"flow_avg_l4_data_len":558,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"3.209.45.79","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":42,"flow_first_seen":1578508364522,"flow_last_seen":1578508365097,"flow_tot_l4_data_len":2493,"flow_min_l4_data_len":20,"flow_max_l4_data_len":522,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"104.42.217.25","src_port":56611,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_first_seen":1578508364421,"flow_last_seen":1578508364694,"flow_tot_l4_data_len":1675,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1144,"flow_avg_l4_data_len":558,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"34.97.172.22","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":36,"flow_first_seen":1578508365701,"flow_last_seen":1578508365828,"flow_tot_l4_data_len":2086,"flow_min_l4_data_len":20,"flow_max_l4_data_len":418,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"139.162.255.210","src_port":56672,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":36,"flow_first_seen":1578508365701,"flow_last_seen":1578508365828,"flow_tot_l4_data_len":2086,"flow_min_l4_data_len":20,"flow_max_l4_data_len":418,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"139.162.255.210","src_port":56672,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508365223,"flow_tot_l4_data_len":2495,"flow_min_l4_data_len":20,"flow_max_l4_data_len":544,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"191.234.162.198","src_port":56620,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":16,"flow_first_seen":1578508365094,"flow_last_seen":1578508365839,"flow_tot_l4_data_len":1818,"flow_min_l4_data_len":32,"flow_max_l4_data_len":554,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"182.162.161.61","src_port":56647,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":62,"flow_first_seen":1578508364924,"flow_last_seen":1578508365071,"flow_tot_l4_data_len":3977,"flow_min_l4_data_len":20,"flow_max_l4_data_len":526,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"209.250.240.205","src_port":56638,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":62,"flow_first_seen":1578508364924,"flow_last_seen":1578508365071,"flow_tot_l4_data_len":3977,"flow_min_l4_data_len":20,"flow_max_l4_data_len":526,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"209.250.240.205","src_port":56638,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":39,"flow_first_seen":1578508364932,"flow_last_seen":1578508365309,"flow_tot_l4_data_len":2451,"flow_min_l4_data_len":20,"flow_max_l4_data_len":553,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"18.219.167.159","src_port":56639,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":35,"flow_first_seen":1578508364659,"flow_last_seen":1578508365043,"flow_tot_l4_data_len":2166,"flow_min_l4_data_len":20,"flow_max_l4_data_len":463,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"40.67.144.128","src_port":56630,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining","breed":"Unsafe","category":"Mining"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":35,"flow_first_seen":1578508364659,"flow_last_seen":1578508365043,"flow_tot_l4_data_len":2166,"flow_min_l4_data_len":20,"flow_max_l4_data_len":463,"flow_avg_l4_data_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"40.67.144.128","src_port":56630,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":42,"flow_first_seen":1578508364523,"flow_last_seen":1578508365511,"flow_tot_l4_data_len":2512,"flow_min_l4_data_len":20,"flow_max_l4_data_len":557,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"52.187.207.27","src_port":56621,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":4,"flow_first_seen":1578508365828,"flow_last_seen":1578508366083,"flow_tot_l4_data_len":552,"flow_min_l4_data_len":32,"flow_max_l4_data_len":436,"flow_avg_l4_data_len":138,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"13.251.14.199","src_port":56678,"dst_port":30303,"l4_proto":"tcp","ndpi": {"proto":"Mining.Amazon","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":4,"flow_first_seen":1578508365828,"flow_last_seen":1578508366083,"flow_tot_l4_data_len":552,"flow_min_l4_data_len":32,"flow_max_l4_data_len":436,"flow_avg_l4_data_len":138,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"13.251.14.199","src_port":56678,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1578508364382,"flow_last_seen":1578508364650,"flow_tot_l4_data_len":1677,"flow_min_l4_data_len":179,"flow_max_l4_data_len":1065,"flow_avg_l4_data_len":559,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"18.138.108.67","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":30,"flow_first_seen":1578508365751,"flow_last_seen":1578508365853,"flow_tot_l4_data_len":2280,"flow_min_l4_data_len":20,"flow_max_l4_data_len":562,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"35.235.37.216","src_port":56675,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":24,"flow_first_seen":1578508366005,"flow_last_seen":1578508366135,"flow_tot_l4_data_len":2215,"flow_min_l4_data_len":20,"flow_max_l4_data_len":593,"flow_avg_l4_data_len":92,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"51.83.237.44","src_port":56684,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_first_seen":1578508364422,"flow_last_seen":1578508365065,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":136,"flow_max_l4_data_len":179,"flow_avg_l4_data_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"66.42.82.246","src_port":30303,"dst_port":30303,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":48,"flow_first_seen":1578508365592,"flow_last_seen":1578508365773,"flow_tot_l4_data_len":3244,"flow_min_l4_data_len":20,"flow_max_l4_data_len":572,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"86.107.243.62","src_port":56671,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":12,"flow_first_seen":1578508366020,"flow_last_seen":1578508366101,"flow_tot_l4_data_len":1557,"flow_min_l4_data_len":32,"flow_max_l4_data_len":612,"flow_avg_l4_data_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"88.99.93.219","src_port":56685,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":31,"flow_first_seen":1578508364522,"flow_last_seen":1578508365036,"flow_tot_l4_data_len":2169,"flow_min_l4_data_len":20,"flow_max_l4_data_len":490,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"162.243.160.83","src_port":56613,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":31,"flow_first_seen":1578508365009,"flow_last_seen":1578508365126,"flow_tot_l4_data_len":2240,"flow_min_l4_data_len":20,"flow_max_l4_data_len":572,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"144.91.120.135","src_port":56641,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":44,"flow_first_seen":1578508364824,"flow_last_seen":1578508365152,"flow_tot_l4_data_len":2648,"flow_min_l4_data_len":20,"flow_max_l4_data_len":603,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.184","dst_ip":"159.203.84.31","src_port":56634,"dst_port":30303,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2000,"source":"ethereum.pcap","alias":"nDPId-test"} diff --git a/test/results/exe_download.pcap.out b/test/results/exe_download.pcap.out index 37a7f525d..a1caaee70 100644 --- a/test/results/exe_download.pcap.out +++ b/test/results/exe_download.pcap.out @@ -1,3 +1,4 @@ +00389{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"exe_download.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"exe_download.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569434051004,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"144.91.69.195","src_port":49165,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"exe_download.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434051,"pkt_ts_usec":4796,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"IOUqtpPxAAgCHEeuCABFAAA0AI9AAIAGAKkKCRllkFtFw8ANAFC+hvgeAAAAAIACIADegAAAAgQFtAEDAwgBAQQC"} 00419{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"exe_download.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434051,"pkt_ts_usec":324116,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"AAgCHEeuIOUqtpPxCABFAAAsBbAAAIAGO5CQW0XDCgkZZQBQwA0+79i4vob4H2AS+vAU7QAAAgQFtA=="} @@ -16,3 +17,5 @@ 02532{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"exe_download.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434051,"pkt_ts_usec":630207,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AAgCHEeuIOUqtpPxCABFAAXcBbkAAIAGNdeQW0XDCgkZZQBQwA0+7\/Ndvob4uFAQ+vCglwAAAAABAAAAg+xUuRUAAACNdaiL\/POli02k6PMCAABfXovlXcPMzMzMzMzMzMzMzMzMVYvsg+xcVleJTaSNRahQi02k6PO9AQCLTaSDudQBAAAAdBiLVbCD4vuJVbCLRaTHgNQBAAAAAAAA6x\/HRawEAIAAx0WwBAAAAMZF+AGLTaTHgdQBAAABAAAAg+xUuRUAAACNdaiL\/POli02k6G8CAABfXovlXcPMzMzMzMzMzMxVi+xRiU38i+Vdw8zMzMzMVYvsav9oTSlEAGShAAAAAFBkiSUAAAAAgey4AAAAiY1A\/\/\/\/aGwBAADoydIBAIPEBImFRP\/\/\/8dF\/AAAAACDvUT\/\/\/8AdBVqAIuNRP\/\/\/+jcAwAAiYU8\/\/\/\/6wrHhTz\/\/\/8AAAAAi4U8\/\/\/\/iYVI\/\/\/\/x0X8\/\/\/\/\/4uNSP\/\/\/4lN8ItV8IsCi03w\/5BAAQAAg\/gBD4W3AAAAx4VM\/\/\/\/nAAAAItN8IO5YAEAAAB0D4uVUP\/\/\/4PKAomVUP\/\/\/4tF8IO4aAEAAAB0D4uNUP\/\/\/4PJAYmNUP\/\/\/4tV8IO6ZAEAAAB0D4uFUP\/\/\/4PIBImFUP\/\/\/4tN8IuRYAEAAGnSoAUAAImVXP\/\/\/4tF8IuIZAEAAGnJoAUAAIlN7ItV7PfaiZVg\/\/\/\/i0Xwi4hoAQAAacmgBQAAA03siY1Y\/\/\/\/jZVM\/\/\/\/UouNQP\/\/\/+hmvAEAi030ZIkNAAAAAIvlXcPMzFWL7FGJTfyLRfyLiMwBAABRi1UIiwKLTQj\/UASL5V3CBADMzMzMzMzMzMzMzMzMzFWL7FGJTfyLRfyLiNABAABRi1UIiwKLTQj\/UASL5V3CBADMzMzMzMzMzMzMzMzMzFWL7FGJTfyLRfyLiNwBAABRi1UIiwKLTQj\/UASL5V3CBADMzMzMzMzMzMzMzMzMzFWL7FGJTfyLRfyLiNgBAABRi1UIiwKLTQj\/UASL5V3CBADMzMzMzMzMzMzMzMzMzFWL7FGJTfyLRfyLiNQBAABRi1UIiwKLTQj\/UASL5V3CBADMzMzMzMzMzMzMzMzMzFWL7IPsEIlN9I1F\/FCNTfhRi0306Di6AQCLVfg7Vfx1CcdF8P\/\/\/\/\/rBotF\/IlF8ItN8FGLVfhSi0306L65AQCNRQhQi0306MC6AQCL5V3CVADMzMzMzMzMzMzMzMzMzFWL7IHszAAAAImNOP\/\/\/2oBi0UIixCLTQj\/EseFPP\/\/\/wAAAACNhUD\/\/\/9Qi404\/\/\/\/6LG6AQCLTQiLUQSJlTT\/\/\/+DvTT\/\/\/9ldCuDvTT\/\/\/9mdAuDvTT\/\/\/9ndDDrRQ+3hVj\/\/\/+D6AL32BvAQImFPP\/\/\/+s4D7eNWP\/\/\/4PpAffZG8lBiY08\/\/\/\/6yEPt5VY\/\/\/\/g+oD99ob0kKJlTz\/\/\/\/rCseFPP\/\/\/wAAAAAzwIO9PP\/\/\/wAPlcBQi00IixGLTQj\/UgiL5V3CBADMzMxVi+yD7AiJTfyLRQiJRfiDffhldA6DffhmdBSDffhndBrrImoBi0386NP1\/\/\/rFmoCi0386Mf1\/\/\/rCmoDi0386Lv1\/\/+L5V3CBADMzMzMzFWL7ItFCFDoRs8BAIPEBF3CBADMzMzMzMzMzMzMzMzMVYvsUYlN\/GoAi0X8i0gcUf8VUFVEAIvlXcPMzMzMzMxVi+xRiU38agGLRfyLSBxR\/xVQVUQAi+Vdw8zMzMzMzFWL7Gr\/aIEpRABkoQAAAABQZIklAAAAAIPsEIlN5ItFCFBqZotN5Oh3FQIAx0X8AAAAAItN5McBSFxEAItV5IPCcIlV8ItN8OjO2gEAi0XwxwCElEQAxkX8AYtN5IHBwAAAAIlN7ItN7Oit2gEAi1XsxwKElEQAxkX8AotF5AUQAQAAiUXoi03o6I3aAQCLTejHAYSURADHRfz\/\/\/\/\/i0Xki030ZIkNAAAAAIvlXcIEAMzMzMzMzMzMzMzMzMzMzFWL7FE="} 02138{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"exe_download.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434051,"pkt_ts_usec":630216,"pkt_caplen":1302,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1302,"pkt_l4_len":1268,"pkt":"AAgCHEeuIOUqtpPxCABFAAUIBboAAIAGNqqQW0XDCgkZZQBQwA0+7\/kRvob4uFAY+vB0WgAAiU38i0386CEAAACLRQiD4AGFwHQMi038UegQzgEAg8QEi0X8i+VdwgQAzMxVi+xq\/2ixKUQAZKEAAAAAUGSJJQAAAABRiU3wx0X8AgAAAItN8IHBEAEAAOiLCwMAxkX8AYtN8IHBwAAAAOh5CwMAxkX8AItN8IPBcOhqCwMAx0X8\/\/\/\/\/4tN8OilEwIAi030ZIkNAAAAAIvlXcPMVYvsUYlN\/ItF\/IPAcFBo6gMAAItNCFHoqYwCAItV\/IHCwAAAAFJo6wMAAItFCFDokYwCAItN\/IHBEAEAAFFo7AMAAItVCFLoeYwCAIvlXcIEAMzMzMzMzMzMzMzMzMzMVYvsUYlN\/LhIW0QAi+Vdw1WL7IPsGIlN6MdF8AAAAADrCYtF8IPAAYlF8IN98Bl9N4tN8IsUjbCQRQBSaKBdRACNRfRQ\/xXUVUQAg8QMjU30UWoAaEMBAACLVQiLQhxQ\/xVIVUQA67rHRewAAAAAagCLTexRaE4BAACLVQiLQhxQ\/xVIVUQAi+VdwgQAzMzMVYvsUYlN\/ItN\/OiFFgIAi0X8g8BwUItN\/Ohi\/\/\/\/i038gcHAAAAAUYtN\/OhQ\/\/\/\/i1X8gcIQAQAAUotN\/Og+\/\/\/\/uAEAAACL5V3DzMzMzMxVi+xq\/2jIKUQAZKEAAAAAUGSJJQAAAACD7CCJTeCLTeDoOuQBAOipGwIAiUXoi0XoixCLTej\/UgyJReyLReyDwBCJRfDHRfwAAAAAjU3wUYtN4IPBcOj27wEAagBqAGhHAQAAi1Xgi4KMAAAAUP8VSFVEAIXAdBGLTfBR6F\/lAACDxASJRdzrB8dF3AAAAACLVeCLRdyJgmABAACNTfBRi03ggcHAAAAA6KPvAQBqAGoAaEcBAACLVeCLgtwAAABQ\/xVIVUQAhcB0EYtN8FHoDOUAAIPEBIlF2OsHx0XYAAAAAItV4ItF2ImCZAEAAI1N8FGLTeCBwRABAADoUO8BAGoAagBoRwEAAItV4IuCLAEAAFD\/FUhVRACFwHQRi03wUei55AAAg8QEiUXU6wfHRdQAAAAAi1Xgi0XUiYJoAQAAx0X8\/\/\/\/\/41N8OifAAAAi030ZIkNAAAAAIvlXcPMVYvsUYlN\/IvlXcIEAMzMzFWL7FGJTfyLRQxQD7dNCFGLVfyLAotN\/P+QNAEAAIvlXcIIAMzMzMzMzMzMzMzMzFWL7FGJTfyLTfzoXQgDAItFCIPgAYXAdAyLTfxR6JDKAQCDxASLRfyL5V3CBADMzFWL7IPsCIlN+ItN+OgPAAAAi+Vdw8zMzMzMzMzMzMzMVYvsg+wIiU34i0X4iwiD6RCJTfyLVfyDwgyDyP\/wD8ECSIXAfxOLTfxRi1X8iwKLTfyLCYsQ\/1IEi+Vdw8zMzFWL7Gr\/aOopRABkoQAAAABQZIklAAAAAIPsDGgYAgAA6NLJAQCDxASJRezHRfwAAAAAg33sAHQNi03s6FAAAACJRejrB8dF6AAAAACLReiJRfDHRfz\/\/\/\/\/i0Xwi030ZIkNAAAAAIvlXcPMzMzMzMxVi+xRiU38uABfRACL5V3DVYvsUYlN\/LikXUQAi+Vdw1WL7Gr\/aBYqRABkoQAAAABQZIklAAAAAFGJTfCLTfDoiScDAMdF\/AAAAACLRfDHAChfRACLTfCBwdAAAADobEsDAMZF"} 00414{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"exe_download.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434051,"pkt_ts_usec":630369,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoALhAAIAGAIwKCRllkFtFw8ANAFC+hvi4Pu\/98VAQ+vAG2QAA"} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":703,"source":"exe_download.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":703,"flow_first_seen":1569434051004,"flow_last_seen":1569434056186,"flow_tot_l4_data_len":693561,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":986,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"144.91.69.195","src_port":49165,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":703,"source":"exe_download.pcap","alias":"nDPId-test"} diff --git a/test/results/exe_download_as_png.pcap.out b/test/results/exe_download_as_png.pcap.out index 46cc1d721..92500d51c 100644 --- a/test/results/exe_download_as_png.pcap.out +++ b/test/results/exe_download_as_png.pcap.out @@ -1,3 +1,4 @@ +00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"exe_download_as_png.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569434903040,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":40298,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"IOUqtpPxAAgCHEeuCABFAAA0Bk9AAIAGv+sKCRlluWJXucAtAFB7PMGWAAAAAIACIAAdNgAAAgQFtAEDAwgBAQQC"} 00426{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434903,"pkt_ts_usec":440451,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"AAgCHEeuIOUqtpPxCABFAAAsESIAAIAG9SC5Yle5CgkZZQBQwC0vLgrVezzBl2AS+vAxRwAAAgQFtA=="} @@ -16,3 +17,5 @@ 02264{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":55696,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESkAAIAG78m5Yle5CgkZZQBQwC0vLiV6ezzCLFAY+vCF8gAA6LBFums813x8GqfsAAAAAAAAAGRFQABMAAAAUAAAAN9uiYgizvFGuh2dNdOBjtEAAAAAAAAAAAAAAAAAAAAAAwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPYVAAAAAAAAUEZAAJwAAADoAAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0AAAAP\/\/\/\/8AAAAA0AAAANEAAADhAAAAAAAAAMPqUh0p6LBFums813x8GqcAFH2S901MS6oECpq+XrR3y+IzLEEPxUGmS11wcgPVKeOSxrAzpaRGvgd9xm+yfh4xjrter\/k+T7eGjRsDtdunPwEAAADgAAAARoT\/DwMAAOxiHWDQkSRJhGgetLBl\/ZJowTPquYefQaoiGxAoHisfAAAAAGITVyAAAAAAAAAAAAAAAAAAAAAAAEFNTUFDQVJFLmpDaGFydABqQ2hhcnQABwAAALRBQAAHAAAAcEFAAAcAAAAsQUAABwAAAOBAQAAHAAAAhEBAAAcAAAAwQEAABwAAAOw\/QAAHAAAAqD9AAAcAAABgP0AABwAAABg\/QAAHAAAAsD5AAAcAAABsPkAABwAAACg+QAAHAAAA3D1AAAcAAACUPUAABwAAAFA9QAAHAAAA7DxAAAcAAACkPEAABwAAAFw8QAAHAAAAFDxAAAcAAADMO0AABwAAAIg7QAAHAAAAGDtAAAcAAADUOkAABwAAAJA6QAAHAAAATDpAAAcAAAAIOkAABwAAAMQ5QAAHAAAAYDlAAAcAAAAEOUAABwAAAMA4QAAHAAAAeDhAAAYAAAD8M0AABwAAAEQwQAAHAAAA\/C9AAAcAAACgL0AABwAAAEwvQAAHAAAA8C5AAPQBAABsK0AAAAAAANBqQADQ10AAABYAAAjgQACmFUAAAOBAACoAXABBAEYAOgBcADgAMQA3ADIAMAAwADAAXABEAGkAYwBWAGUAcgBvAG4AYQA0AFAAYQByAHQAMgAuAHYAYgBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQbQAAmAAAAAQAAAGwrQAAAAAAApGZAAP\/\/\/\/8AAAAAwCtAACDgQAAAAAAAGMdUCQAAAAAAAAAAAAAAAOgeQAABAAAAoDBAAAAAAADoHkAAAQAAAPAeQAABAAAA7B5AAAIAAAD0HkAADwDiAWgAbABEH0AAHO5AAAAAAAA09mAJsDBAAMAwQADQMEAAQAAsAIgGAADgMEAA\/\/\/\/\/wA="} 00420{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":55794,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoBlZAAIAGv\/AKCRlluWJXucAtAFB7PMIsLy4qzlAQ+vAodwAA"} 02285{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"exe_download_as_png.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569434904,"pkt_ts_usec":56830,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"AAgCHEeuIOUqtpPxCABFAAV8ESoAAIAG78i5Yle5CgkZZQBQwC0vLirOezzCLFAY+vBtPQAAAAAAAAAAAIAfQADol0AJ8DBAAP\/\/\/\/9AABIAjAYAAJwxQAABAAMAAAAAAAAAAABIIEAA+JdACawxQAABAAMA5CBAAPEgQAD+IEAACyFAABghQAAlIUAAMiFAAD8hQABmIUAAsCBAAL0gQADKIEAA1yBAAEwhQABZIUAAAAAAAPQeQABwHkAAqhdAALAXQAC2F0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMIgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM8gQAC1IEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9AAHAeQACqF0AAsBdAALYXQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBbCQEhwYAAOkrSgAAgWwkBIcGAADpzksAAIFsJASHBgAA6cFMAACBbCQEhwYAAOm0TgAAgWwkBP\/\/AADpp08AAIFsJAT\/\/wAA6SpQAACBbCQE\/\/8AAOmNUAAAgWwkBP\/\/AADpQFEAAIFsJAT\/\/wAA6bNRAACBbCQE\/\/8AAOn2UgAAgWwkBP\/\/AADpWVQAAIFsJAT\/\/wAA6UxVAACBbCQE\/\/8AAOn\/WAAAgWwkBP\/\/AADpYmwAAIFsJAT\/\/wAA6eVuAAAAAQADAGwrQAAAAAAAJGdAAP\/\/\/\/8AAAAAUCxAADTgQAAAAAAAQNJQCQAAAAAAAAAAAAAAAOQhQAABAAAAiDZAAAAAAADkIUAAAQAAAOwhQAAAAAAA6CFAAAcAAADsIUAABAC3AWgAbAAEI0AA8OVAAAAAAACo7WAJmDZAANA0QABAABgAOAAAAEQ0QAAFAAMAAAAAAAAAAAAUI0AAgJhACag2QAAFAAMAQAAJADwAAAC0NkAAAQADAAAAAAAAAAAAjCNAAJCYQAnENkAAAQADAEAAEQBAAAAAzDZAAAMAAwAAAAAAAAAAAMgjQACgmEAJ3DZAAAMAAwBAABgARAAAAEQ0QAACAAMAAAAAAAAAAAAkJEAAgJhACeQ2QAACAAMAQAASAEgAAACcMUAABgADAAAAAAAAAAAAnCRAAPiXQAnwNkAABgADAEAAHwBMAAAA\/DZAAP\/\/\/\/8AAAAAAAAAAPwkQACwmEAJDDdAAP\/\/\/\/9AABEAUAAAAMw2QAAEAAMAAAAAAAAAAACQJUAAoJhACRQ3QAAEAAMA7CVAAPslQAASJkAAHyZAAAAAAADsIUAAbCFAAKoXQACwF0AAthdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIkAAbCFAAKoXQACwF0AAthdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8IkAAbCFAAKoXQACwF0AAthdAABcmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGQiQABsIUAAqhdAALAXQAC2F0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":534,"flow_first_seen":1569434903040,"flow_last_seen":1569434972556,"flow_tot_l4_data_len":511293,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":957,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.25.101","dst_ip":"185.98.87.185","src_port":49197,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00140{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":534,"source":"exe_download_as_png.pcap","alias":"nDPId-test"} diff --git a/test/results/facebook.pcap.out b/test/results/facebook.pcap.out index 8f05450a6..c2d3c0562 100644 --- a/test/results/facebook.pcap.out +++ b/test/results/facebook.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"facebook.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"facebook.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1472393122365,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.18","dst_ip":"66.220.156.68","src_port":52066,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"facebook.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472393122,"pkt_ts_usec":365661,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"mAyC0zx8MFLLbJwbCABFAAA84M9AAEAGjxHAqCsSQtycRMtiAbv14btyAAAAAKACchDLCQAAAgQFtAQCCAoAS1u9AAAAAAEDAwc="} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"facebook.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472393122,"pkt_ts_usec":668038,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"MFLLbJwbmAyC0zx8CABFAAA8AABAAE0GYuFC3JxEwKgrEgG7y2LsHfNy9eG7c6ASNpzIhwAAAgQFeAQCCAq7uwhkAEtbvQEDAwg="} @@ -35,3 +36,6 @@ 00484{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"facebook.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472393123,"pkt_ts_usec":968290,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"MFLLbJwbmAyC0zx8CABFAABeCR9AAFMGvY8fDVYkwKgrEgG7rkZw6dmALwEr+IAYAD9ngQAAAQEICiVF0eUAS114FwMDACXwZuAMzzHt97ZyjO39DSkFoBZdHFHJZUlTmsJ7MnD+3N\/jhCYy"} 00425{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"facebook.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472393123,"pkt_ts_usec":968321,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"mAyC0zx8MFLLbJwbCABFAAA0dSRAAEAGZLTAqCsSHw1WJK5GAbsvASwecOnZqoAQAO1hEgAAAQEICgBLXZ4lRdHl"} 02314{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"facebook.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472393124,"pkt_ts_usec":87521,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"pkt":"MFLLbJwbmAyC0zx8CABFAAWgCSBAAFMGuEwfDVYkwKgrEgG7rkZw6dmqLwEr+IAQAD\/xPQAAAQEICiVF0mIAS114FwMDBfTwZuAMzzHt+F\/CnhQc4vog1mXqgUZ7RovGYIf4aFPsiVxEl4j6uvny01g1HY6CBgPuO4sMMP0VKo58e\/op5HRJ64ooOSmwtghUYOYrD54VKVDnxPI\/StkMSinVYzLPaZzw\/M1yLnJ6M78+Bu1Xzt\/gKy6A+MGHvUIf1GPzb+AwCG0XotLwxlTIg3\/MmjciLEwsjGHxiJkEjLN82mGKZu4zJ3N3uyhp5fJSHAbiJ4MXgne2LRjkGFnoXhzV25ABOUQUX6BPTDM8YrAMKPsuVIUsq5qyXXzTYsrimkbBLe++PLrcRI97c4M0M6J5cF8eoanyXRRRcNqKrZEenJQGf6VNxZO974VnB0\/Jck1VYDdyz3esX3JphaCS5oeDahP75ZwLlYD\/el8mOsXWly7ZzB\/MNhB9u4gP2e5R0fZXmbgcaqbkCOYnPmjlwAwNjO+CKYvGZrEYmAb3DUbQon+vciE9Gh3fraldg4xNx0Unr1MZEAiwOxUhIy\/kbx4BhQaBgBqXt0cb2N9mgpdXTKwwYbx3ET9Ev+Nq8eJmgNpLdk2FEQRz2+\/swRlxb9wKznyl+GtIQifFL30gxdlmmNv2V8MGgY6Bpik3KNjMhpyE4LDCy1hoKsiw35gfIh1dfQWgVF+NeJd6I5btZ\/L\/JBVApU38+cIIgxjB5eBP45OzfOUol5vz5Ds2LMYzkXLrgL4fRfn5qH52w38zGW8T+CadqAJleSXsNbrX5JXHYqJx6HxIhnYkGqMGK2dU692XQLtg0hcEJD1397W9181YyiKnRPSfl8kFe4JsjrJQhBF2oAisZ+F\/sFybYwicovw3hcVUS\/+MM8l7fN7F17pQOuasUdmqLBvAj00Cf0y1B9tpPYxQGZcRPdC4C99pWoYtTTaKrsG23KIbYStpVMS6soexTSPR7xdY7LSPumwUbMrPeADSIxzJz0SXXvDKG3fykIUEaEh7ovOGhqs6Pv6eJ9cchQ4Quz6OZvHxuM6Ll\/wQonAMDdl4nozVygotuVtEB\/r0slhT0qHsnyHp\/C9f6b6sRUHrll7jb99Cj3WszOGc8+y+NM6mN5fN3JGy2cFQJUbZCVD5JNZkmfSDY56H\/oSma\/wSionWOvplj0WSqlc512FY7RMVZS7rorj7D9Lm0ZzYGo+JBW5YJDouUOP99Aei+3qU4pI9xCJCg1yIoma2N+ZG+n76z72ZAAaNeWbFaQ9z610MopjNuhVVsVk\/hAyFMzGTGbhs\/WG9yOavdTToAL68tXUCoRJF88ZfOjRINv+b\/m\/zdqK4XMLpYwkkmtBWnLPbIktxXaMwDWPHw1E8NCxpKHIU8qcXMTagjXwTOTAfHbE2BvwuvYVwy5tgglBwegL9dB6xW8WO5D4rul3PKNO36o+A7RLWJgo\/7\/gD7FMMqi29XFPaq2G07BefT1OVbTFbW3O0uSozE5X\/EiHPn1Ts4sX\/G8s41bbkWcuJF2+rO0O1HG8dN+DmyOCPkk1AOMvT0O+V9oR5xFuirOQcHXZPpHDu8plVBrr+3qZgOmIWj5g5cjnYrncmd40kAgqxsDyVCCvmws+PtrgbH1vQk+682M85K2\/kHGVGiNbwiHrUmRoLwzWNAlejGLoiuOoXWhnPE\/nLesC5ZR7QliWUPg5RgWuwveUB4rfa4tlujgiKoXv0pgyhXfcfbLcm5Zr\/7NyUCLo2jnw+b7Y1qqPSBLP0vccfDk3eBh3IwPZJg5ZmZQaCVwzquphe7W4bHr0wdJIzJibEfBiICpoNq3Ly2cYVCDFTeVfZsVtdWCiIOmkg4+ha5qE73D6jX+3ha8dDGlybO2L29HSXijqjQbYATwm9lTdIQmGcxOs="} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":60,"source":"facebook.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":19,"flow_first_seen":1472393122365,"flow_last_seen":1472393123665,"flow_tot_l4_data_len":5099,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":268,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.18","dst_ip":"66.220.156.68","src_port":52066,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":60,"source":"facebook.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":41,"flow_first_seen":1472393123550,"flow_last_seen":1472393124229,"flow_tot_l4_data_len":23372,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":570,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.18","dst_ip":"31.13.86.36","src_port":44614,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":60,"source":"facebook.pcap","alias":"nDPId-test"} diff --git a/test/results/fix.pcap.out b/test/results/fix.pcap.out index a94ad598a..1ddf405d3 100644 --- a/test/results/fix.pcap.out +++ b/test/results/fix.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"fix.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"fix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1493755109242,"flow_last_seen":0,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":118,"flow_max_l4_data_len":118,"flow_avg_l4_data_len":118,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":43594,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00540{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"fix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1493755109,"pkt_ts_usec":242949,"pkt_caplen":152,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":152,"pkt_l4_len":118,"pkt":"THK5MeMlACJNe\/gxCABFAACKT3MAAPUGlw4IERYfwKgAFA+gqko3bYCMRQ1qAYAY\/\/+s3wAAAQEICsq+JozkIvOrOD1PATk9MDA3NQEzNT1HAQIgAAANgQxAKWj1wo9cKQAAAAEAABRnDEBj4euA7PpqAAAAAQAADiEMQENwo99tuUEAAAABAAAMAwxAYm64YJmdywAAAAE="} 00491{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"fix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1493755109242,"flow_last_seen":0,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":118,"flow_max_l4_data_len":118,"flow_avg_l4_data_len":118,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":43594,"l4_proto":"tcp","ndpi": {"proto":"FIX","breed":"Safe","category":"RPC"}} @@ -170,3 +171,16 @@ 00459{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1243,"source":"fix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1493755131,"pkt_ts_usec":957249,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"THK5MeMlACJNe\/gxCABFAABP8AAAADIGm\/PQ9WsDwKgAFA+glvYLJrDvYuT941AYYmg0UgAAOD1GSVguNC4xATk9MDAwMTQBMzU9MQExMTI9ZmFybQExMD0yMTcB"} 00527{"flow_id":9,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1244,"source":"fix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1493755131,"pkt_ts_usec":957560,"pkt_caplen":139,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":139,"pkt_l4_len":105,"pkt":"ACJNe\/gxTHK5MeMlCABFAAB9POlAAEAGAN3AqAAU0PVrA5b2D6Bi5P3jCyaxFlAY\/GwoNwAAOD1GSVhDT01QATk9NzABeJwFwbENgDAQA0D9QET2Jw5JJLdIbEBLQ0fD\/gV3w8d5lVYY00BTVBlRm0GN2kPpBHcIuXEujSUGmX7u7w3CVI8f3Z4N2A=="} 00405{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1247,"source":"fix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1493755132,"pkt_ts_usec":7515,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"THK5MeMlACJNe\/gxCABFAAAo8AEAADIGnBnQ9WsDwKgAFA+glvYLJrEWYuT+OFAQYmiMxgAA"} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":456,"flow_first_seen":1493755109301,"flow_last_seen":1493755132102,"flow_tot_l4_data_len":23399,"flow_min_l4_data_len":20,"flow_max_l4_data_len":477,"flow_avg_l4_data_len":51,"midstream":1,"l3_proto":"ip4","src_ip":"208.245.107.3","dst_ip":"192.168.0.20","src_port":4000,"dst_port":45578,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":70,"flow_first_seen":1493755109440,"flow_last_seen":1493755131870,"flow_tot_l4_data_len":2792,"flow_min_l4_data_len":20,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":39,"midstream":1,"l3_proto":"ip4","src_ip":"208.245.107.3","dst_ip":"192.168.0.20","src_port":4000,"dst_port":45584,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":36,"flow_first_seen":1493755110328,"flow_last_seen":1493755132019,"flow_tot_l4_data_len":2072,"flow_min_l4_data_len":32,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":57,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":40918,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":6,"flow_first_seen":1493755117668,"flow_last_seen":1493755127687,"flow_tot_l4_data_len":441,"flow_min_l4_data_len":32,"flow_max_l4_data_len":118,"flow_avg_l4_data_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":40928,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":11,"flow_first_seen":1493755116662,"flow_last_seen":1493755126832,"flow_tot_l4_data_len":621,"flow_min_l4_data_len":20,"flow_max_l4_data_len":118,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"217.192.86.32","dst_ip":"192.168.0.20","src_port":4000,"dst_port":53330,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":222,"flow_first_seen":1493755109242,"flow_last_seen":1493755131889,"flow_tot_l4_data_len":17013,"flow_min_l4_data_len":32,"flow_max_l4_data_len":254,"flow_avg_l4_data_len":76,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":43594,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":10,"flow_first_seen":1493755109301,"flow_last_seen":1493755128771,"flow_tot_l4_data_len":721,"flow_min_l4_data_len":32,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":72,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":47952,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":10,"flow_first_seen":1493755109654,"flow_last_seen":1493755129718,"flow_tot_l4_data_len":695,"flow_min_l4_data_len":32,"flow_max_l4_data_len":118,"flow_avg_l4_data_len":69,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":47962,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":401,"flow_first_seen":1493755109264,"flow_last_seen":1493755132120,"flow_tot_l4_data_len":21072,"flow_min_l4_data_len":32,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":52,"midstream":1,"l3_proto":"ip4","src_ip":"8.17.22.31","dst_ip":"192.168.0.20","src_port":4000,"dst_port":47968,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":10,"flow_first_seen":1493755111956,"flow_last_seen":1493755132007,"flow_tot_l4_data_len":572,"flow_min_l4_data_len":20,"flow_max_l4_data_len":105,"flow_avg_l4_data_len":57,"midstream":1,"l3_proto":"ip4","src_ip":"208.245.107.3","dst_ip":"192.168.0.20","src_port":4000,"dst_port":38646,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":18,"flow_first_seen":1493755110320,"flow_last_seen":1493755130355,"flow_tot_l4_data_len":1007,"flow_min_l4_data_len":20,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":55,"midstream":1,"l3_proto":"ip4","src_ip":"208.245.107.3","dst_ip":"192.168.0.20","src_port":4000,"dst_port":38652,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":11,"flow_first_seen":1493755113353,"flow_last_seen":1493755123449,"flow_tot_l4_data_len":621,"flow_min_l4_data_len":20,"flow_max_l4_data_len":119,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"208.245.107.3","dst_ip":"192.168.0.20","src_port":4000,"dst_port":39094,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1261,"source":"fix.pcap","alias":"nDPId-test"} diff --git a/test/results/ftp.pcap.out b/test/results/ftp.pcap.out index 815e939fa..324be94bb 100644 --- a/test/results/ftp.pcap.out +++ b/test/results/ftp.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ftp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ftp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1552590234892,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50694,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590234,"pkt_ts_usec":892296,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2xCwDBkn+CABFAABAAABAAEAGAADAqAHUWoJGScYGABWjI5ftAAAAALAC\/\/9jegAAAgQFtAEDAwUBAQgKO1eYmQAAAAAEAgAA"} 00431{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590234,"pkt_ts_usec":919708,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xCwDBkn+EBMx8Tl2CABFAAA8AABAADYG4XRagkZJwKgB1AAVxgZYKsHSoyOX7qASqbA+KAAAAgQFrAQCCAoSZ\/tNO1eYmQEDAw4="} @@ -43,3 +44,6 @@ 00420{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590241,"pkt_ts_usec":605580,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2xCwDBkn+CABFCAA0AABAAEAGAADAqAHUWoJGScYIX8sNBxpPDE6a8YAQEABjbgAAAQEICjtXspsSaAHT"} 02347{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"ftp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1552590241,"pkt_ts_usec":605595,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xCwDBkn+EBMx8Tl2CABFAAXUeOhAADYGYvRagkZJwKgB1F\/LxggMTprxDQcaT4AQAAMXWQAAAQEIChJoAdM7V7J9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":323,"source":"ftp.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":255,"flow_first_seen":1552590241545,"flow_last_seen":1552590241726,"flow_tot_l4_data_len":224192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":879,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50696,"dst_port":24523,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1192,"source":"ftp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":68,"flow_first_seen":1552590234892,"flow_last_seen":1552590243371,"flow_tot_l4_data_len":3259,"flow_min_l4_data_len":32,"flow_max_l4_data_len":273,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50694,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1192,"source":"ftp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":9,"flow_first_seen":1552590236580,"flow_last_seen":1552590236666,"flow_tot_l4_data_len":1513,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1237,"flow_avg_l4_data_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.212","dst_ip":"90.130.70.73","src_port":50695,"dst_port":25685,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1192,"source":"ftp.pcap","alias":"nDPId-test"} diff --git a/test/results/ftp_failed.pcap.out b/test/results/ftp_failed.pcap.out index 8e19b2a6d..7d9962b3e 100644 --- a/test/results/ftp_failed.pcap.out +++ b/test/results/ftp_failed.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ftp_failed.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1574361625864,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00468{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361625,"pkt_ts_usec":864342,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACgGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3QbUAAAAAoAJwgHzLAAACBAWgBAIICpYFXqIAAAAAAQMDBw=="} 00470{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361625,"pkt_ts_usec":878212,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"ZABqYzXM9LUv\/K\/wht1gC1mOACgGOioACAAQEAAAAAAAAAAAAAEqAA1AAAEAAwGSABIBkwARABWutHAVBmyZN0G2oBL\/\/zbpAAACBAWgBAIIClbTSMOWBV6iAQMDDg=="} @@ -14,3 +15,6 @@ 00465{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":74667,"pkt_caplen":92,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":92,"pkt_l4_len":38,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACYGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3QchwFQbPgBgA4XzJAAABAQgKlgV6zFbTThFRVUlUDQo="} 00479{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":88560,"pkt_caplen":100,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":100,"pkt_l4_len":46,"pkt":"ZABqYzXM9LUv\/K\/wht1gC1mOAC4GOioACAAQEAAAAAAAAAAAAAEqAA1AAAEAAwGSABIBkwARABWutHAVBs+ZN0HOgBgCAFELAAABAQgKVtNPzpYFeswyMjEgR29vZGJ5ZS4NCg=="} 00457{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ftp_failed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574361633,"pkt_ts_usec":88598,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"9LUv\/K\/wZABqYzXMht1gC5eXACAGQCoADUAAAQADAZIAEgGTABEqAAgAEBAAAAAAAAAAAAABrrQAFZk3Qc5wFQbdgBAA4XzDAAABAQgKlgV62lbTT84="} +00620{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_tot_l4_data_len":728,"flow_min_l4_data_len":32,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","ndpi": {"proto":"FTP_CONTROL","breed":"Unsafe","category":"Download-FileTransfer-FileSharing"},"ftp": {"user":"hello","password":"","auth_failed":1}} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":18,"flow_first_seen":1574361625864,"flow_last_seen":1574361633102,"flow_tot_l4_data_len":728,"flow_min_l4_data_len":32,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:192:12:193:11","dst_ip":"2a00:800:1010::1","src_port":44724,"dst_port":21,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":18,"source":"ftp_failed.pcap","alias":"nDPId-test"} diff --git a/test/results/fuzz-2006-06-26-2594.pcap.out b/test/results/fuzz-2006-06-26-2594.pcap.out index 18534e88e..38b1ec16b 100644 --- a/test/results/fuzz-2006-06-26-2594.pcap.out +++ b/test/results/fuzz-2006-06-26-2594.pcap.out @@ -1,3 +1,4 @@ +00397{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469540839,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00480{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469540,"pkt_ts_usec":839312,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/AODtAW69CABFAABOaYwAAIARTMHAqAECwKgB\/wCJAIkAOlu0hOcBEAABAAAAAAAAIEVGRURFSkZQRUVFUEVORUJFSkVPU0FDQUNBQ0FDQUJNAAAgAAE="} 00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469540839,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}} @@ -1422,3 +1423,36 @@ 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_first_seen":1120471107427,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2832,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00467{"flow_id":253,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120471107,"pkt_ts_usec":427770,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"ADBUADRWAODtAW69CABFAABIbJIAAIARSuLAqAECwKgBAQsQADUANDd+8jYBAAABAAAAAAAABF9zaXAEX3VkcANzaXAJY3liZXJjaXR5AmRrAAAhAAE="} 00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_first_seen":1120471107427,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2832,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"_sip._udp.sip.cybercity.dk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":2,"flow_first_seen":1120470717078,"flow_last_seen":1120470717080,"flow_tot_l4_data_len":864,"flow_min_l4_data_len":308,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":432,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":7,"flow_first_seen":1120470658556,"flow_last_seen":1120470672075,"flow_tot_l4_data_len":406,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.41","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":69,"flow_first_seen":1120469540839,"flow_last_seen":1120471067960,"flow_tot_l4_data_len":3994,"flow_min_l4_data_len":50,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":3,"flow_first_seen":1120470657808,"flow_last_seen":1120470666317,"flow_tot_l4_data_len":546,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.41","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":55,"flow_first_seen":1120469680188,"flow_last_seen":1120471094413,"flow_tot_l4_data_len":22027,"flow_min_l4_data_len":13,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":400,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":3,"flow_first_seen":1120470764674,"flow_last_seen":1120470768028,"flow_tot_l4_data_len":219,"flow_min_l4_data_len":42,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":3,"flow_first_seen":1120470775129,"flow_last_seen":1120470779409,"flow_tot_l4_data_len":178,"flow_min_l4_data_len":42,"flow_max_l4_data_len":94,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2794,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":4,"flow_first_seen":1120470775049,"flow_last_seen":1120470779408,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":42,"flow_max_l4_data_len":94,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2795,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":3,"flow_first_seen":1120470779487,"flow_last_seen":1120470782692,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2796,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":2,"flow_first_seen":1120470796801,"flow_last_seen":1120470796802,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2797,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":2,"flow_first_seen":1120470800175,"flow_last_seen":1120470806184,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2798,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":3,"flow_first_seen":1120470814334,"flow_last_seen":1120470817390,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2800,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":2,"flow_first_seen":1120470831400,"flow_last_seen":1120470831402,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2801,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":3,"flow_first_seen":1120470832512,"flow_last_seen":1120470840523,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2802,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":2,"flow_first_seen":1120470848525,"flow_last_seen":1120470848527,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2803,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":3,"flow_first_seen":1120470848643,"flow_last_seen":1120470851639,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2804,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":5,"flow_first_seen":1120470865712,"flow_last_seen":1120470874723,"flow_tot_l4_data_len":260,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2806,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":2,"flow_first_seen":1120470883845,"flow_last_seen":1120470885848,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2808,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":2,"flow_first_seen":1120470899859,"flow_last_seen":1120470899861,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2809,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":3,"flow_first_seen":1120470900860,"flow_last_seen":1120470904866,"flow_tot_l4_data_len":156,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2810,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":4,"flow_first_seen":1120470949427,"flow_last_seen":1120470958433,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":2,"flow_first_seen":1120470966852,"flow_last_seen":1120470975858,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2814,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":4,"flow_first_seen":1120470983999,"flow_last_seen":1120470993243,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2816,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":4,"flow_first_seen":1120471001714,"flow_last_seen":1120471010718,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2823,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":2,"flow_first_seen":1120471018720,"flow_last_seen":1120471018721,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2824,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":5,"flow_first_seen":1120471019307,"flow_last_seen":1120471028313,"flow_tot_l4_data_len":260,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2825,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":2,"flow_first_seen":1120471036315,"flow_last_seen":1120471036317,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2826,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":1120471077370,"flow_last_seen":1120471078365,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2829,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":4,"flow_first_seen":1120471084097,"flow_last_seen":1120471088463,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":42,"flow_max_l4_data_len":94,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2830,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":2,"flow_first_seen":1120471094410,"flow_last_seen":1120471094412,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":48,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2831,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":1,"flow_first_seen":1120471107427,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"192.168.1.1","src_port":2832,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":5,"flow_first_seen":1120470985421,"flow_last_seen":1120470985466,"flow_tot_l4_data_len":900,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00141{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":691,"source":"fuzz-2006-06-26-2594.pcap","alias":"nDPId-test"} diff --git a/test/results/fuzz-2006-09-29-28586.pcap.out b/test/results/fuzz-2006-09-29-28586.pcap.out index b09141647..1d15654da 100644 --- a/test/results/fuzz-2006-09-29-28586.pcap.out +++ b/test/results/fuzz-2006-09-29-28586.pcap.out @@ -1,3 +1,4 @@ +00398{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00391{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1031854484,"pkt_ts_usec":481540,"pkt_caplen":60,"pkt_type":2304,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"CAAgsl17AFCLk5N8CQBFAAAo8EpAAIAGrEqsFAMFrBQDDQooAFDkFf3+yWv\/bVARIal6iQAABIGD1GDD"} 00170{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","type":2304} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1031854484481,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"172.20.3.13","dst_ip":"172.20.3.5","src_port":80,"dst_port":2600,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -249,3 +250,12 @@ 00384{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":130,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1031854568,"pkt_ts_usec":982532,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":54,"pkt_l4_len":0,"pkt":"AFCLk5N8CAAgsl17CABFAAAoxOJAl0AGF7OsFAMNrBQDBQBQCi7Kxgh65UF0ElARgyyXWQAA"} 00187{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":130,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","l4_data_len":20} 00432{"flow_id":26,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1031854568,"pkt_ts_usec":982740,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"DAAgsl17AFCLk5N8CABFAAAoVktAAIAGRkqsFAMFrBQDDQouAFDlQXQSysYIe1AQHWv9GgAAAAAAZAAA"} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":12,"flow_first_seen":1031854562488,"flow_last_seen":1031854567701,"flow_tot_l4_data_len":1208,"flow_min_l4_data_len":15,"flow_max_l4_data_len":447,"flow_avg_l4_data_len":100,"midstream":1,"l3_proto":"ip4","src_ip":"172.20.3.13","dst_ip":"172.20.3.5","src_port":53136,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":6,"flow_first_seen":1031854514843,"flow_last_seen":1031854525904,"flow_tot_l4_data_len":271,"flow_min_l4_data_len":20,"flow_max_l4_data_len":163,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2603,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":9,"flow_first_seen":1031854532142,"flow_last_seen":1031854543315,"flow_tot_l4_data_len":2011,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2604,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":5,"flow_first_seen":1031854535021,"flow_last_seen":1031854546079,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":20,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":21,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2605,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":5,"flow_first_seen":1031854535021,"flow_last_seen":1031854546079,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":20,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":21,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2605,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":13,"flow_first_seen":1031854557802,"flow_last_seen":1031854568982,"flow_tot_l4_data_len":4776,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":367,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2606,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":6,"flow_first_seen":1031854562320,"flow_last_seen":1031854562528,"flow_tot_l4_data_len":551,"flow_min_l4_data_len":20,"flow_max_l4_data_len":443,"flow_avg_l4_data_len":91,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.5","dst_ip":"172.20.3.13","src_port":2607,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":4,"flow_first_seen":1031854565447,"flow_last_seen":1031854565700,"flow_tot_l4_data_len":792,"flow_min_l4_data_len":20,"flow_max_l4_data_len":728,"flow_avg_l4_data_len":198,"midstream":0,"l3_proto":"ip4","src_ip":"172.20.3.13","dst_ip":"172.20.3.5","src_port":80,"dst_port":2608,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00142{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":131,"source":"fuzz-2006-09-29-28586.pcap","alias":"nDPId-test"} diff --git a/test/results/fuzz-2020-02-16-11740.pcap.out b/test/results/fuzz-2020-02-16-11740.pcap.out index 080e3e074..71b49bd68 100644 --- a/test/results/fuzz-2020-02-16-11740.pcap.out +++ b/test/results/fuzz-2020-02-16-11740.pcap.out @@ -1,3 +1,4 @@ +00398{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1528996067791,"flow_last_seen":0,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":711,"flow_max_l4_data_len":711,"flow_avg_l4_data_len":711,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.64.30","dst_ip":"108.226.25.53","src_port":29200,"dst_port":1812,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01347{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1528996067,"pkt_ts_usec":791491,"pkt_caplen":745,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":745,"pkt_l4_len":711,"pkt":"AAAMB6xAABRP+4rqCABFAALbIMZAAP8RAAAKDEAebOIZNXIQBxQCxwAAAQoCv14OK3h3MxRiiuPV6g7+kV4aCgAAV8gOBFVTGgwAAFfIDQZ3aWZpGg8AAFfICQlXSVNQUjEwGgkAADikDQM2NwZbIqDjATUwMzExNDgwMjeaNTE2NDgwQHdsYW4ubW5jNDgwLm1jYzMxMS4zZ3BwbmV0d29yay5vcmdZAxB+CDFjaXNjb4MGAAAAAR8TZmMtZGItYjMtMDgtZmYtMTQeJTAwLWE3LTQyLWQwLWUwLTAwOlZlcml6b25XVkZpd2NjZXNzBQYAAAAIGjEAAAAJASthdWRpdC1zZXNzaW9uLUlkPTEwZmYxMGFjMDAwMDAwYjFkMWEwMjI1YiwgNWIyMmEwZDEvZmM6ZGI6YjM6MDg6ZmY6MTQvMjA1BAasFAEQIA5WWldDMlRlc3RMYWI6DAAAN2MBBgAAAAIGBgAAAEQlAAAABRQ9BgAAABNABgAAAA1BBgAAAAZRRTU2TzoCAQA4ATAzMTE0ODAyNzE1MTY0ODBAd2xhbi5tbmM0ODAubWNjMzExLjNncHBuZXR3b3JrLm+qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqg=="} 00524{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1528996067791,"flow_last_seen":0,"flow_tot_l4_data_len":711,"flow_min_l4_data_len":711,"flow_max_l4_data_len":711,"flow_avg_l4_data_len":711,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.64.30","dst_ip":"108.226.25.53","src_port":29200,"dst_port":1812,"l4_proto":"udp","ndpi": {"proto":"Radius","breed":"Acceptable","category":"Network"}} @@ -466,3 +467,9 @@ 00172{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":357,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","type":2064} 01247{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":361,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1528998639,"pkt_ts_usec":586727,"pkt_caplen":697,"pkt_type":22528,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":697,"pkt_l4_len":0,"pkt":"AAAMB6xAABRP+4rqWABFAAKrIW5AAP8RAAAKCEAexuIZNXIQBxQClwAAAcACj3BXfw4b3GMlZswG9bQoL7gaCgAAV8gOBFVTGgwAAFfIDQZXaWZpJQAAAFfICQlXSVNQUjEwGgkAADghDQMzNwZbIqrvATUwMzExNDgwMjMyNTY4NjMxQHdsYW4ubW5jNDkwLm1jYzMxMS4zZ3BwbmV0d29yay5vcmdZAxB+CDFjaXNjb4MGAAAAAR8TOTAtYjAtZWQtNGUtNzctYTMeJTAwLWE3LTQyLWQwLWUwLXAwOlZlcml6b25XaUZpQWNjZXNzBQYAAAAIGjEAAAAJESthdWRpdC1zZXNzaW9uLWlkPTEwZmYxMGFjMDAwMDAwZDZlYmFhMjI1YiwgNWIybWFhZWIvOTA6YjA6ZWQ6NGU6Nzc6YTMvMjQ1BAasFAEQIA5WWldDMlRlc3RMYWIaDAAAN2MBBgAAAAIGBgAAAAIMBgAABRQ9BgAAABNABgAAAA1BBgAAAAZRBDU2T2cCAAAIbQwAABoUAABXyAcOVlpXQzJUZXN0TGFiGgoAAFfICARFVBoQAABXyAoKU3RhbmRhcmQaEAAAV8gLClRlc3QgTGFiGgkAAFfIDwMxGgoAAFfIEAROShoRAABXyBELTHluZGh1cnN0GgwAAFfIEgYAAADJGhdWAFfIHRFWWlcgQzIgVGVzdDdMYWIaCwAAV8glBVZ6VxoNAAA4IQ4HMDcwNzEaDAAAOCERcAAAAAAaFQAAOCESD0ludmFsaWQgVmFsdWUaHQAAOCETFzQwLjgwNDg4Mk4tNzQuMTAyODM5VxoMAAA4IRQGAAABAhoMAAA4IRUGAAAAAhoVAAA4IRYPU3RhZGl1bURpcmVjdBoMAAAFgwcGwFBKmVASZHVbxXaB7Y4HBclkU5O1hA=="} 00173{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":361,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","type":22528} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":18,"flow_first_seen":1528997050187,"flow_last_seen":1528998557443,"flow_tot_l4_data_len":9435,"flow_min_l4_data_len":131,"flow_max_l4_data_len":711,"flow_avg_l4_data_len":524,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.64.30","dst_ip":"198.226.25.62","src_port":29200,"dst_port":1812,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":200,"flow_first_seen":1528996068129,"flow_last_seen":1528998643334,"flow_tot_l4_data_len":90603,"flow_min_l4_data_len":145,"flow_max_l4_data_len":711,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.64.30","dst_ip":"198.226.25.53","src_port":29200,"dst_port":1812,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":4,"flow_first_seen":1528997997929,"flow_last_seen":1528998605741,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":113,"flow_max_l4_data_len":657,"flow_avg_l4_data_len":380,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.64.30","dst_ip":"198.226.25.53","src_port":29200,"dst_port":1813,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1528998636010,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"198.226.25.53","dst_ip":"10.12.64.30","l4_proto":37,"ndpi": {"proto":"Unknown","breed":"Unrated"}} +00458{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1528998636010,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"198.226.25.53","dst_ip":"10.12.64.30","l4_proto":37,"flow_datalink":1,"flow_max_packets":15} +00142{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":366,"source":"fuzz-2020-02-16-11740.pcap","alias":"nDPId-test"} diff --git a/test/results/git.pcap.out b/test/results/git.pcap.out index 9a6f405e3..ebb98789e 100644 --- a/test/results/git.pcap.out +++ b/test/results/git.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"git.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"git.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460821630164,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.77","dst_ip":"5.153.231.21","src_port":47991,"dst_port":9418,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00430{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460821630,"pkt_ts_usec":164056,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"nJcm0ghCPJcOZtCOCABFAAA8Q1ZAAEAGScLAqABNBZnnFbt3JMp+hgtEAAAAAKACchB0gwAAAgQFtAQCCAoBp0gSAAAAAAEDAwo="} 00430{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460821630,"pkt_ts_usec":221958,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PJcOZtCOnJcm0ghCCABFCAA8AABAAC8GnhAFmecVwKgATSTKu3dqwE5VfoYLRaASOJBfrwAAAgQFrAQCCAorjWmrAadIEgEDAwc="} @@ -15,3 +16,5 @@ 00422{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460821630,"pkt_ts_usec":471592,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PJcOZtCOnJcm0ghCCABFCAA0J\/NAAC8GdiUFmecVwKgATSTKu3dqwFKffoYNooAQAHq\/YgAAAQEICiuNaeoBp0hU"} 00433{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460821630,"pkt_ts_usec":471621,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PJcOZtCOnJcm0ghCCABFCAA8J\/RAAC8GdhwFmecVwKgATSTKu3dqwFKffoYNooAYAHrFngAAAQEICiuNaeoBp0hUMDAwOE5BSwo="} 02347{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"git.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460821630,"pkt_ts_usec":489457,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"PJcOZtCOnJcm0ghCCABFCAXUJ\/VAAC8GcIMFmecVwKgATSTKu3dqwFKnfoYNooAQAHrgqAAAAQEICiuNae4Bp0hUMDAyMgJDb3VudGluZyBvYmplY3RzOiAxMjYsIGRvbmUuCjAwMjkCQ29tcHJlc3Npbmcgb2JqZWN0czogICAxJSAoMS81NykgICANMDAyOQJDb21wcmVzc2luZyBvYmplY3RzOiAgIDMlICgyLzU3KSAgIA0wMDI5AkNvbXByZXNzaW5nIG9iamVjdHM6ICAgNSUgKDMvNTcpICAgDTAwMjkCQ29tcHJlc3Npbmcgb2JqZWN0czogICA3JSAoNC81NykgICANMDAyOQJDb21wcmVzc2luZyBvYmplY3RzOiAgIDglICg1LzU3KSAgIA0wMDI5AkNvbXByZXNzaW5nIG9iamVjdHM6ICAxMCUgKDYvNTcpICAgDTAwMjkCQ29tcHJlc3Npbmcgb2JqZWN0czogIDEyJSAoNy81NykgICANMDAyOQJDb21wcmVzc2luZyBvYmplY3RzOiAgMTQlICg4LzU3KSAgIA0wMDI5AkNvbXByZXNzaW5nIG9iamVjdHM6ICAxNSUgKDkvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDE3JSAoMTAvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDE5JSAoMTEvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDIxJSAoMTIvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDIyJSAoMTMvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDI0JSAoMTQvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDI2JSAoMTUvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDI4JSAoMTYvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDI5JSAoMTcvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDMxJSAoMTgvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDMzJSAoMTkvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDM1JSAoMjAvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDM2JSAoMjEvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDM4JSAoMjIvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQwJSAoMjMvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQyJSAoMjQvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQzJSAoMjUvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQ1JSAoMjYvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQ3JSAoMjcvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDQ5JSAoMjgvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDUwJSAoMjkvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDUyJSAoMzAvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDU0JSAoMzEvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDU2JSAoMzIvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDU3JSAoMzMvNTcpICAgDTAwMmECQ29tcHJlc3Npbmcgb2JqZWN0czogIDU5"} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":90,"source":"git.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":90,"flow_first_seen":1460821630164,"flow_last_seen":1460821631269,"flow_tot_l4_data_len":70945,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2912,"flow_avg_l4_data_len":788,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.77","dst_ip":"5.153.231.21","src_port":47991,"dst_port":9418,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":90,"source":"git.pcap","alias":"nDPId-test"} diff --git a/test/results/google_ssl.pcap.out b/test/results/google_ssl.pcap.out index fe2c9276e..144c413b2 100644 --- a/test/results/google_ssl.pcap.out +++ b/test/results/google_ssl.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"google_ssl.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"google_ssl.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1434443394683,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.31.3.224","dst_ip":"216.58.212.100","src_port":42835,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"google_ssl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434443394,"pkt_ts_usec":683939,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"AA6OTbSogMbKAJ6fCABFAAAsBqJAAEAG14usHwPg2DrUZKdTAbt6Z3LqAAAAAGACFtCOVwAAAgQFtA=="} 00417{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"google_ssl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434443394,"pkt_ts_usec":717671,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"gMbKAJ6fAA6OTbSoCABFAAAseLYAADMGsnfYOtRkrB8D4AG7p1PuIxETemdy62ASp5T+aAAAAgQFlgAA"} @@ -14,3 +15,6 @@ 02343{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"google_ssl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434443398,"pkt_ts_usec":327656,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"gMbKAJ6fAA6OTbSoCABFAAW+fNkAADMGqMLYOtRkrB8D4AG7p1PuIxaqemdzaVAQp5RWwgAASW50ZXJuZXQgQXV0aG9yaXR5IEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnCoEd1zYUJE6BqOC4NhQSLyJP\/EZcBqIRn7gj8Xxic4h7lr+YQ23MkSJoHQLU09VpM6CYpXu61lfxuEFgBLEXpQ\/vFtIOPRT9yTm+5HpFcTP9FMN9Er8n1Tefb6ga2+HwNBQHygwA0DaCHNRbH\/\/OjynNwaOvUsRBOt9JN7m+fwxcfuU1WDzLkqvQtLL6sRqGrLMU90VS4sfyBlhH82dqD5jK4Q1aWWEyBnFRiL4U5W+44BKEMYq7LqXIBHHOZkQBKDwYXqVJYxOUnXitu0IyhT8ziJqs07PRgOXlwN+wLHee69FM8+6PnG33vQlJcINNYmdnfsOEXmJHjfFr45yaQIDAQABo4HnMIHkMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4ysxOMB0GA1UdDgQWBBRK3QYWG7z2aLV29YG2u2IaulqBLzASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBBjA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vZy5zeW1jYi5jb20vY3Jscy9ndGdsb2JhbC5jcmwwLgYIKwYBBQUHAQEEIjAgMB4GCCsGAQUFBzABhhJodHRwOi8vZy5zeW1jZC5jb20wFwYDVR0gBBAwDjAMBgorBgEEAdZ5AgUBMA0GCSqGSIb3DQEBBQUAA4IBAQAnjM\/pxzu+wG\/oloT7nFxdkOR324syYJtl2IUmtbqfHt5kTh\/GyCBbCZ+rqeAJNEWiZSU3PX9abyDM+frxHY8QDAI6xMkBdpa+m\/kV2DnRxQNHdriKjDHWYNXkj9v6PMbVmCj4HI8XkTTLy1J60fs6IOThhrHYGA++1odkjcUKJUJR77I4uOAd0OH85vSvRrrvwL\/FtAX1lHUM\/qK+Arrqhlv5NbNm9cWNhaEaI3caGRdUE2CfC+G0nCgq+a4CNG0lk5yCqBd78YWw0w9Y4fux\/pyho+j9yT\/013HcvYykGeAhIyNVE4+kFgIJfrmv7ttTZL1xL7k5zjC3tLxU4EcHAAOBMIIDfTCCAuagAwIBAgIDErvmMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDIwNTIxMDQwMDAwWhcNMTgwODIxMDQwMDAwWjBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3QgR2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD99BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdqfnGk5sRgprDvgOSJKA+eJdbtg\/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDviS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU1XupGc1V3sjs0l44U+VcT4wt\/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoWMPRfwCvocWvk+QIDAQABo4HwMIHtMB8GA1UdIwQYMBaAFEjmaPkr0rKV10fYIyAQTzOYkJ\/UMB0GA1UdDgQWBBTAephojYn7qwVkDBF9qn1luMrMTjAPBgNVHRMBAf8EBTADAQH\/MA4GA1UdDwE="} 00837{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"google_ssl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434443398,"pkt_ts_usec":595261,"pkt_caplen":368,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":368,"pkt_l4_len":334,"pkt":"AA6OTbSogMbKAJ6fCABFAAFiBqhAAEAG1k+sHwPg2DrUZKdTAbt6Z3Np7iMdcFAYLLBd8wAAFgMBAQYQAAECAQCJE\/UgWC1ephqdHlX76FYEvfsgrbMWPzUiKCabJKOq+PPxveMMBWMoKrAR383+Za5DefH15hpBf6KHSBreRxt4DCtCeYZyOCOTnaHmJuA+B+CpAvxIUauUywgA0Kbv0PY\/h2DOTF85nFsyyCCRlu5+Z\/Hagc5FBjk5JLDWo82AqJaazwoDzKcLFLAkqYtOgQGuLs9u6iqKkrvx9Rlomd+2PxuohkGYjk4iGsVFmSRrlhKDxifSDIlNWNln2rjAgXo+hjOSOs+xzBkSIMieIqFTTdF9t1nhteQEs3JQXWgLW4EkCINmccl84iq7ma03klyZ8Gg+dxC3vXdte3pIvlN0FAMBAAEBFgMBACRVFaqlyGalIwzWGm3pOUlb5hIiHh6emt5yoX3HqC5Oozr9Lv4="} 00828{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"google_ssl.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434443399,"pkt_ts_usec":540882,"pkt_caplen":358,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":358,"pkt_l4_len":324,"pkt":"gMbKAJ6fAA6OTbSoCABFAAFYfNoAADMGrSfYOtRkrB8D4AG7p1PuIxxAemdzaVAYp5RnXgAAAf8EBAMCAQYwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwTgYDVR0gBEcwRTBDBgRVHSAAMDswOQYIKwYBBQUHAgEWLWh0dHBzOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvcmVwb3NpdG9yeTANBgkqhkiG9w0BAQUFAAOBgQB24RJuTksWEoYwBrKBCM\/wCMfHcX5m7sLt1Dsf\/\/DwyE7WQziwuTB9GNBVg6JqyzYRnOhIZqNtf7gT1Ef+i1pcc\/yu2RsyGTirlzQUqpbS66McFAhJtrvlke+DNusdVm\/K2rxzY5Dkf3s+Iss9B+1fOHSc4wNQTqGvmO5h8oQ\/EhYDAQAEDgAAAA=="} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":28,"source":"google_ssl.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":28,"flow_first_seen":1434443394683,"flow_last_seen":1434443401353,"flow_tot_l4_data_len":8136,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":290,"midstream":0,"l3_proto":"ip4","src_ip":"172.31.3.224","dst_ip":"216.58.212.100","src_port":42835,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":28,"source":"google_ssl.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":28,"flow_first_seen":1434443394683,"flow_last_seen":1434443401353,"flow_tot_l4_data_len":8136,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":290,"midstream":0,"l3_proto":"ip4","src_ip":"172.31.3.224","dst_ip":"216.58.212.100","src_port":42835,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":28,"source":"google_ssl.pcap","alias":"nDPId-test"} diff --git a/test/results/googledns_android10.pcap.out b/test/results/googledns_android10.pcap.out index 7608229c5..f20517871 100644 --- a/test/results/googledns_android10.pcap.out +++ b/test/results/googledns_android10.pcap.out @@ -1,3 +1,4 @@ +00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"googledns_android10.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592552824409,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"8.8.8.8","dst_ip":"192.168.1.159","src_port":853,"dst_port":55856,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552824,"pkt_ts_usec":409182,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ag\/ahpuQEBMx8Tl2CABFAAA0gpUAAHcG7tcICAgIwKgBnwNV2jAOPHBKaWPSFIARAUT59wAAAQEIChWqa0r\/\/5Cw"} 00437{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592552824,"pkt_ts_usec":632762,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ag\/ahpuQEBMx8Tl2CABFAAA0gzYAAHcG7jYICAgIwKgBnwNV2jAOPHBKaWPSFIARAUT5GAAAAQEIChWqbCn\/\/5Cw"} @@ -116,3 +117,6 @@ 00657{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":305,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592553007,"pkt_ts_usec":152248,"pkt_caplen":225,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":225,"pkt_l4_len":191,"pkt":"EBMx8Tl2ag\/ahpuQCABFAADTFhFAAEAGVcHAqAGfCAgEBLxSA1VGZWyjr3ai54AYAXiZ1AAAAQEICgAAfb9\/c2MSFwMDAJoAAAAAAAAAASvU9Egx87RbkmJ13pZK7LHbvoZqJEW+LMQCXUVUsYXXYOT0A07A9oBhbd3xAqGLJVjanY8YjA+PchbEeksYAxBUebXNWt3CLGgqUZ1zZL2W9RktPfe\/xpJ61Di5ER1tDbATkasN2MFVlbRIP0cM9hu\/oS8YMUya1uNp3pnEVI9bPChlf\/XPzz7so24uZvPXyyE2"} 00439{"flow_id":8,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":306,"source":"googledns_android10.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592553007,"pkt_ts_usec":169844,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ag\/ahpuQEBMx8Tl2CABFAAA0ShMAAHYGLF4ICAQEwKgBnwNVvFKvdqLnRmVtQoAQAPSBbwAAAQEICn9zYyYAAH2\/"} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":474,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":133,"flow_first_seen":1592552878549,"flow_last_seen":1592552996502,"flow_tot_l4_data_len":24100,"flow_min_l4_data_len":32,"flow_max_l4_data_len":549,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.4.4","src_port":48098,"dst_port":853,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":532,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":241,"flow_first_seen":1592553007037,"flow_last_seen":1592553079303,"flow_tot_l4_data_len":56597,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":234,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.4.4","src_port":48210,"dst_port":853,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00464{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":532,"source":"googledns_android10.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1592552827426,"flow_last_seen":1592552828415,"flow_tot_l4_data_len":256,"flow_min_l4_data_len":64,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.159","dst_ip":"8.8.8.8","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00140{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":532,"source":"googledns_android10.pcap","alias":"nDPId-test"} diff --git a/test/results/gquic.pcap.out b/test/results/gquic.pcap.out index cd5d27aed..d83ea6515 100644 --- a/test/results/gquic.pcap.out +++ b/test/results/gquic.pcap.out @@ -1,3 +1,6 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"gquic.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"gquic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591876186378,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"10.44.5.25","dst_ip":"216.58.213.163","src_port":61097,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02226{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"gquic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591876186,"pkt_ts_usec":378535,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"6PckTkFdoMWJ9P+XCABFAAVieo1AAIARvdoKLAUZ2DrVo+6pAbsFTko2w1EwNTAIAXaX8XoV5u8AAEU0NFnBgsF5hkBVQ9QcdhAQB7AX4STVuX+cZkTXcyq7Q06MKI3IMV7nn3XwVsYd8lSM2UQ2Mh\/Lz0P54TH133\/BjF8sKcZx48\/VepMyZjozNf6hUhocgBAvamo29IXHVqILxpkl4wjCzjbjeV119chifFcXxaTjllFkxsh3XmLG5348E\/qK2TLLnMy43JAHw6S2e1v2BO4WXkya\/bcrsjPnQYikRvTxH8li9ZflQ5PttsYcSUtQigVmzX+3zu6YljUMgwCKrGbUc4ym0tN37M5ly\/uhm21+A6fvtyySGNQfP7wJOsR1iWGsA6NR+V\/fmgbvfd72gKd0sTHFADbRPSKYDc0XDK\/X8vG8GXGEknHbOT7DGSzLKpHYvLrwIaFjsweHE6gkta44k2oP3lJ5y\/ohylLleMWOzrznvbvHmPDTo6fznFlCwcMwiT5bU7kKdr22dfJC4HZKXgrfdx\/kyr9W7YgF8ndv1gEMp60hGoa3HeIkNrwcimMUj8lo1MQMLSdfIURLgLYuYXeqNU9nrCpCTOHF8rljnTLtemFl5GKnW4QO+Vn8YQU0wC2WniPFD0JOSE\/9\/8uhjdFWVDMbiGWhYk1SCdcSCnwwatMyU\/DcpZqDI25eb58WZqvNqtnsCmojU\/8N4SjVKXFe6sqZF9Vu2GvgHDvSqxDzjeY9qlts4TuIbe+gH+w1MKU7JxNtGZ08YyKdDEVfiklQ\/xyvSgH5AGRqlnD6igJ7NF54pjKD67q+V\/b7AzUVhGIbpajDS4rvn+fDdhXSGqLFbtHNBw9zOlfyLlg3QCkztn+awCGkuUrUQJWRuzHeXcQ9Pm+GTWr4ztxdNe8GOdcH0fw\/02FqwqbZa0xgXb6ogDH\/Z7u3OTt5CsB\/hPp4imvHezect7LAbuRcIJ+tmXKeqwNdUGoyV614kYKA0aTDm4QbBmp4nIg9dspzjXHExZ33U9zxLwZ8DYwQJDoYhywocb4+jKp5OhFT0Egt5ANj4PPsKNBEjNDxnpAKCiI11YkYMyYj1BSFJ2mKW5kFXZ2\/Uk7W0jKMRykBFSaIJ+fwu1W4yhNjDR69KpOGwGw5d47DA9U+Gj7qbRCpjgb1v145AzbIQNTU\/mwU8gqij0o+rVb\/pUEtWMRho\/Yukqvj0PDpk20u\/iMNduvSEQAQLt7IA31zZMJsdzUDXqeH4lvAJTdAXDM+BfHOutfryXO0ilZKrrhbJmj03RyAieSkoI7y9TYI7udqZUukM2QcgXS180FYjb94yLuFlXG0La9U7oT6UzgYEOrDdq4bcoWorhw9j4EjTTcsFMkNO8f65TlicSD0KdGh7ggCR8NtD2qMSi4KIMxq9IHmGPWBJODrdc1+LXcmA3ApoiY81zbK2QPTdK0LHWSdeauC3LCzY9zJ5bEtZvA4hiamdfZl4E5cxC\/raRilWW9+sNuXDrAH9rw48q66KiLSEC63yDpS1q549REO+OCEIx8SKQQoN1W6tspnVZ3EKLwuCby00TS84gP7\/ke1UZsRSUTrMeCETmkIya9DRfJn3gxYto584jg1Sk6Axi4aJ8MlnhdHfC\/0XWQrVM1UOD3\/J3K5XZUZKJ5vUWJzfBTgAe8J4\/heUMD2WmkBuQIER6hh9JGvwyZ2I6vJO7KXsorNCeXZA6iFfdtk90sqEl67LnWUAJmZ\/6NzgV\/JXrGoQRR0uqoWVC\/xj1u+c66MRH8y3Tf8DUoZ1L57SrRzGrkWBB6B2RSkfxWVzZUSCgEgPU4Lp+fnv6pDzh8zifmLUphU5Jycotx7"} 00638{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"gquic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591876186378,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"10.44.5.25","dst_ip":"216.58.213.163","src_port":61097,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"client_requested_server_name":"www.gstatic.com","user_agent":"canary Chrome\/85.0.4169.0 Windows NT 10.0; Win64; x64"}} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"gquic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591876186378,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"10.44.5.25","dst_ip":"216.58.213.163","src_port":61097,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"gquic.pcap","alias":"nDPId-test"} diff --git a/test/results/h323-overflow.pcap.out b/test/results/h323-overflow.pcap.out index 1eff6992f..fa6ac59f5 100644 --- a/test/results/h323-overflow.pcap.out +++ b/test/results/h323-overflow.pcap.out @@ -1,2 +1,6 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"h323-overflow.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"h323-overflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":31337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00415{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"h323-overflow.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946681200,"pkt_ts_usec":0,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"IiIiIiIiIiIiIiIjCABFAAAsRr1AAIAG+9DAqAEBwKgBAnppAFA5fV1j4FJ\/s1AYQD3UwAAAAwAABA=="} +00511{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1,"source":"h323-overflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":31337,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00474{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"h323-overflow.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.2","src_port":31337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"h323-overflow.pcap","alias":"nDPId-test"} diff --git a/test/results/hangout.pcap.out b/test/results/hangout.pcap.out index cb6e14132..ed5e5ce0a 100644 --- a/test/results/hangout.pcap.out +++ b/test/results/hangout.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"hangout.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"hangout.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1468516947751,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"74.125.134.127","dst_ip":"10.89.61.13","src_port":19305,"dst_port":56406,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00534{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"hangout.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1468516947,"pkt_ts_usec":751092,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"CJ4BbNkmACFeRhcmCABFAACEs2cAACwRwp9KfYZ\/Clk9DUtp3FYAcAThAQEAVCESpEJmaHpqc2RpS0drd1gABgAhWWRWSldCNmwzN20xYzhENDpCbU1TU1l3ZHhBT1czSFlYAAAAACAACAABfY2fUviQAAgAFKAHosL2sVKq2EKifFUwLylv3i3sgCgABLYwivQ="} 00581{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"hangout.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1468516947751,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"74.125.134.127","dst_ip":"10.89.61.13","src_port":19305,"dst_port":56406,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.GoogleHangoutDuo","breed":"Acceptable","category":"VoIP"}} @@ -15,3 +16,5 @@ 00537{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"hangout.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1468516959,"pkt_ts_usec":761943,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"CJ4BbNkmACFeRhcmCABFAACEz3MAACwRppNKfYZ\/Clk9DUtp3FYAcACSAQEAVCESpEIwbERtNENYWTlOSXgABgAhWWRWSldCNmwzN20xYzhENDpCbU1TU1l3ZHhBT1czSFlYAAAAACAACAABfY2fUviQAAgAFLskEr4nSL5TTWv7Gw6qDRufq\/+8gCgABLRf+vQ="} 00537{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"hangout.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1468516960,"pkt_ts_usec":765333,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"CJ4BbNkmACFeRhcmCABFAACE0JgAACwRpW5KfYZ\/Clk9DUtp3FYAcHRZAQEAVCESpEJQTHJwc3FEeStHK2YABgAhWWRWSldCNmwzN20xYzhENDpCbU1TU1l3ZHhBT1czSFlYAAAAACAACAABfY2fUviQAAgAFDEX\/dQ5fy+SxiE0bgZSagBAyTwBgCgABD1H6LY="} 00536{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"hangout.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1468516961,"pkt_ts_usec":759411,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"CJ4BbNkmACFeRhcmCABFAACE0uIAACwRoyRKfYZ\/Clk9DUtp3FYAcEuMAQEAVCESpEJ3RGRuSlI1b3p6TVQABgAhWWRWSldCNmwzN20xYzhENDpCbU1TU1l3ZHhBT1czSFlYAAAAACAACAABfY2fUviQAAgAFJx22As21z4ewdrKbbQZAFr9rafBgCgABAFQq5M="} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":19,"source":"hangout.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":19,"flow_first_seen":1468516947751,"flow_last_seen":1468516965768,"flow_tot_l4_data_len":2128,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"74.125.134.127","dst_ip":"10.89.61.13","src_port":19305,"dst_port":56406,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":19,"source":"hangout.pcap","alias":"nDPId-test"} diff --git a/test/results/http-crash-content-disposition.pcap.out b/test/results/http-crash-content-disposition.pcap.out index 3afec6526..a578d7505 100644 --- a/test/results/http-crash-content-disposition.pcap.out +++ b/test/results/http-crash-content-disposition.pcap.out @@ -1,3 +1,4 @@ +00407{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00395{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492518365,"pkt_ts_usec":663977,"pkt_caplen":60,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"RQAAPNS7QABABvZlwKgAZ66BAArH4wBQe0WpbgAAAACgAjkINI0AAAIEBbQEAggKABR91QAAAAABAwMG"} 00182{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","datalink":12} 00396{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492518365,"pkt_ts_usec":767814,"pkt_caplen":60,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"RQAAPAAAQAAtBt4hroEACsCoAGcAUMfjkVcfantFqW+gEjiQ\/PYAAAIEBawEAggKK6FboQAUfdUBAwMH"} @@ -16,3 +17,4 @@ 00182{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":8,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","datalink":12} 01625{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":9,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492518365,"pkt_ts_usec":968183,"pkt_caplen":981,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":981,"pkt_l4_len":0,"pkt":"RQAD1UN3QAAtBpcRroEACsCoAGcAUMfjkVclC3tFq0qAGAB6wJEAAAEBCAoroVxpABR97jQ8L21heF9kaXNwbGF5X251bT4KCTwvbWVzc2FnZT4KCTxtZXNzYWdlPgoJCTxpZD4yMDwvaWQ+CgkJPHRpdGxlPkEgUGVwIFRhbGsgZnJvbSBLaWQgUHJlc2lkZW50ITwvdGl0bGU+CgkJPGRlc2NyaXB0aW9uPldhdGNoIHRoZSBuZXdlc3QgdmlkZW8gZnJvbSBUaGUgR3JlZ29yeSBCcm90aGVycywgYW5kIHBlcmZvcm0geW91ciBvd24gcmVuZGl0aW9uITwvZGVzY3JpcHRpb24+CgkJPHVybD5odHRwOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9bkZHY3JZUGRySlU8L3VybD4KCQk8dHlwZT4wPC90eXBlPgoJCTxjYXRlZ29yeT4xPC9jYXRlZ29yeT4KCQk8bWF4X2Rpc3BsYXlfbnVtPjIxNDYzNTQyNDg8L21heF9kaXNwbGF5X251bT4KCTwvbWVzc2FnZT4KCTxtZXNzYWdlPgoJCTxpZD4yMTwvaWQ+CgkJPHRpdGxlPlJhcCBsaWtlIEVtaW5lbSE8L3RpdGxlPgoJCTxkZXNjcmlwdGlvbj5BdXRvUmFwIHR1cm5zIHNwZWVjaCBpbnRvIHJhcCAoYW5kIGNvcnJlY3RzIGJhZCByYXBwaW5nKS48L2Rlc2NyaXB0aW9uPgoJCTx1cmw+aHR0cDovL2FwaS5zbXVsZS5jb20vdjIvcmVkaXJlY3QvZXlKM1pXSlZjbXdpT2lKb2RIUndjem92TDNCc1lYa3VaMjl2WjJ4bExtTnZiUzl6ZEc5eVpTOWhjSEJ6TDJSbGRHRnBiSE0vYVdSY2RUQXdNMlJqYjIwdWMyMTFiR1V1WVhWMGIzSmhjQ0lzSW0xdlltbHNaVlZ5YkNJNkltMWhjbXRsZERvdkwyUmxkR0ZwYkhNL2FXUmNkVEF3TTJSamIyMHVjMjExYkdVdVlYVjBiM0poY0NJc0ltTmhiWEJoYVdkdVNXUWlPakUxTVRNc0ltRndjQ0k2SWtGVlZFOVNRVkJmUjA5UFJ5Sjk8L3VybD4KCQk8dHlwZT4wPC90eXBlPgoJCTxjYXRlZ29yeT4zPC9jYXRlZ29yeT4KCQk8bWF4X2Rpc3BsYXlfbnVtPjIxNDYwNzU0MDI8L21heF9kaXNwbGF5X251bT4KCTwvbWVzc2FnZT4KPC9tZXNzYWdlX2xpc3Q+CjwvaW1zZ3M+"} 00182{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":9,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test","datalink":12} +00149{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9,"source":"http-crash-content-disposition.pcap","alias":"nDPId-test"} diff --git a/test/results/http-lines-split.pcap.out b/test/results/http-lines-split.pcap.out index 687e59236..e57b02625 100644 --- a/test/results/http-lines-split.pcap.out +++ b/test/results/http-lines-split.pcap.out @@ -1,3 +1,4 @@ +00393{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http-lines-split.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http-lines-split.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1593713340401,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.0.20","src_port":39236,"dst_port":31337,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http-lines-split.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593713340,"pkt_ts_usec":401681,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABjzZLGIYDjgxTWgCABFAAA0t6tAAHkGyLLAqAABwKgAFJlEemkrolmxAAAAAIAC+vBZugAAAgQFtAEBBAIBAwMG"} 00432{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http-lines-split.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593713340,"pkt_ts_usec":401724,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"YDjgxTWgABjzZLGICABFAAA0AABAALIGR17AqAAUwKgAAXppmUT8ca\/AK6JZsoAS+vCBjAAAAgQFtAEBBAIBAwMH"} @@ -14,3 +15,5 @@ 00426{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"http-lines-split.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593713340,"pkt_ts_usec":404101,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGIYDjgxTWgCABFAAAot7BAAHkGyLnAqAABwKgAFJlEemkroln1\/HG2IlAQA+reqgAAAAAAAAAA"} 00426{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"http-lines-split.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593713340,"pkt_ts_usec":404575,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABjzZLGIYDjgxTWgCABFAAAot7FAAHkGyLjAqAABwKgAFJlEemkroln1\/HG2IlARA+reqQAAAAAAAAAA"} 00417{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"http-lines-split.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593713340,"pkt_ts_usec":404597,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"YDjgxTWgABjzZLGICABFAAAoAABAALIGR2rAqAAUwKgAAXppmUT8cbYiK6JZ9lAQAfbgnQAA"} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":14,"source":"http-lines-split.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":14,"flow_first_seen":1593713340401,"flow_last_seen":1593713340404,"flow_tot_l4_data_len":2003,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":143,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.0.20","src_port":39236,"dst_port":31337,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":14,"source":"http-lines-split.pcap","alias":"nDPId-test"} diff --git a/test/results/http_ipv6.pcap.out b/test/results/http_ipv6.pcap.out index 780e37e66..8a8447738 100644 --- a/test/results/http_ipv6.pcap.out +++ b/test/results/http_ipv6.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http_ipv6.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00504{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1448269123954,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4006:804::200e","src_port":40526,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http_ipv6.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1448269123,"pkt_ts_usec":954061,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"UMWNrEEBeKzApw1Mht1gAAAAACAGQCoADUAAAQADeqzA\/\/6nDUwqABRQQAYIBAAAAAAAACAOnk4Bu0sl6VcU0QFTgBAA8iVzAAABAQgKEg1o4A\/E+0k="} 00456{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http_ipv6.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1448269123,"pkt_ts_usec":971846,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"eKzApw1M9LUv\/K\/Cht1gAAAAACAGOSoAFFBABggEAAAAAAAAIA4qAA1AAAEAA3qswP\/+pw1MAbueThTRAVNLJelYgBABCVvaAAABAQgKD8WrNBINPNs="} @@ -157,3 +158,27 @@ 00791{"flow_id":14,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"http_ipv6.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1448269146,"pkt_ts_usec":931566,"pkt_caplen":328,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":328,"pkt_l4_len":274,"pkt":"eKzApw1M9LUv\/K\/Cht1gAAAAARIGOyoCJvAArQGXAAAAAAAAAjYqAA1AAAEAA3qswP\/+pw1MAbvPjOjBpxsLSryIgBgDiAPWAAABAQgKG+f7FBINf04WAwMAugQAALYAABwgALCmxpnijZhcM64vCu\/Oer5dI9ws+1Sh4C7e+6h1VezKkkWzLNFOEhCxJ\/e7qeGje77wq1c0Blk4oGMX66OZHyF83TvWUgG977HQR4Unb6sRF6SzJpK3+NvQ4YJwzQVAfePJydOI+pOgZQbTUW5\/pGjx+9RjBv1HOCpfeNAlfvdP04FY2woLgiThgOywr\/tzZNPKbYyeS4+ln9C4KCZcXfMdZtabq0sCVLel6B+tEDDsARQDAwABARYDAwAoDsyLHNtuAalm3dvDfTp1jLQpg9kJAp9VNWjWGA9tvoytcPS9bJWjNQ=="} 00460{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":192,"source":"http_ipv6.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1448269146,"pkt_ts_usec":966054,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"UMWNrEEBeKzApw1Mht1gAAAAACAGQCoADUAAAQADeqzA\/\/6nDUwqAibwAK0BlwAAAAAAAAI2z44Bu8SPr1Lp+qgEgBABL9R2AAABAQgKEg1\/WRvn+xI="} 00460{"flow_id":14,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1448269146,"pkt_ts_usec":970056,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"UMWNrEEBeKzApw1Mht1gAAAAACAGQCoADUAAAQADeqzA\/\/6nDUwqAibwAK0BlwAAAAAAAAI2z4wBuwtKvIjowagNgBABO9R2AAABAQgKEg1\/Whvn+xQ="} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":12,"flow_first_seen":1448269146905,"flow_last_seen":1448269146970,"flow_tot_l4_data_len":4539,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2888,"flow_avg_l4_data_len":378,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a02:26f0:ad:197::236","src_port":53132,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":10,"flow_first_seen":1448269146905,"flow_last_seen":1448269146966,"flow_tot_l4_data_len":4475,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3579,"flow_avg_l4_data_len":447,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a02:26f0:ad:197::236","src_port":53134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":14,"flow_first_seen":1448269127395,"flow_last_seen":1448269127510,"flow_tot_l4_data_len":1457,"flow_min_l4_data_len":32,"flow_max_l4_data_len":538,"flow_avg_l4_data_len":104,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4001:803::1017","src_port":41776,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00524{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":14,"flow_first_seen":1448269127395,"flow_last_seen":1448269127510,"flow_tot_l4_data_len":1457,"flow_min_l4_data_len":32,"flow_max_l4_data_len":538,"flow_avg_l4_data_len":104,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4001:803::1017","src_port":41776,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":62,"flow_first_seen":1448269127400,"flow_last_seen":1448269138520,"flow_tot_l4_data_len":12629,"flow_min_l4_data_len":37,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":203,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4001:803::1017","src_port":45931,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1448269139314,"flow_last_seen":1448269139321,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a02:26f0:ad:1a1::eed","src_port":60124,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00516{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1448269139314,"flow_last_seen":1448269139321,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a02:26f0:ad:1a1::eed","src_port":60124,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1448269127922,"flow_last_seen":1448269127940,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4006:803::2008","src_port":58660,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00519{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1448269127922,"flow_last_seen":1448269127940,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4006:803::2008","src_port":58660,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":19,"flow_first_seen":1448269138575,"flow_last_seen":1448269138746,"flow_tot_l4_data_len":5988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":315,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:b0c0:3:d0::70:1001","src_port":37486,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":17,"flow_first_seen":1448269138575,"flow_last_seen":1448269138746,"flow_tot_l4_data_len":5924,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2700,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:b0c0:3:d0::70:1001","src_port":37488,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":18,"flow_first_seen":1448269139219,"flow_last_seen":1448269139339,"flow_tot_l4_data_len":5956,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":330,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:b0c0:3:d0::70:1001","src_port":37494,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":26,"flow_first_seen":1448269144450,"flow_last_seen":1448269144884,"flow_tot_l4_data_len":14213,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":546,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:b0c0:3:d0::70:1001","src_port":37506,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1448269123954,"flow_last_seen":1448269123971,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4006:804::200e","src_port":40526,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00519{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1448269123954,"flow_last_seen":1448269123971,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4006:804::200e","src_port":40526,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1448269143410,"flow_last_seen":1448269143539,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:2880:1010:3f20:face:b00c::25de","src_port":40308,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00531{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1448269143410,"flow_last_seen":1448269143539,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a03:2880:1010:3f20:face:b00c::25de","src_port":40308,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1448269127960,"flow_last_seen":1448269128028,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":45,"flow_max_l4_data_len":206,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:400b:c02::5f","src_port":55145,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1448269127960,"flow_last_seen":1448269128028,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":45,"flow_max_l4_data_len":206,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:400b:c02::5f","src_port":55145,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1448269144306,"flow_last_seen":1448269144348,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:400b:c02::9a","src_port":33062,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00518{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1448269144306,"flow_last_seen":1448269144348,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:400b:c02::9a","src_port":33062,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1448269145458,"flow_last_seen":1448269145478,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4001:803::1012","src_port":59690,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1448269145458,"flow_last_seen":1448269145478,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a00:d40:1:3:7aac:c0ff:fea7:d4c","dst_ip":"2a00:1450:4001:803::1012","src_port":59690,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":193,"source":"http_ipv6.pcap","alias":"nDPId-test"} diff --git a/test/results/iec60780-5-104.pcap.out b/test/results/iec60780-5-104.pcap.out index df0f5e692..f7ecd7dfd 100644 --- a/test/results/iec60780-5-104.pcap.out +++ b/test/results/iec60780-5-104.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"iec60780-5-104.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"iec60780-5-104.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1219992231267,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1568,"dst_port":2404,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"iec60780-5-104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1219992231,"pkt_ts_usec":267238,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ABXFGNTMABNy14eKCABFAAAwbS5AAIAGRKWsG\/htrBv4TwYgCWR6t61JAAAAAHAC\/\/8CpgAAAgQFtAEBBAI="} 00428{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"iec60780-5-104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1219992231,"pkt_ts_usec":267345,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"ABNy14eKABXFGNTMCABFAAAwQVVAAIAGcH6sG\/hPrBv4bQlkBiDrZdPBeretSnAS\/\/9DbQAAAgQFtAEBBAI="} @@ -103,3 +104,5 @@ 00442{"flow_id":6,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"iec60780-5-104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1219992889,"pkt_ts_usec":959139,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"ABNy14eKABXFGNTMCABFAAA4Qa9AAIAGcBysG\/hPrBv4bQlkBir5wu7hQbAarFAY\/+NJHwAAaA4IAAIAZAEKAA2RAAAAFA=="} 00425{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"iec60780-5-104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1219992890,"pkt_ts_usec":99579,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABXFGNTMABNy14eKCABFAAAoblhAAIAGQ4OsG\/htrBv4TwYqCWRBsBqs+cLu8VAQ\/5kSpwAAAAAAAAAA"} 00426{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"iec60780-5-104.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1219992909,"pkt_ts_usec":959873,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"ABXFGNTMABNy14eKCABFAAAublxAAIAGQ3msG\/htrBv4TwYqCWRBsBqs+cLu8VAY\/5mflAAAaAQBAAoA"} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":147,"source":"iec60780-5-104.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":47,"flow_first_seen":1219992819942,"flow_last_seen":1219993055118,"flow_tot_l4_data_len":1373,"flow_min_l4_data_len":20,"flow_max_l4_data_len":84,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1578,"dst_port":2404,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":147,"source":"iec60780-5-104.pcap","alias":"nDPId-test"} diff --git a/test/results/imaps.pcap.out b/test/results/imaps.pcap.out index 757d41fa1..a55708595 100644 --- a/test/results/imaps.pcap.out +++ b/test/results/imaps.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"imaps.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"imaps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590857744659,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.8","dst_ip":"167.99.215.164","src_port":50506,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"imaps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590857744,"pkt_ts_usec":659641,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+f\/AqAEIp2PXpMVKA+HRNM\/NAAAAALAC\/\/\/ajwAAAgQFtAEDAwUBAQgKFE2dOQAAAAAEAgAA"} 00433{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"imaps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590857744,"pkt_ts_usec":706356,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGBgSnY9ekwKgBCAPhxUrMi6La0TTPzqAS\/ojr6QAAAgQFrAQCCAqpw+fsFE2dOQEDAwc="} @@ -17,3 +18,5 @@ 00492{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"imaps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590857744,"pkt_ts_usec":868194,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"EBMx8Tl2KDc3AG3ICABFAABnAABAAEAG+djAqAEIp2PXpMVKA+HRNNEczIuuuoAYEAA7XwAAAQEIChRNneqpw+iQFAMDAAEBFgMDACglJ8Mzvl1tB2IhOqlbKgTgBKc91pKNDFqA2GYulIqLvB4p2N7Frl1n"} 00422{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"imaps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590857744,"pkt_ts_usec":905615,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0NsBAADQGz0unY9ekwKgBCAPhxUrMi6660TTRT4AQAfwIYQAAAQEICqnD6LUUTZ3q"} 00493{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"imaps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590857744,"pkt_ts_usec":905735,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnNsFAADQGzxenY9ekwKgBCAPhxUrMi6660TTRT4AYAfxr8wAAAQEICqnD6LUUTZ3qFAMDAAEBFgMDAChAqpq8t2fITIfMhvOf8DvJz3jdHhYAkNco57ZHSCpyv0i\/fAHB+HFs"} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"imaps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1590857744659,"flow_last_seen":1590857744987,"flow_tot_l4_data_len":4516,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":225,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.8","dst_ip":"167.99.215.164","src_port":50506,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"imaps.pcap","alias":"nDPId-test"} diff --git a/test/results/instagram.pcap.out b/test/results/instagram.pcap.out index eb5698e48..884061895 100644 --- a/test/results/instagram.pcap.out +++ b/test/results/instagram.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"instagram.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1436720898354,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"173.252.107.4","src_port":56382,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"instagram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1436720898,"pkt_ts_usec":354402,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABsv8H60QPMIw47hCABFAAA8TypAAEAGEYLAqABnrfxrBNw+AbsehKWiAAAAAKACOQjaPgAAAgQFtAQCCAoAA+qIAAAAAAEDAwY="} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1436720898386,"flow_last_seen":0,"flow_tot_l4_data_len":1397,"flow_min_l4_data_len":1397,"flow_max_l4_data_len":1397,"flow_avg_l4_data_len":1397,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -492,3 +493,10 @@ 01481{"flow_id":38,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2787,"source":"instagram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568796265,"pkt_ts_usec":322176,"pkt_caplen":840,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":840,"pkt_l4_len":806,"pkt":"xGGLNYKpxiwDYGpkCABFAAM6sogAAFQGeTsfDVY0wKgCEQG7wNGAszvwOoozEYAYAHXMHQAAAQEICmwYnbINcJ7HFwMDAwH4IYO\/bnnJPpH2DUUq24IcQv54cTP9ANeHQki28uc11Zu8OsVJG6uckSDRqBAgjrXAsFeNh+Hv6q6qBibXcpxbHPtoMJsq1oRmb215W6vtqN+YTG40\/ynzRKu85d8till4rarc9YXOmpU1KG5EBWACHnEUweSzUmZkGh18FWlI9s8VRe4GjaTavryYOpvi4f\/+l06O7cDmQus+nkfJO4FQRW6BYPehnbLtz9U7ONeMP4fKM48X8FXls0g6mB5ZNfCJv01BDdKkDY6HBVwxmV79Tb\/H5Tdd8KcftJrWYxhDlgNLbhwY0QubVBbrSa0gXnPH11GYGFJHNEKVIReo0\/xndiA7tum04CK0itI5icJi1VvmrIcD7RrGinsZY8eHcqss5hXJ\/UvNwpzQaqfbJVtYkGphDfyR9\/zPKqCqENMBHQwHYWdwCxW4tDOPtahcfEE1FrcCDMLphxX3HLH6wdcLRmIUGlpz9NmV9VS6v+97qt\/Hb9fCN6HYzQnwrcy66pdRLsgWXNLTPNsjso9WcGNNcQ+8dXBT0fZtBgBE+5nJyZcIh0UzQ8AcGGl8kslDuuUPZBxg35luxbTCvrc8e7iau8z6bstz508MpVXRcZwI494X6uiOToSH6GrJSisd5MNSv5KSGbCRlpLCYEucEG5VpxzmIitJ1Jf8EDSVwy\/3J7TX1zjsb1Ue3aZ206N4zZGKiDVdfaGp4\/wHZRYF0nnEaY5uM6EQ4Zzx1JiNd28m5diz3P0+P6A4heeZ42NY37OLTJq\/ZvnsTZgeE4euBKzE30x8SOSrGYQSj2kUev0T3C+NBnFwvL4huBLq4W5I\/uASFVHeBzURQOYXDz4yDBG0aRL+36d6h5qovqzAyE6Kmb+lvblKXtkJFS61xhIkunE1dL3SFrz55nJd7t\/Sz2pszmcydnp5MyXLYST5RDDWk\/c50pB\/Yqr0vT1PV2B0sjQdp\/rNvTxQ\/NzEaC4OoeYQROBYHEFqAasbYpu5I0TTuCbJws4VIbnd8XVToLncEhYo"} 00461{"flow_id":38,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2788,"source":"instagram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568796265,"pkt_ts_usec":322186,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"xGGLNYKpxiwDYGpkCABFAABLsokAAFQGfCkfDVY0wKgCEQG7wNGAsz72OoozEYAQAHXKpwAAAQEICmwYnbINcJ7HFwMDABJgUObMp8Yh43VpzLWrtvs+vcU="} 02312{"flow_id":38,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2789,"source":"instagram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568796265,"pkt_ts_usec":323062,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"pkt":"xGGLNYKpxiwDYGpkCABFAAWgsooAAFQGdtMfDVY0wKgCEQG7wNGAsz8NOoozEYAQAHW\/AwAAAQEICmwYnbINcJ7HFwMDBe2fuVF69OnvL+7P6xeUZG8KfIdGISriqfPejAtsrrSyGYAC6x0\/+7AbN+P8YnMWW6CDlHjG66lfeP42+RUSTfASQSqypWeLVlORWb79sRKDmwZhV6g5kOE5w7\/pHKNDHR99kVf3FYZzzgk5qxjpsTC2KgyeyXH9LQZoLmBnr4b3YC52p4KGXyCPV\/lCQHXJxEbYhJLN8DmSxOlTvCGvWRT\/Jq61slV+D\/bey\/H\/v5nBoJ5AARuAjzkg44tySQ1XNvUBJcL85Y4qz79nhrLc2l2VSZSdpD2j9YG\/9uxThvE7O9aEZzulHwRgggXtp4B6IO8AhEmtKUHqrz9YvZF3q4MRKwvN3yZObLbXln0IBjXzWzei1AFo8jafHnKRrtUl6jMCnWCt\/WIImUGxXsfT9IFaJfn8TV3ZVc8IH8pqv2cSn\/Cqvisvot04ybKT4A9383Gjtw2FLMcgdV5hW4AwE4\/NE+2eWD4u385bxkHF3lP5h6hyQdy9iVO8vEaHIyIXTJwLh7WP5S1baTvWdpXE8tJD1+tR+Bj6KtV+GMb0U4rAEDwUL5tESThIWX0+HZmRIhjOlLGqUtGKBYg\/H6lIuAYsOIMtOjzBDtc11R9rg2fHFILECq3RMn3zR9RKUAop5WXUwbJaO9HlEMqbSLQA82+RC13J6TDwmD1TUSgjlx84SdbyIiqrLKAOJeOp0igi20nXOqbC0NVT04xp50pHYtcDgZWf\/jRxYk0UctNP7uPo6APIyZRmuI8kT7kscW90h2XxB8Fjg2aGyf4mNWmD\/ZSlOMBCxj9OQEoOBTfkDH9oOjw24gkiUjASuCD5poPvSRUnWr0adFS1BdAmtRpwKpffyziTsyOajQMT1FFSn4LBjxD\/SbxHYyLj8VwwiaV3+HBxL9GqPMsPa9iU5RNggzTWYn+0K3HWpRqnWLR+fjXpzb6fW1jWF2UvOuGaVpb6MeDZv5q3qTne+rXd5kABZG23quMWNl8r45ecmjXG1WRUc45Pive8v3yuoJ6\/bt8Xe28g5WvAY8In4SLj+cmDPkXXSAzvr2tmZ2XVIvY8fPjzKJTLsspkgD4AcdQf9kDka+q\/hHEKKcplBoVe3A5qB5PzZbq2OX2D19RgjIMwShzm85IjuR6bLk9rgYBsxM8xhSgmPrpU\/UZepmoLLfUZwgx6yaV2OUDddq6a9npr2exIHpCocATVOpq2\/QCVRTuFfvGK+OPEHd1U0t46YhFqwW3Py2t45mq+L31nfvqoJvZKlVIjPJdLGuZkzrPPUusdYT+uDtAtjLqBHgAxCE4kqU39GMFCy4YTlHUrQJ8adU2LFOqumui4ry8r83G8oGKQg8IbCGxy5JJiHk6bWZJ8ipgLbJXKDoYgnbQX2kNZOt5HZFoEH+5jIlvpqfvqY3vpJBpyrGNUfeDSmnbLUbjAIZsh0ScSALxOl5loLGZ5TbZDnbKA5Vkak54gIiohpCpy6itmcR6esIfTPw\/SccTY9fB1Pe3OHQ2q5EQehAkVrIkDzp\/ApxHtUgNwCHalLszkTkPxQQl+AXreA\/IULTlygORuxIKXta77VClV7LbrqdAmC+K+8CiwLKrT1KcACuDL\/Jnhfn8L2+foxiDOXHEQBMcKKfaZ4QRBUf7csyvL09SuibgPklafIPLJf5KCLNyy4ir2vyR49icAlNuMA\/4BLAJzY2XCDuYZOIJFDz1Lkt8vbiXkn4XYysnhUnPsj3JtOxlwOaEHFvJDnfv7dMLZ089SnaJueBZZlxi4mbLqMQbWqf08oMhWFPStVsGMNWX2nRmDofAhKsEe8okDpLgY3axsYOEhsrSFlvhHxt1GEvGvqQHw6vLJ8HA="} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1366,"flow_first_seen":1568796253770,"flow_last_seen":1568796268061,"flow_tot_l4_data_len":1263938,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":925,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49355,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":144,"flow_first_seen":1568796254514,"flow_last_seen":1568796268054,"flow_tot_l4_data_len":102410,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":711,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49357,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":388,"flow_first_seen":1568796254515,"flow_last_seen":1568796268054,"flow_tot_l4_data_len":296046,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":763,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":230,"flow_first_seen":1568796254524,"flow_last_seen":1568796268054,"flow_tot_l4_data_len":162614,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":707,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49359,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":359,"flow_first_seen":1568796265146,"flow_last_seen":1568796268054,"flow_tot_l4_data_len":283527,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":789,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49360,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":212,"flow_first_seen":1568796265147,"flow_last_seen":1568796268053,"flow_tot_l4_data_len":162004,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":764,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49361,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3443,"source":"instagram.pcap","alias":"nDPId-test"} diff --git a/test/results/ip_fragmented_garbage.pcap.out b/test/results/ip_fragmented_garbage.pcap.out index 8f0c7977c..848385008 100644 --- a/test/results/ip_fragmented_garbage.pcap.out +++ b/test/results/ip_fragmented_garbage.pcap.out @@ -1,3 +1,4 @@ +00398{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1534244024697,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24102,"dst_port":10792,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00420{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1534244024,"pkt_ts_usec":697756,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":16,"pkt":"QgEK8AABQgEK8AAbCABFAAAkAKAgAEAGRbEKAAACCoAAAl4mKigpKComXiUkI0AjJCUpOAAA"} 00378{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1534244024,"pkt_ts_usec":697792,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":50,"pkt_l4_len":0,"pkt":"QgEK8AABQgEK8AAbCABFAAAkAKAgAkAGRa8KAAACCoAAAl4mKigqJl4lJCMmKihLSUo="} @@ -18152,3 +18153,62 @@ 00188{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":9076,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","l4_data_len":16} 00369{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1534244033,"pkt_ts_usec":215628,"pkt_caplen":42,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":42,"pkt_l4_len":0,"pkt":"QgEK8AABQgEK8AAbCABFAAAcAKACcEAGY0kKAAACCoAAAmxrZGE+TDxN"} 00187{"basic_event_id":8,"basic_event_name":"nDPI IPv4\/L4 payload detection failed","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","l4_data_len":8} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1534244025609,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16417,"dst_port":16419,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1534244025609,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16417,"dst_port":16419,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1534244026825,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9508,"dst_port":8995,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1534244026825,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9508,"dst_port":8995,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1534244030473,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9508,"dst_port":8998,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1534244030473,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9508,"dst_port":8998,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1534244026521,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":10790,"dst_port":24101,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1534244026521,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":10790,"dst_port":24101,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1534244024697,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24102,"dst_port":10792,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1534244024697,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24102,"dst_port":10792,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1534244025001,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18730,"dst_port":20304,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1534244025001,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18730,"dst_port":20304,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1534244031688,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24136,"dst_port":16967,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1534244031688,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24136,"dst_port":16967,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1534244032602,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":17751,"dst_port":9024,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1534244032602,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":17751,"dst_port":9024,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1534244027433,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":14387,"dst_port":14646,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1534244027433,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":14387,"dst_port":14646,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1534244029256,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16199,"dst_port":21055,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1534244029256,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16199,"dst_port":21055,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1534244031384,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18762,"dst_port":18503,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1534244031384,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18762,"dst_port":18503,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1534244027737,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18248,"dst_port":19019,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1534244027737,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18248,"dst_port":19019,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1534244028345,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16243,"dst_port":21055,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1534244028345,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":16243,"dst_port":21055,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1534244032907,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":27502,"dst_port":30307,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1534244032907,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":27502,"dst_port":30307,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1534244026217,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24101,"dst_port":9251,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1534244026217,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":24101,"dst_port":9251,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1534244025305,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9253,"dst_port":24102,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1534244025305,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9253,"dst_port":24102,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1534244032298,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9251,"dst_port":9770,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1534244032298,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9251,"dst_port":9770,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1534244031993,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":29799,"dst_port":26228,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1534244031993,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":29799,"dst_port":26228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1534244025912,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":21029,"dst_port":22878,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1534244025912,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":21029,"dst_port":22878,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1534244033211,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":10792,"dst_port":10790,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1534244033211,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":10792,"dst_port":10790,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1534244028953,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":2612,"dst_port":12849,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1534244028953,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":2612,"dst_port":12849,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1534244028041,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13105,"dst_port":14648,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1534244028041,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13105,"dst_port":14648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1534244030777,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13362,"dst_port":12596,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1534244030777,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13362,"dst_port":12596,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1534244029559,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":19273,"dst_port":19016,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1534244029559,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":19273,"dst_port":19016,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1534244029864,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9566,"dst_port":18498,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1534244029864,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":9566,"dst_port":18498,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1534244030168,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":11892,"dst_port":26470,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1534244030168,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":11892,"dst_port":26470,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1534244028649,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":17458,"dst_port":10790,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1534244028649,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":17458,"dst_port":10790,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1534244027129,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13617,"dst_port":10536,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1534244027129,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":13617,"dst_port":10536,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1534244031080,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18258,"dst_port":16199,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1534244031080,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.2","dst_ip":"10.128.0.2","src_port":18258,"dst_port":16199,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00143{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":9077,"source":"ip_fragmented_garbage.pcap","alias":"nDPId-test"} diff --git a/test/results/iphone.pcap.out b/test/results/iphone.pcap.out index ccf2c5164..5a7110cf5 100644 --- a/test/results/iphone.pcap.out +++ b/test/results/iphone.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"iphone.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"iphone.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1582454552576,"flow_last_seen":0,"flow_tot_l4_data_len":518,"flow_min_l4_data_len":518,"flow_max_l4_data_len":518,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01081{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"iphone.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454552,"pkt_ts_usec":576659,"pkt_caplen":552,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":552,"pkt_l4_len":518,"pkt":"\/\/\/\/\/\/\/\/xiwDYGpkCABFAAIaAFkAAEAR8inAqAIBwKgC\/0RcRFwCBr34eyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiAzMzA0MDI2MjQwMTMxNjcxMTI3MTc3MTQ1ODMyOTcxNTM2ODg0ODIsICJkaXNwbGF5bmFtZSI6ICIiLCAibmFtZXNwYWNlcyI6IFsyNzUwMzcwNTYwLCA3ODUyNjYxNzcsIDE1MjYyNjMwNDUsIDEzMzg2NTkyMDEsIDE0ODE5MzM3LCA0ODEwNTkxNzYwLCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgOTk2MzA2MjE1LCA1MzAzMzAxMjQ4LCAyODUyMTYwNywgNDA1NjQ2MjU5MiwgNzA1MzYyNzE4NCwgMTUyMjE3NzU4NywgMTQyMTExNDM5OSwgMTI1MjExNjQyOSwgOTk0Njk3NzMsIDcwNzk2MzY2ODgsIDE3Njk2NDMwNywgMTI1NTQwNTY2LCAxMDQ3NDI4MTg5LCA0NzE2MTkwMDQ4LCA1NDY3MTYzMDg4LCAxMTk1MDQ0MDcxLCA5Njg1MzIyNCwgMTc2MDk5NjMsIDY0NzgzMDM0NDAsIDUxMTcwNjY0MiwgNjI5Nzk1NTE4NCwgMTQxNTYyMDM1MF19"} 00509{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"iphone.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1582454552576,"flow_last_seen":0,"flow_tot_l4_data_len":518,"flow_min_l4_data_len":518,"flow_max_l4_data_len":518,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -452,3 +453,52 @@ 00427{"flow_id":53,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":460,"source":"iphone.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454600,"pkt_ts_usec":617961,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGAHHAqAIRX2UYNcWcAbsi3fokxZjNvoAQA\/r3QAAAAQEIChHf7\/SI0z7W"} 00538{"flow_id":53,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":461,"source":"iphone.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454600,"pkt_ts_usec":639449,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"xiwDYGpkxGGLNYKpCABFAgCEAABAAEAGAB\/AqAIRX2UYNcWcAbsi3fokxZjNvoAYBAD\/dQAAAQEIChHf8AmI0z7WFAMDAAEBFwMDAEVUOOj2tGvaINrHyVOhP0kBTB8LDlsPjRKAV8G0PLMBWW4ePVJCAbmXcCnjrI+JyeomJ1V4BzSnP+GW9fNRzui7ZvfHi3g="} 00491{"flow_id":53,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":462,"source":"iphone.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1582454600,"pkt_ts_usec":641576,"pkt_caplen":112,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":112,"pkt_l4_len":78,"pkt":"xiwDYGpkxGGLNYKpCABFAgBiAABAAEAGAEHAqAIRX2UYNcWcAbsi3fp0xZjNvoAYBABgXgAAAQEIChHf8AuI0z7WFwMDAClRVTUdkgd1Ri8nQFNd98VjxkuZgkygicyhmvcNiVIlazT8aPL8dJi3aw=="} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":25,"flow_first_seen":1582454598252,"flow_last_seen":1582454599058,"flow_tot_l4_data_len":13378,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":535,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.185.140","src_port":50575,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":45,"flow_first_seen":1582454598587,"flow_last_seen":1582454600617,"flow_tot_l4_data_len":12335,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":274,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.176.75","src_port":50580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":77,"flow_first_seen":1582454598721,"flow_last_seen":1582454600748,"flow_tot_l4_data_len":75712,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":983,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.185.87","src_port":50581,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":32,"flow_first_seen":1582454599225,"flow_last_seen":1582454600287,"flow_tot_l4_data_len":8941,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.176.75","src_port":50584,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":30,"flow_first_seen":1582454599740,"flow_last_seen":1582454600279,"flow_tot_l4_data_len":8893,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":296,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.176.75","src_port":50586,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1582454598542,"flow_last_seen":1582454598582,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":44,"flow_max_l4_data_len":210,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":52852,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1582454598205,"flow_last_seen":1582454598247,"flow_tot_l4_data_len":268,"flow_min_l4_data_len":50,"flow_max_l4_data_len":218,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":63143,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1582454553219,"flow_last_seen":1582454596366,"flow_tot_l4_data_len":2156,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":4,"flow_first_seen":1582454595839,"flow_last_seen":1582454599396,"flow_tot_l4_data_len":296,"flow_min_l4_data_len":74,"flow_max_l4_data_len":74,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::823:3f17:8298:a29c","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1582454598246,"flow_last_seen":1582454598287,"flow_tot_l4_data_len":230,"flow_min_l4_data_len":43,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":51007,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":12,"flow_first_seen":1582454599396,"flow_last_seen":1582454600443,"flow_tot_l4_data_len":4889,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":407,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.137.166.35","src_port":50585,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598758,"flow_tot_l4_data_len":233,"flow_min_l4_data_len":46,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":63377,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1582454598204,"flow_last_seen":1582454598247,"flow_tot_l4_data_len":286,"flow_min_l4_data_len":56,"flow_max_l4_data_len":230,"flow_avg_l4_data_len":143,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":63381,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1582454553607,"flow_last_seen":1582454586688,"flow_tot_l4_data_len":1987,"flow_min_l4_data_len":53,"flow_max_l4_data_len":1194,"flow_avg_l4_data_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"169.254.225.216","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":14,"flow_first_seen":1582454598888,"flow_last_seen":1582454599079,"flow_tot_l4_data_len":7495,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":535,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"104.73.61.30","src_port":50583,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00455{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":5,"flow_first_seen":1582454598885,"flow_last_seen":1582454599226,"flow_tot_l4_data_len":180,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00436{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1582454599054,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598760,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":47,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":53272,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598756,"flow_tot_l4_data_len":235,"flow_min_l4_data_len":45,"flow_max_l4_data_len":190,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":53317,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1582454595352,"flow_last_seen":1582454596370,"flow_tot_l4_data_len":616,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.17","src_port":67,"dst_port":68,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":18,"flow_first_seen":1582454598385,"flow_last_seen":1582454599058,"flow_tot_l4_data_len":5910,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":328,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.130.2.46","src_port":50577,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1582454598373,"flow_last_seen":1582454598412,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":40,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":110,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":55457,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":12,"flow_first_seen":1582454598766,"flow_last_seen":1582454598934,"flow_tot_l4_data_len":6219,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"92.122.252.82","src_port":50582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":1582454600454,"flow_last_seen":1582454600494,"flow_tot_l4_data_len":235,"flow_min_l4_data_len":47,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":63677,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_first_seen":1582454553607,"flow_last_seen":1582454586688,"flow_tot_l4_data_len":1905,"flow_min_l4_data_len":370,"flow_max_l4_data_len":1165,"flow_avg_l4_data_len":635,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c42c:3ff:fe60:6a64","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00439{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1582454595354,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ff98:a29c","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1582454598209,"flow_last_seen":1582454598248,"flow_tot_l4_data_len":242,"flow_min_l4_data_len":49,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":61862,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":34,"flow_first_seen":1582454599934,"flow_last_seen":1582454600426,"flow_tot_l4_data_len":10676,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":314,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"92.123.77.26","src_port":50587,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1582454560698,"flow_last_seen":1582454560698,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"224.0.0.1","src_port":5351,"dst_port":5350,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1582454560698,"flow_last_seen":1582454560698,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"224.0.0.1","src_port":5351,"dst_port":5350,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1582454598373,"flow_last_seen":1582454599396,"flow_tot_l4_data_len":148,"flow_min_l4_data_len":74,"flow_max_l4_data_len":74,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1582454553606,"flow_last_seen":1582454586688,"flow_tot_l4_data_len":1958,"flow_min_l4_data_len":53,"flow_max_l4_data_len":1165,"flow_avg_l4_data_len":489,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1582454598212,"flow_last_seen":1582454598252,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":48,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":55914,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598756,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":46,"flow_max_l4_data_len":101,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":64203,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1582454599065,"flow_last_seen":1582454599105,"flow_tot_l4_data_len":132,"flow_min_l4_data_len":39,"flow_max_l4_data_len":93,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":62160,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598759,"flow_tot_l4_data_len":235,"flow_min_l4_data_len":47,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":49880,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598758,"flow_tot_l4_data_len":233,"flow_min_l4_data_len":46,"flow_max_l4_data_len":187,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":53983,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1582454599073,"flow_last_seen":1582454599105,"flow_tot_l4_data_len":132,"flow_min_l4_data_len":39,"flow_max_l4_data_len":93,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":52031,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":20,"flow_first_seen":1582454598416,"flow_last_seen":1582454600719,"flow_tot_l4_data_len":6496,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":324,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.253.105.202","src_port":50578,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":20,"flow_first_seen":1582454598418,"flow_last_seen":1582454600719,"flow_tot_l4_data_len":6518,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.253.105.202","src_port":50579,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":27,"flow_first_seen":1582454598377,"flow_last_seen":1582454598754,"flow_tot_l4_data_len":9966,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"95.101.25.53","src_port":50576,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":28,"flow_first_seen":1582454600508,"flow_last_seen":1582454600678,"flow_tot_l4_data_len":10515,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":375,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"95.101.24.53","src_port":50588,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598760,"flow_tot_l4_data_len":217,"flow_min_l4_data_len":39,"flow_max_l4_data_len":178,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":62526,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":9,"flow_first_seen":1582454598387,"flow_last_seen":1582454598716,"flow_tot_l4_data_len":1135,"flow_min_l4_data_len":32,"flow_max_l4_data_len":728,"flow_avg_l4_data_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.253.105.202","src_port":49152,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00465{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1582454596364,"flow_last_seen":1582454597360,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":68,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::823:3f17:8298:a29c","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00462{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1582454595354,"flow_last_seen":1582454599568,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":8,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::823:3f17:8298:a29c","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1582454598713,"flow_last_seen":1582454598755,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":40,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":52682,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1582454599929,"flow_last_seen":1582454599930,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":47,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":65079,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":500,"source":"iphone.pcap","alias":"nDPId-test"} diff --git a/test/results/ipv6_in_gtp.pcap.out b/test/results/ipv6_in_gtp.pcap.out index c2cbf3803..f774e6ea4 100644 --- a/test/results/ipv6_in_gtp.pcap.out +++ b/test/results/ipv6_in_gtp.pcap.out @@ -1,4 +1,6 @@ +00388{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00508{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536839120,"pkt_ts_usec":404326,"pkt_caplen":150,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":150,"pkt_l4_len":0,"pkt":"AAAAAAACNLNUB8pWgQAMoYEAYAUIAEVoAIBoSQAA\/xHueQruUBoK7v5LCGgIaABsAAAw\/wBcEoCPuGAIuFIANBFAJgf8IEBSA55JCupNF\/7gnP0Al2q8Zxk+AAAAAAAAAAe\/4GQ6ADQ3SIBuFZfDWsIvMrWrNfP4Fx5OYe4CUCXgPs5ziPlz8hT\/27dLl2xtqJbPLkrE"} 00161{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test","type":33024} 00531{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536840494,"pkt_ts_usec":424533,"pkt_caplen":166,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":166,"pkt_l4_len":0,"pkt":"AAAAAAABNLNUB8pVgQAMn4EAQAIIAEVYAJD2QgAA\/xGMPAruJFwK7v5NCGgIaAB8AAAw\/wBsB0wVsGANtkgARDJAKgEEyMAUFE4AAQAClFtnYSoBBMjwAA9JAAAAAAAAAAT\/O2YDAAAAQhlm1OFxgeTba50SyREjm3lFbPc9lgrLUcRYebJHYlYzSCeWv2L\/IjSAXfS1U+Rh4DDxR7yVXb8kOaI3Xg=="} 00161{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":2,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test","type":33024} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"ipv6_in_gtp.pcap","alias":"nDPId-test"} diff --git a/test/results/irc.pcap.out b/test/results/irc.pcap.out index be544f0c3..da6855db5 100644 --- a/test/results/irc.pcap.out +++ b/test/results/irc.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"irc.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"irc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1387554241634,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.180.156.249","dst_ip":"38.229.70.20","src_port":45921,"dst_port":8000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":634815,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAAMB6wBABNyxPHhCABFAAA8\/+BAAEAGJjUKtJz5JuVGFLNhH0BpMfDFAAAAAKACOQj\/0AAAAgQFtAQCCAq+wg8lAAAAAAEDAwc="} 00430{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554241,"pkt_ts_usec":665525,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABNyxPHhANAr0XYACABFAAA8AABAADIGNBYm5UYUCrSc+R9As2GRFS01aTHwxqASFqAOiAAAAgQFtAQCCAowSCUOvsIPJQEDAwY="} @@ -15,3 +16,5 @@ 00494{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554250,"pkt_ts_usec":645455,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"ABNyxPHhANAr0XYACABFAABoCCRAADIGK8Ym5UYUCrSc+R9As2GRFS3baTHw+oAYAFsCCQAAAQEICjBILdO+wg+3OmNhcmQuZnJlZW5vZGUubmV0IE5PVElDRSAqIDoqKiogTm8gSWRlbnQgcmVzcG9uc2UNCg=="} 00421{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554250,"pkt_ts_usec":645480,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAAMB6wBABNyxPHhCABFAAA0\/+dAAEAGJjYKtJz5JuVGFLNhH0BpMfD6kRUuD4AQAHMmewAAAQEICr7CMlgwSC3T"} 02358{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"irc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1387554250,"pkt_ts_usec":647295,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"ABNyxPHhANAr0XYACABFAAXcCCVAADIGJlEm5UYUCrSc+R9As2GRFS4PaTHw+oAQAFsv4QAAAQEICjBILdS+wg+3OmNhcmQuZnJlZW5vZGUubmV0IDAwMSBtb2xvY2h0ZXN0IDpXZWxjb21lIHRvIHRoZSBmcmVlbm9kZSBJbnRlcm5ldCBSZWxheSBDaGF0IE5ldHdvcmsgbW9sb2NodGVzdA0KOmNhcmQuZnJlZW5vZGUubmV0IDAwMiBtb2xvY2h0ZXN0IDpZb3VyIGhvc3QgaXMgY2FyZC5mcmVlbm9kZS5uZXRbMzguMjI5LjcwLjIwLzgwMDBdLCBydW5uaW5nIHZlcnNpb24gaXJjZC1zZXZlbi0xLjEuMw0KOmNhcmQuZnJlZW5vZGUubmV0IDAwMyBtb2xvY2h0ZXN0IDpUaGlzIHNlcnZlciB3YXMgY3JlYXRlZCBTdW4gRGVjIDExIDIwMTEgYXQgMjI6MTY6MTAgVVRDDQo6Y2FyZC5mcmVlbm9kZS5uZXQgMDA0IG1vbG9jaHRlc3QgY2FyZC5mcmVlbm9kZS5uZXQgaXJjZC1zZXZlbi0xLjEuMyBET1FSU1phZ2hpbG9wc3d6IENGSUxNUFFTYmNlZmdpamtsbW5vcHFyc3R2eiBia2xvdmVxamZJDQo6Y2FyZC5mcmVlbm9kZS5uZXQgMDA1IG1vbG9jaHRlc3QgQ0hBTlRZUEVTPSMgRVhDRVBUUyBJTlZFWCBDSEFOTU9ERVM9ZUlicSxrLGZsaixDRkxNUFFTY2dpbW5wcnN0eiBDSEFOTElNSVQ9IzoxMjAgUFJFRklYPShvdilAKyBNQVhMSVNUPWJxZUk6MTAwIE1PREVTPTQgTkVUV09SSz1mcmVlbm9kZSBLTk9DSyBTVEFUVVNNU0c9QCsgQ0FMTEVSSUQ9ZyA6YXJlIHN1cHBvcnRlZCBieSB0aGlzIHNlcnZlcg0KOmNhcmQuZnJlZW5vZGUubmV0IDAwNSBtb2xvY2h0ZXN0IENBU0VNQVBQSU5HPXJmYzE0NTkgQ0hBUlNFVD1hc2NpaSBOSUNLTEVOPTE2IENIQU5ORUxMRU49NTAgVE9QSUNMRU49MzkwIEVUUkFDRSBDUFJJVk1TRyBDTk9USUNFIERFQUY9RCBNT05JVE9SPTEwMCBGTkMgVEFSR01BWD1OQU1FUzoxLExJU1Q6MSxLSUNLOjEsV0hPSVM6MSxQUklWTVNHOjQsTk9USUNFOjQsQUNDRVBUOixNT05JVE9SOiA6YXJlIHN1cHBvcnRlZCBieSB0aGlzIHNlcnZlcg0KOmNhcmQuZnJlZW5vZGUubmV0IDAwNSBtb2xvY2h0ZXN0IEVYVEJBTj0kLGFyeHogV0hPWCBDTElFTlRWRVI9My4wIFNBRkVMSVNUIEVMSVNUPUNUVSA6YXJlIHN1cHBvcnRlZCBieSB0aGlzIHNlcnZlcg0KOmNhcmQuZnJlZW5vZGUubmV0IDI1MSBtb2xvY2h0ZXN0IDpUaGVyZSBhcmUgMjIxIHVzZXJzIGFuZCA5MDE2NSBpbnZpc2libGUgb24gMjggc2VydmVycw0KOmNhcmQuZnJlZW5vZGUubmV0IDI1MiBtb2xvY2h0ZXN0IDMxIDpJUkMgT3BlcmF0b3JzIG9ubGluZQ0KOmNhcmQuZnJlZW5vZGUubmV0IDI1MyBtb2xvY2h0ZXN0IDEgOnVua25vd24gY29ubmVjdGlvbihzKQ0KOmNhcmQuZnJlZW5vZGUubmV0IDI1NCBtb2xvY2h0ZXN0IDU0NzQwIDpjaGFubmVscyBmb3JtZWQNCjpjYXJkLmZyZWVub2RlLm5ldCAyNTUgbW9sb2NodGVzdCA6SSBoYXZlIDIzMjQgY2xpZW50cyBhbmQgOCBzZXJ2ZXJzDQo6Y2FyZC5mcmVlbm9kZS5uZXQgMjY1IG1vbG9jaHRlc3QgMjMyNCA5OTI3IDpDdXJyZW50IGxvY2FsIHVzZXJzIDI="} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":29,"source":"irc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":29,"flow_first_seen":1387554241634,"flow_last_seen":1387554256201,"flow_tot_l4_data_len":7959,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":274,"midstream":0,"l3_proto":"ip4","src_ip":"10.180.156.249","dst_ip":"38.229.70.20","src_port":45921,"dst_port":8000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":29,"source":"irc.pcap","alias":"nDPId-test"} diff --git a/test/results/ja3_lots_of_cipher_suites.pcap.out b/test/results/ja3_lots_of_cipher_suites.pcap.out index ba96e0cde..c63a30a24 100644 --- a/test/results/ja3_lots_of_cipher_suites.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites.pcap.out @@ -1,3 +1,4 @@ +00402{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00415{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1557818846,"pkt_ts_usec":743554,"pkt_caplen":74,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":74,"pkt_l4_len":0,"pkt":"AAAAAAABsKp3tUhAgQAAXYEAAQIIAEUAADTDSUAAPwad0wrOgxIKzkH55SEBu84u1gAAAAAAgAJyEJdSAAACBAW0AQEEAgEDAwI="} 00175{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","type":33024} 00415{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1557818846,"pkt_ts_usec":744536,"pkt_caplen":74,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":74,"pkt_l4_len":0,"pkt":"AAAAAAABAAd9VAeAgQAAXYEAAQIIAEUAADQAAEAAPQZjHQrOQfkKzoMSAbvlIcEFrEzOLtYBgBI5CGLyAAACBAW0AQEEAgEDAwc="} @@ -20,3 +21,4 @@ 00176{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":10,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","type":33024} 00408{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":11,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1557818846,"pkt_ts_usec":965822,"pkt_caplen":68,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AAAAAAABsKp3tUhAgQAAXYEAAQIIAEUAACifbEAAPwbBvArOgxIKzkH55SEBu84u2SwAAAAAUAQAAEcBAAAAAAAAAAA="} 00176{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":11,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test","type":33024} +00145{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":11,"source":"ja3_lots_of_cipher_suites.pcap","alias":"nDPId-test"} diff --git a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out index 19b61b762..3c0f2f4ee 100644 --- a/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/test/results/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -1,3 +1,4 @@ +00409{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1505724520,"pkt_ts_usec":744830,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":118,"pkt_l4_len":0,"pkt":"\/Ejvopo\/MNF+D2w+CABFuABkI90AAEARjIOEvvQMl3m5LAhoCGgAUAAAMv8AQAE8W3RuUAAARQAAPGNKQABABin+wKiTsZd5waDkgAG7Qsba5QAAAACgAjkIo+MAAAIEBbQEAggKAAu5rwAAAAABAwMF"} 00213{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":1,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","caplen":114,"len":118} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1505724520744,"flow_last_seen":0,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":80,"flow_max_l4_data_len":80,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"132.190.244.12","dst_ip":"151.121.185.44","src_port":2152,"dst_port":2152,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -41,3 +42,5 @@ 00216{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":24,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","caplen":1202,"len":1206} 00470{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":25,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1505724526,"pkt_ts_usec":501639,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":110,"pkt_l4_len":0,"pkt":"\/Ejvopo\/MNF+D2w+CABFuABc0zYAAEAR3TGEvvQMl3m5LAhoCGgASAAAMv8AOAE8W3SFUAAARQAANGNWQABABin6wKiTsZd5waDkgAG7QsbjA1XaCIaAEQIjYE4AAAEBCAoAC7vkMW8PEg=="} 00214{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":25,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","caplen":106,"len":110} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":27,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":27,"flow_first_seen":1505724520744,"flow_last_seen":1505724526702,"flow_tot_l4_data_len":6048,"flow_min_l4_data_len":56,"flow_max_l4_data_len":1456,"flow_avg_l4_data_len":224,"midstream":0,"l3_proto":"ip4","src_ip":"132.190.244.12","dst_ip":"151.121.185.44","src_port":2152,"dst_port":2152,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00152{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":27,"source":"ja3_lots_of_cipher_suites_2_anon.pcap","alias":"nDPId-test"} diff --git a/test/results/kerberos.pcap.out b/test/results/kerberos.pcap.out index 461338e68..dafc9cc44 100644 --- a/test/results/kerberos.pcap.out +++ b/test/results/kerberos.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"kerberos.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1549337929790,"flow_last_seen":0,"flow_tot_l4_data_len":259,"flow_min_l4_data_len":259,"flow_max_l4_data_len":259,"flow_avg_l4_data_len":259,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49157,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00732{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"kerberos.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1549337929,"pkt_ts_usec":790448,"pkt_caplen":293,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":293,"pkt_l4_len":259,"pkt":"pB9ywglqAAgCHEeuCABFAAEXABdAAIAGkNisEAjJrBAICMAFAFiynbRHbznTnlAYAQAf5QAAAAAA62qB6DCB5aEDAgEFogMCAQqjFTATMBGhBAICAICiCQQHMAWgAwEB\/6SBwTCBvqAHAwUAQIEAEKEYMBagAwIBAaEPMA0bC2pvaG5zb24tcGMkohAbDmhhcHB5Y3JhZnQub3JnoyMwIaADAgECoRowGBsGa3JidGd0Gw5oYXBweWNyYWZ0Lm9yZ6URGA8yMDM3MDkxMzAyNDgwNVqmERgPMjAzNzA5MTMwMjQ4MDVapwYCBE7AFheoFTATAgESAgERAgEXAgEYAgL\/eQIBA6kdMBswGaADAgEUoRIEEEpPSE5TT04tUEMgICAgICA="} 00782{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"kerberos.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1549337929,"pkt_ts_usec":790962,"pkt_caplen":332,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":332,"pkt_l4_len":298,"pkt":"AAgCHEeupB9ywglqCABFAAE+ExRAAIAGfbSsEAgIrBAIyQBYwAVvOdOesp21NlAYAQCkkQAAAAABEn6CAQ4wggEKoAMCAQWhAwIBHqQRGA8yMDE5MDIwNTAzMzg0OFqlBQIDBjUgpgMCARmpEBsOaGFwcHljcmFmdC5vcmeqIzAhoAMCAQKhGjAYGwZrcmJ0Z3QbDmhhcHB5Y3JhZnQub3JnrIGnBIGkMIGhMH6hAwIBE6J3BHUwczA0oAMCARKhLRsrSEFQUFlDUkFGVC5PUkdob3N0am9obnNvbi1wYy5oYXBweWNyYWZ0Lm9yZzAFoAMCARcwNKADAgEDoS0bK0hBUFBZQ1JBRlQuT1JHaG9zdGpvaG5zb24tcGMuaGFwcHljcmFmdC5vcmcwCaEDAgECogIEADAJoQMCARCiAgQAMAmhAwIBD6ICBAA="} @@ -114,3 +115,73 @@ 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":76,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1549337952282,"flow_last_seen":0,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":376,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":376,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49194,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00897{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"kerberos.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1549337952,"pkt_ts_usec":282970,"pkt_caplen":410,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":410,"pkt_l4_len":376,"pkt":"pB9ywglqAAgCHEeuCABFAAGMAVBAAIAGjyqsEAjJrBAICMAqAb0OVvT1RRDYGlAYAP+BiQAAx2oDxasXfLBTEcjz3tABELHnmrS3ZANlrcp\/hNjXtg\/fwYTBDdsdTzX+XDaW+uv3s2\/LBkJPP0K4Dy0YU3CzKo3pfb0515XvBfsBO7Ma0iP8tOV8txynjcFaEQvYkdi2SQ6bebHRRKNuECPHoWmL3h9GQAZAb4a73kOXQ+HdWdMxxkSNni5ZeogFxLOO9R2cL7EvadD9j700FIRXk1Ysly6p8QSOxUcF2BTlCAMMXraIVwnaJn4OFnBRV1kK62QzrTna4Mma6JSVzK\/6fCHORQn+FIHExUVoG3Vq1BveDwHtG0XGyIXhHabrgc6YQttz\/jzBPNDyI9ROMV3pQ0pZrTLzCjs+95mV\/WzyQTG\/SRF7u\/0NE9yZnVgk7HZw7F9bqd7MfX+aga2J6\/HQLbCChYzLyXsDW8WbBsbXh+XIiTyOIboYMLvBqY271GjiVoIyA7mbRvLsykMc7DElauDSPsA2vtc="} 00765{"flow_id":36,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1549337952,"pkt_ts_usec":283232,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"AAgCHEeupB9ywglqCABFAAEsFBRAAIAGfMasEAgIrBAIyQG9wCpFENgaDlb2WVAYAP9XsAAAAAABAP5TTUJAAAEAAAAAAAEAHwAJAAAAAAAAAAEAAAAAAAAA\/\/4AAAAAAABhAAAAAAQAAFesIp3Ms9YkV3HyzmcNx+gJAAAASAC4AKGBtTCBsqADCgEAoQsGCSqGSIL3EgECAqKBnQSBmmCBlwYJKoZIhvcSAQICAgBvgYcwgYSgAwIBBaEDAgEPongwdqADAgESom8EbUXiUY0MYNrse7Xdy+nvFD1NZYMmVWsdodfXY9v69kCk+MLVD1Rqj48zpMQyXFgAZRbdNaLq\/lZFH5cVcwmZOZp6PzJLHFRz2Ys9FBPKwjMkCOL5scijYfadSqIU\/eT7q\/ACDBFzzf8MmsOdu9E="} +00506{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":6,"flow_first_seen":1549337930219,"flow_last_seen":1549337951711,"flow_tot_l4_data_len":1802,"flow_min_l4_data_len":240,"flow_max_l4_data_len":395,"flow_avg_l4_data_len":300,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49165,"dst_port":49155,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":6,"flow_first_seen":1549337930219,"flow_last_seen":1549337951711,"flow_tot_l4_data_len":1802,"flow_min_l4_data_len":240,"flow_max_l4_data_len":395,"flow_avg_l4_data_len":300,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49165,"dst_port":49155,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1549337940432,"flow_last_seen":1549337940433,"flow_tot_l4_data_len":923,"flow_min_l4_data_len":240,"flow_max_l4_data_len":379,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49185,"dst_port":49155,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1549337940432,"flow_last_seen":1549337940433,"flow_tot_l4_data_len":923,"flow_min_l4_data_len":240,"flow_max_l4_data_len":379,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49185,"dst_port":49155,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00599{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1549337929790,"flow_last_seen":1549337929790,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49157,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1549337929790,"flow_last_seen":1549337929790,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49157,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00599{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1549337929811,"flow_last_seen":1549337929812,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49158,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1549337929811,"flow_last_seen":1549337929812,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49158,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00575{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1549337929815,"flow_last_seen":1549337929815,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49159,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1549337929815,"flow_last_seen":1549337929815,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49159,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1549337929816,"flow_last_seen":1549337929816,"flow_tot_l4_data_len":2915,"flow_min_l4_data_len":1451,"flow_max_l4_data_len":1464,"flow_avg_l4_data_len":1457,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49160,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00575{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1549337929981,"flow_last_seen":1549337929983,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":146,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":159,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49162,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1549337929981,"flow_last_seen":1549337929983,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":146,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":159,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49162,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00599{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1549337930192,"flow_last_seen":1549337930193,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49166,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1549337930192,"flow_last_seen":1549337930193,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49166,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00599{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1549337930214,"flow_last_seen":1549337930214,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49167,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1549337930214,"flow_last_seen":1549337930214,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49167,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1549337930217,"flow_last_seen":1549337930217,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":146,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":159,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49168,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1549337930217,"flow_last_seen":1549337930217,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":146,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":159,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49168,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00575{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1549337931198,"flow_last_seen":1549337931199,"flow_tot_l4_data_len":221,"flow_min_l4_data_len":88,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":110,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49170,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1549337931198,"flow_last_seen":1549337931199,"flow_tot_l4_data_len":221,"flow_min_l4_data_len":88,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":110,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49170,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1549337931210,"flow_last_seen":1549337931211,"flow_tot_l4_data_len":2924,"flow_min_l4_data_len":1452,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":1462,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49171,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00578{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1549337931211,"flow_last_seen":1549337931213,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":156,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":620,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49173,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1549337931211,"flow_last_seen":1549337931213,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":156,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":620,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49173,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1549337931218,"flow_last_seen":1549337931219,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49175,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1549337931218,"flow_last_seen":1549337931219,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49175,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1549337931219,"flow_last_seen":1549337931220,"flow_tot_l4_data_len":2915,"flow_min_l4_data_len":1451,"flow_max_l4_data_len":1464,"flow_avg_l4_data_len":1457,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49176,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00600{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1549337937703,"flow_last_seen":1549337937703,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49181,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1549337937703,"flow_last_seen":1549337937703,"flow_tot_l4_data_len":557,"flow_min_l4_data_len":259,"flow_max_l4_data_len":298,"flow_avg_l4_data_len":278,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49181,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00600{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1549337937724,"flow_last_seen":1549337937724,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49182,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"johnson-pc","domain":"happycraft.org","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1549337937724,"flow_last_seen":1549337937724,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":132,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49182,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00574{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1549337937725,"flow_last_seen":1549337937726,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":60,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49183,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1549337937725,"flow_last_seen":1549337937726,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":60,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49183,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1549337940431,"flow_last_seen":1549337940432,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49186,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1549337940431,"flow_last_seen":1549337940432,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":135,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":146,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49186,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00601{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1549337951630,"flow_last_seen":1549337951631,"flow_tot_l4_data_len":515,"flow_min_l4_data_len":255,"flow_max_l4_data_len":260,"flow_avg_l4_data_len":257,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49187,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"happycraft","username":"theresa.johnson"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1549337951630,"flow_last_seen":1549337951631,"flow_tot_l4_data_len":515,"flow_min_l4_data_len":255,"flow_max_l4_data_len":260,"flow_avg_l4_data_len":257,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49187,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00601{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1549337951638,"flow_last_seen":1549337951638,"flow_tot_l4_data_len":517,"flow_min_l4_data_len":182,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49188,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"happycraft","username":"theresa.johnson"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1549337951638,"flow_last_seen":1549337951638,"flow_tot_l4_data_len":517,"flow_min_l4_data_len":182,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49188,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00573{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1549337951639,"flow_last_seen":1549337951639,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":61,"flow_max_l4_data_len":86,"flow_avg_l4_data_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49189,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1549337951639,"flow_last_seen":1549337951639,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":61,"flow_max_l4_data_len":86,"flow_avg_l4_data_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49189,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1549337951709,"flow_last_seen":1549337951710,"flow_tot_l4_data_len":447,"flow_min_l4_data_len":210,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":223,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49190,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1549337951709,"flow_last_seen":1549337951710,"flow_tot_l4_data_len":447,"flow_min_l4_data_len":210,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":223,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49190,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1549337952265,"flow_last_seen":1549337952266,"flow_tot_l4_data_len":420,"flow_min_l4_data_len":199,"flow_max_l4_data_len":221,"flow_avg_l4_data_len":210,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49192,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1549337952265,"flow_last_seen":1549337952266,"flow_tot_l4_data_len":420,"flow_min_l4_data_len":199,"flow_max_l4_data_len":221,"flow_avg_l4_data_len":210,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49192,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00576{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1549337952280,"flow_last_seen":1549337952281,"flow_tot_l4_data_len":420,"flow_min_l4_data_len":199,"flow_max_l4_data_len":221,"flow_avg_l4_data_len":210,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49195,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1549337952280,"flow_last_seen":1549337952281,"flow_tot_l4_data_len":420,"flow_min_l4_data_len":199,"flow_max_l4_data_len":221,"flow_avg_l4_data_len":210,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49195,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00573{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1549337952282,"flow_last_seen":1549337952282,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":55,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":61,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49196,"dst_port":88,"l4_proto":"tcp","ndpi": {"proto":"Kerberos","breed":"Acceptable","category":"Network"},"kerberos": {"hostname":"","domain":"","username":""}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1549337952282,"flow_last_seen":1549337952282,"flow_tot_l4_data_len":123,"flow_min_l4_data_len":55,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":61,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49196,"dst_port":88,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1549337929983,"flow_last_seen":1549337929983,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49161,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1549337929983,"flow_last_seen":1549337929983,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49161,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1549337931189,"flow_last_seen":1549337931190,"flow_tot_l4_data_len":492,"flow_min_l4_data_len":230,"flow_max_l4_data_len":262,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49169,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1549337931189,"flow_last_seen":1549337931190,"flow_tot_l4_data_len":492,"flow_min_l4_data_len":230,"flow_max_l4_data_len":262,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49169,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1549337931211,"flow_last_seen":1549337931213,"flow_tot_l4_data_len":492,"flow_min_l4_data_len":230,"flow_max_l4_data_len":262,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49172,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1549337931211,"flow_last_seen":1549337931213,"flow_tot_l4_data_len":492,"flow_min_l4_data_len":230,"flow_max_l4_data_len":262,"flow_avg_l4_data_len":246,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49172,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1549337937690,"flow_last_seen":1549337937691,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49179,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1549337937690,"flow_last_seen":1549337937691,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49179,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1549337937700,"flow_last_seen":1549337937701,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49180,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1549337937700,"flow_last_seen":1549337937701,"flow_tot_l4_data_len":516,"flow_min_l4_data_len":230,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":258,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49180,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1549337952267,"flow_last_seen":1549337952267,"flow_tot_l4_data_len":564,"flow_min_l4_data_len":230,"flow_max_l4_data_len":334,"flow_avg_l4_data_len":282,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49191,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1549337952267,"flow_last_seen":1549337952267,"flow_tot_l4_data_len":564,"flow_min_l4_data_len":230,"flow_max_l4_data_len":334,"flow_avg_l4_data_len":282,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49191,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1549337952273,"flow_last_seen":1549337952274,"flow_tot_l4_data_len":580,"flow_min_l4_data_len":230,"flow_max_l4_data_len":350,"flow_avg_l4_data_len":290,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49193,"dst_port":389,"l4_proto":"tcp","ndpi": {"proto":"LDAP","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1549337952273,"flow_last_seen":1549337952274,"flow_tot_l4_data_len":580,"flow_min_l4_data_len":230,"flow_max_l4_data_len":350,"flow_avg_l4_data_len":290,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49193,"dst_port":389,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1549337929817,"flow_last_seen":1549337929818,"flow_tot_l4_data_len":527,"flow_min_l4_data_len":247,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":263,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49156,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"SMBv23","breed":"Acceptable","category":"System"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1549337929817,"flow_last_seen":1549337929818,"flow_tot_l4_data_len":527,"flow_min_l4_data_len":247,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":263,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49156,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1549337931220,"flow_last_seen":1549337931221,"flow_tot_l4_data_len":527,"flow_min_l4_data_len":247,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":263,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49174,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"SMBv23","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1549337931220,"flow_last_seen":1549337931221,"flow_tot_l4_data_len":527,"flow_min_l4_data_len":247,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":263,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49174,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1549337952282,"flow_last_seen":1549337952283,"flow_tot_l4_data_len":656,"flow_min_l4_data_len":280,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49194,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"SMBv23","breed":"Acceptable","category":"System"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1549337952282,"flow_last_seen":1549337952283,"flow_tot_l4_data_len":656,"flow_min_l4_data_len":280,"flow_max_l4_data_len":376,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.8.201","dst_ip":"172.16.8.8","src_port":49194,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":77,"source":"kerberos.pcap","alias":"nDPId-test"} diff --git a/test/results/long_tls_certificate.pcap.out b/test/results/long_tls_certificate.pcap.out index 8f5c09781..0ec143551 100644 --- a/test/results/long_tls_certificate.pcap.out +++ b/test/results/long_tls_certificate.pcap.out @@ -1,3 +1,4 @@ +00397{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"long_tls_certificate.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"long_tls_certificate.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1609756181300,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.60","dst_ip":"106.15.100.123","src_port":55333,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"long_tls_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609756181,"pkt_ts_usec":300869,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGqknAqAE8ag9ke9glAbsIXeEZAAAAALAC\/\/9qjwAAAgQFtAEDAwUBAQgKDpRqEwAAAAAEAgAA"} 00451{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"long_tls_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609756181,"pkt_ts_usec":671657,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"KDc3AG3IEBMx8Tl2CABFAABAAABAACsGv0lqD2R7wKgBPAG72CWlbC1xCF3hGrASMqDiugAAAgQFrAEBAQEBAQEBAQEBAQEBAQEEAgAA"} @@ -17,3 +18,5 @@ 00422{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"long_tls_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609756182,"pkt_ts_usec":35862,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGqmHAqAE8ag9ke9glAbsIXeMfpWxIPFAQ\/\/9sXwAA"} 01837{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"long_tls_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609756182,"pkt_ts_usec":43894,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"KDc3AG3IEBMx8Tl2CABFAARCso1AACkGCrpqD2R7wKgBPAG72CWlbEQiCF3jH1AYHIQyjQAAdGlvbiBDQSAtIFNIQTI1NiAtIEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxw5sPyOTf8xwpZ0gww5TP37ATsKYScpH1SPvAzSFdMijAi5GXAt9yYidT4vw+JxsjFU127\/ys+r741bnSkbZEyLKNtWbwajjlkOT8gy85vnm6JnIY0h4f1c2aRoZHVrR1H3CnNR\/4YASrnrqiOpX2MoKCjoSSaJiGXoNJPc367RzknsFI5sStc7rKd+kFAK5AaXUppxDZIje+H7+4\/Ue5f7co6jkZjHZTCXpGLmJWQmu6Z0cbTcPSh41ICjir9QhiwHERa1uK2OrkmthCk0g7XO6fM7+FrXbn4Dw1ots2Qh5Sk94ZdqSvL41+bPE+SeATv+WUuYCIOEHc+ldK72y8QIDAQABo4IBJTCCASEwDgYDVR0PAQH\/BAQDAgEGMBIGA1UdEwEB\/wQIMAYBAf8CAQAwHQYDVR0OBBYEFJbeYfG9HBYpUxzAzH07gwBA5hp8MEcGA1UdIARAMD4wPAYEVR0gADA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QuY3JsMD0GCCsGAQUFBwEBBDEwLzAtBggrBgEFBQcwAYYhaHR0cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vcm9vdHIxMB8GA1UdIwQYMBaAFGB7ZhpFDZfKiVAvfQTNNKj\/\/P1LMA0GCSqGSIb3DQEBCwUAA4IBAQBGKu5eva4BYDcxEYZxdLZGScgQFv4vYiMXqx+H+ILtyt8OLN9kdY7lGHKnjDqLyayld1D3756k4KCPFFejKl\/sfm0Q5rqNsAiHdg5MstlRuxEC8lzdHL3zVZYP1AbA\/OIjiiRw07vweRqnYXCDiq8GxSDYoWPQbK5PMteufBhFdQUpd99CQGRkhr4qdgkxbx0k9JnQhf7yIQj5xvbx0Fnt1lY8CCgDZ7rw+fGQFkeuZ+a8gEjpQnY0l1VpJA6D1qAttPXzeYpJKHQaQaHC0ySINTBglBe04QQiMT07LxcGsridhitaae+D9UvEqrQq+HyhsYWUjPQMhwz0rED4WUmYFgMDAJQMAACQAwAXQQQHBay7E+l5uDF6vN0dNLfHZ3XFe8J1r8409dB6E5YGVhU9B+hLA4Y34U3QyAAeGWQ1RguC3GcZ8MZf0+Ru71\/JBAMARzBFAiAgyGq4ahdxqLGVDNRsFNBgOBB+olXEjHLxrojVx2ay6wIhAOyZtyRBCq\/VlL8q4e2g98hxlplagBQF4DnrtMUJaXs6FgMDAAQOAAAA"} 00438{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"long_tls_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609756182,"pkt_ts_usec":43951,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGqlXAqAE8ag9ke9glAbsIXeMfpWxIPIAQ\/\/9fEAAAAQEFCqVsRCKlbEg8"} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":47,"source":"long_tls_certificate.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":47,"flow_first_seen":1609756181300,"flow_last_seen":1609756183162,"flow_tot_l4_data_len":13184,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":280,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.60","dst_ip":"106.15.100.123","src_port":55333,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00140{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":47,"source":"long_tls_certificate.pcap","alias":"nDPId-test"} diff --git a/test/results/malformed_dns.pcap.out b/test/results/malformed_dns.pcap.out index 6505edccc..4efce7669 100644 --- a/test/results/malformed_dns.pcap.out +++ b/test/results/malformed_dns.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"malformed_dns.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"malformed_dns.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591551760342,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50435,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"malformed_dns.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591551760,"pkt_ts_usec":342902,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"AAAAAAAAAAAAAAAACABFAAA4nToAAEAR33h\/AAABfwAAAcUDADUAJP43hLQBAAABAAAAAAAAA3d3dwJ4dANjb20AAAEAAQ=="} 00627{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"malformed_dns.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591551760342,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50435,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"www.xt.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -9,3 +10,5 @@ 02609{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"malformed_dns.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591551765,"pkt_ts_usec":355529,"pkt_caplen":1430,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1430,"pkt_l4_len":1396,"pkt":"\/\/\/\/\/\/\/\/AAAAAAAACABFAAWIAAEAAEARd2J\/AAABfwAAAQA1xQMFdLSchLSBAAACAAIAAAAAA3d3dwJ4dANjb20AAAEAASJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBPwAAAAA\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8+Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz\/AQD0+Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/wEHAQjs8PT4\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/P8BDwETARcBGNzg5Ojs8PT4\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz\/AR8BIwEnASsBLwEzATcBOLzAxMjM0NTY3ODk6Ozw9Pj8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/wE\/AUMBRwFLAU8BUwFXAVsBXwFjAWcBawFvAXMBdwF4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9PsBfwGDAYcBiwGPAZMBlwGbAZ8BowGnAasBrwGzAbcBuwG\/AcMBxwHLAc8B0wHXAdsB3wHjAecB6wHvAfMB9wH4AAQABwAwAAQABAAAAAAAEQkJCQsAMAAUAAQAAAAAATANBQUE\/MDAwMDEwMDAyMDAxMTAwMTIwMDIxMDAyMjAxMDEwMjAxMTEwMTEyMDEyMTAxMjIwMjAyMTEwMjEyMDIyMTAyBQAAAAAAwP8="} 00691{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":5,"source":"malformed_dns.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_first_seen":1591551760342,"flow_last_seen":1591551765355,"flow_tot_l4_data_len":4260,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1396,"flow_avg_l4_data_len":852,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50435,"dst_port":53,"l4_proto":"udp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"www.xt.com","num_queries":2,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"0.0.0.0"}} 02609{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"malformed_dns.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591551765,"pkt_ts_usec":368813,"pkt_caplen":1430,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1430,"pkt_l4_len":1396,"pkt":"\/\/\/\/\/\/\/\/AAAAAAAACABFAAWIAAEAAEARd2J\/AAABfwAAAQA1xQMFdLSchLSBAAACAAIAAAAAA3d3dwJ4dANjb20AAAEAASJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBPwAAAAA\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8+Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz\/AQD0+Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/wEHAQjs8PT4\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/P8BDwETARcBGNzg5Ojs8PT4\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz\/AR8BIwEnASsBLwEzATcBOLzAxMjM0NTY3ODk6Ozw9Pj8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/Pz8\/wE\/AUMBRwFLAU8BUwFXAVsBXwFjAWcBawFvAXMBdwF4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9PsBfwGDAYcBiwGPAZMBlwGbAZ8BowGnAasBrwGzAbcBuwG\/AcMBxwHLAc8B0wHXAdsB3wHjAecB6wHvAfMB9wH4AAQABwAwAAQABAAAAAAAEQkJCQsAMAAUAAQAAAAAATANBQUE\/MDAwMDEwMDAyMDAxMTAwMTIwMDIxMDAyMjAxMDEwMjAxMTEwMTEyMDEyMTAxMjIwMjAyMTEwMjEyMDIyMTAyBQAAAAAAwP8="} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"malformed_dns.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1591551760342,"flow_last_seen":1591551765368,"flow_tot_l4_data_len":5656,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1396,"flow_avg_l4_data_len":942,"midstream":0,"l3_proto":"ip4","src_ip":"127.0.0.1","dst_ip":"127.0.0.1","src_port":50435,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"malformed_dns.pcap","alias":"nDPId-test"} diff --git a/test/results/malformed_icmp.pcap.out b/test/results/malformed_icmp.pcap.out index 968763935..01264e42f 100644 --- a/test/results/malformed_icmp.pcap.out +++ b/test/results/malformed_icmp.pcap.out @@ -1,3 +1,6 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"malformed_icmp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00448{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"malformed_icmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1593066612951,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"218.152.179.213","dst_ip":"218.152.179.54","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} 00397{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"malformed_icmp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593066612,"pkt_ts_usec":951269,"pkt_caplen":42,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":42,"pkt_l4_len":8,"pkt":"AFUir8Y3AERm\/CmvCABFAAAcAAEAAEABXqPamLPV2pizNqUAWv8AAAAA"} 00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"malformed_icmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1593066612951,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"218.152.179.213","dst_ip":"218.152.179.54","l4_proto":"icmp","ndpi": {"flow_risk": {"17":"Malformed packet"},"proto":"ICMP","breed":"Acceptable","category":"Network"}} +00449{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"malformed_icmp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1593066612951,"flow_last_seen":0,"flow_tot_l4_data_len":8,"flow_min_l4_data_len":8,"flow_max_l4_data_len":8,"flow_avg_l4_data_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"218.152.179.213","dst_ip":"218.152.179.54","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"malformed_icmp.pcap","alias":"nDPId-test"} diff --git a/test/results/malware.pcap.out b/test/results/malware.pcap.out index 3299a4f40..7a43679f3 100644 --- a/test/results/malware.pcap.out +++ b/test/results/malware.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"malware.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569571466977,"flow_last_seen":0,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"1.1.1.1","src_port":42370,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00480{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569571466,"pkt_ts_usec":977364,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"CGoKOl4eMFLLbJwbCABFAABcg9cAAEARLQnAqAcHAQEBAaWCADUASMoKC6QBIAABAAAAAAABA3d3dw9pbnRlcm5ldGJhZGd1eXMDY29tAAABAAEAACkQAAAAAAAADAAKAAjrBFAObfGpig=="} 00634{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"malware.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569571466977,"flow_last_seen":0,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"1.1.1.1","src_port":42370,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"www.internetbadguys.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -35,3 +36,6 @@ 00407{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"malware.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569579417,"pkt_ts_usec":30097,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"CGoKOl4eMFLLbJwbCABFAAAoxfRAAEAGDIPAqAcHQ9dc0omkAbvdSlzxHWneDVAQAd9ocwAA"} 00581{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"malware.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569579417,"pkt_ts_usec":39098,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"CGoKOl4eMFLLbJwbCABFAACmxfVAAEAGDATAqAcHQ9dc0omkAbvdSlzxHWneDVAYAfVo8QAAFgMDAEYQAABCQQQXnDccjfVZWhqBUucdKddp1G59dDixN1oUPMNrwd\/5+g0DfHVKaOkM7PBEa\/PQ0DStvwqbgxEQhAx2pf\/kyEJVFAMDAAEBFgMDACgAAAAAAAAAAMBOO2LVRDZ5rUhBnMhKrHETxOl4WnHbkdoDiQqlhuRT"} 00451{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"malware.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569579417,"pkt_ts_usec":39640,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"CGoKOl4eMFLLbJwbCABFAABHxfZAAEAGDGLAqAcHQ9dc0omkAbvdSl1vHWneDVAZAfVokgAAFQMDABoAAAAAAAAAARyktu6aPdJhbsX8oiEa2+1Qow=="} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":26,"source":"malware.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":20,"flow_first_seen":1569579416636,"flow_last_seen":1569579417280,"flow_tot_l4_data_len":6442,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":322,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"67.215.92.210","src_port":35236,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":26,"source":"malware.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1569579408876,"flow_last_seen":1569579409087,"flow_tot_l4_data_len":413,"flow_min_l4_data_len":64,"flow_max_l4_data_len":349,"flow_avg_l4_data_len":206,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.7.7","dst_ip":"67.215.92.210","src_port":48394,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":26,"source":"malware.pcap","alias":"nDPId-test"} diff --git a/test/results/modbus.pcap.out b/test/results/modbus.pcap.out index a3acaaabe..1303da3ba 100644 --- a/test/results/modbus.pcap.out +++ b/test/results/modbus.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"modbus.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1223541953927,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541953,"pkt_ts_usec":927963,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0i\/1AAIAGEGjAqG6DwKhuiggaAfZB0urG4RU6zlAY\/MYAMgAAANEAAAAGAQMAAQAB"} 00511{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1223541953927,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","ndpi": {"proto":"Modbus","breed":"Acceptable","category":"IoT-Scada"}} @@ -15,3 +16,5 @@ 00425{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":932270,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAdAAIAGEF7AqG6DwKhuiggaAfZB0usO4RU7EFAY\/IT\/4wAAANcAAAAGAQMAAQAB"} 00423{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":933391,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzPDRAAIAGYDLAqG6KwKhugwH2CBrhFTsQQdLrGlAY+6P+vAAAANcAAAAFAQMCAAA="} 00425{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":933457,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAhAAIAGEF3AqG6DwKhuiggaAfZB0usa4RU7G1AY\/Hn\/1wAAANgAAAAGAQMAAAAB"} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":102,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":102,"flow_first_seen":1223541953927,"flow_last_seen":1223541977037,"flow_tot_l4_data_len":3213,"flow_min_l4_data_len":31,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":31,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":102,"source":"modbus.pcap","alias":"nDPId-test"} diff --git a/test/results/monero.pcap.out b/test/results/monero.pcap.out index ed2d5ba6f..91d2d14f1 100644 --- a/test/results/monero.pcap.out +++ b/test/results/monero.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"monero.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"monero.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1514196188350,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.148","dst_ip":"94.23.199.191","src_port":46838,"dst_port":3333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"monero.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196188,"pkt_ts_usec":350524,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"fmgbW\/gUcIXCQ0+iCABFAAA8e7pAAEAG1e7AqAKUXhfHv7b2DQVL2\/baAAAAAKACchDZewAAAgQFtAQCCAocofANAAAAAAEDAwc="} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"monero.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196188,"pkt_ts_usec":430828,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"cIXCQ0+ifmgbW\/gUCABF4AA8AABAADEGX8leF8e\/wKgClA0FtvbB2Ar1S9v226AScSCYUwAAAgQFtAQCCArnhI20HKHwDQEDAwc="} @@ -32,3 +33,6 @@ 00416{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"monero.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196197,"pkt_ts_usec":709341,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"cIXCQ0+ifmgbW\/gUCABFAAAoOQlAACEGQPR006fDwKgClA0F0lYVgmAq8ygEj1AQAOWCXAAAAAAAAAAA"} 00827{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"monero.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196198,"pkt_ts_usec":363248,"pkt_caplen":364,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":364,"pkt_l4_len":330,"pkt":"cIXCQ0+ifmgbW\/gUCABFAAFeOQpAACEGP71006fDwKgClA0F0lYVgmAq8ygEj1AYAOXjWAAAeyJpZCI6bnVsbCwibWV0aG9kIjoibWluaW5nLm5vdGlmeSIsInBhcmFtcyI6WyIyOWM0YzUxZTI4OGE4Y2EyYzM2NSIsIjA0MDAwMDAwIiwiOWUyZmM3NjhiZDE5Nzc1MjhjOGQ2MDk2ZDQ2Mzc2NzU4MTc5ZTI1YmYzMjkzNDI4YjY1ZjEyMDEwMDAwMDAwMCIsIjM1ZDM0MWE4YjE5YTM4Y2Q1ODRjYjU0OTQxODViNGRiZjFhN2VhYTkxYTlmZjY1NDFlODUxZGU1MGNiYzg4YTIiLCIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIiwiYTljYzQwNWEiLCIwOWQ4MTUxYyIsdHJ1ZV19Cg=="} 00409{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"monero.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196198,"pkt_ts_usec":405805,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"fmgbW\/gUcIXCQ0+iCABFAAAolt1AAEAGxB\/AqAKUdNOnw9JWDQXzKASPFYJhYFAQAO2BHgAA"} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":319,"source":"monero.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":47,"flow_first_seen":1514196196437,"flow_last_seen":1514197261597,"flow_tot_l4_data_len":8695,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1464,"flow_avg_l4_data_len":185,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.148","dst_ip":"116.211.167.195","src_port":53846,"dst_port":3333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":319,"source":"monero.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":272,"flow_first_seen":1514196188350,"flow_last_seen":1514197279769,"flow_tot_l4_data_len":147111,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":540,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.148","dst_ip":"94.23.199.191","src_port":46838,"dst_port":3333,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":319,"source":"monero.pcap","alias":"nDPId-test"} diff --git a/test/results/mongodb.pcap.out b/test/results/mongodb.pcap.out index 0e93eb3a6..de54f31d8 100644 --- a/test/results/mongodb.pcap.out +++ b/test/results/mongodb.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"mongodb.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00413{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"mongodb.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1483459978,"pkt_ts_usec":959064,"pkt_caplen":82,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":82,"pkt_l4_len":0,"pkt":"LGv11hfFABsXAAIwgQABLAgARQAAQHp6QAA\/BrGvCgoKCgoKCgvKbmmJmGzsIgAAAACwAv\/\/ouIAAAIEBVABAwMFAQEICm\/8XGwAAAAABAIAAA=="} 00157{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"mongodb.pcap","alias":"nDPId-test","type":33024} 00412{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"mongodb.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1483459978,"pkt_ts_usec":959080,"pkt_caplen":82,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":82,"pkt_l4_len":0,"pkt":"LGv11hfFLGv11hfMgQAAMggARQAAQHp6QAA+BrKvCgoKCgoKCgvKbmmJmGzsIgAAAACwAv\/\/ouIAAAIEBVABAwMFAQEICm\/8XGwAAAAABAIAAA=="} @@ -52,3 +53,4 @@ 00158{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":26,"source":"mongodb.pcap","alias":"nDPId-test","type":33024} 00498{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":27,"source":"mongodb.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1483814916,"pkt_ts_usec":108514,"pkt_caplen":143,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":143,"pkt_l4_len":0,"pkt":"LGv11hfFABsXAAIwgQABLAgARQAAfYoRQAA\/BvKWCgoKEgoKChP8NnUwNO8EZBGWgSuAGBAgykwAAAEBCAoeHKgCUsc3tEkAAACHkQAA\/\/\/\/\/9QHAAAAAAAASW5hY3RpdmVVc2VySWRlbnRpdHkuJGNtZAAAAAAAAQAAABMAAAAQZ2V0bm9uY2UAAQAAAAA="} 00158{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":27,"source":"mongodb.pcap","alias":"nDPId-test","type":33024} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":27,"source":"mongodb.pcap","alias":"nDPId-test"} diff --git a/test/results/mpeg.pcap.out b/test/results/mpeg.pcap.out index eacebd485..29be67e6e 100644 --- a/test/results/mpeg.pcap.out +++ b/test/results/mpeg.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"mpeg.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"mpeg.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1434379491040,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.80.160","dst_ip":"46.101.157.119","src_port":55804,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"mpeg.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434379491,"pkt_ts_usec":40018,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"yGyHABajPBXCt3IOCABFAABAOE9AAEAGJUTAqFCgLmWdd9n8AFBP68YoAAAAALAC\/\/\/OTgAAAgQFtAEDAwUBAQgKFSiGAAAAAAAEAgAA"} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"mpeg.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434379491,"pkt_ts_usec":117076,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":40,"pkt":"PBXCt3IOyGyHABajCABFAAA8AABAADIGa5cuZZ13wKhQoABQ2fyPIjpcT+vGKaAScSAIFwAAAgQFqAQCCAoAu5vaFSiGAAEDAwhf8g=="} @@ -16,3 +17,5 @@ 00422{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"mpeg.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434379491,"pkt_ts_usec":160493,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"yGyHABajPBXCt3IOCABFAAA0OtBAAEAGIs\/AqFCgLmWdd9n8AFBP68a9jyJWaYAQD9N6+gAAAQEIChUohncAu5vu"} 02410{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"mpeg.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434379491,"pkt_ts_usec":161455,"pkt_caplen":1502,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1502,"pkt_l4_len":1468,"pkt":"PBXCt3IOyGyHABajCABFAAXQobZAADIGxEwuZZ13wKhQoABQ2fyPIlZpT+vGvYAQAHYVzwAAAQEICgC7m+4VKIZNLxLPeV6nXf99nXeO25UCRqFtev\/ziMRJO5QiBADGFt1lt4y3ehfS44MRlUZk0\/QSGda240tmYffh2bdBF\/+QOm3WNxqGqtFF7kXpF3w5JJLasR8f6G46XDvNgTw\/jrNCWHgdLiQKRuBMPQJpeViHlZLHaQRubj4OAR3lR5pxUgz9nAT02BoeH861yJDJqpqLnDZdsov6SiunTETxNqV1\/f03ubiL4\/ZO5vNO2Oe58\/NT9sbstsTsiYfXbava633U0yc8xUOqgmG0p0vweE5ZxMoqMKQbHRWKP88aib0q4YisEyhW161usTYmzBnkw8DwL4pHUM8SCC4KNzaDsR4+S7jrN1OoxQJdCz8WziOBVsxrRlc4KJTlsPByV8RWrLpDD+YTROcm7GcCQOuOTGDIpUNN4\/\/ziMRtPNQuAAFZeAHREFghNDAT5kYD4hryhTrgzQFe+bDjeG4ikupFGvo7W0PmpGUititkjmZKeQ5UVlgR4VmVTr8qsc8wNNLZRj0\/iN0SLPmFa3rmFDvbN5vL\/G1mtveud+n9vu28at7e9\/PJjyXz96pvW77l1nEX+2c2zfFvvP1Wv1bWq4pW1L51TOd6iZp4sOqka4awxYfMEEMKaetRlRfEDRneTGJYFAjAHNSIq+oUQ5YHmizEozPOUSVbBIOIABeiHzApAVKMQDYuZMIYYac0yIIlHpuZcNPtW5NwGB0HTCjgw4aAsNMUOCCN55S09d7dlLBCMFC4oGjRhyQVMgUKqUtcCSQMFmbFxJxPdxsquwwwYUYXpdgaKig8yP\/ziMSMYDxqQAGZ0AAAM0rGShghoOYAlO9pMTM0oBoFLtkkMRR330cRcZRkN2PMuJAAxZLdCJGgDBK4HGgSRMYQLnEzg2z8WPAqUFUjTI3Qy5+F+RuowNOusoODWJfYiRCyA3bMyZ0xRhiZjAI4SDj8CLBkA03gJ+jRgScMMAzNxAMBTxiAoQZffXXPWIfuWOf3v\/5IAXcwpaXF1LAP79XK3+HmMGEAFDxSldambDGuValHc\/nf\/\/+3rC3UsajFi5DE5LOd\/87uVV7pZD0uj8BP\/DLdG3Za0dWNMTms61Wo6j6uq4bkM\/aQriRX2cpzMnZ5L\/z\/\/\/\/bgwOCP\/\/\/28W9T0UP9CxommOwv4kA9atYSULbikxC4oaI\/RymILguS\/\/ziMQeQzRCbAGPeACiwRsgAFVmDTRpPxbQgAZR2jNPUcZvjhEBAbGkvyomMonApBfSatJASCi4C9Yj+QxwEKQCbMQ\/wgbgb6HhoF7YiYo8TwLUUaLHwc6CPOQgxiFMdZnjwTT0RVVLgmqhbRlF6JnBLsc5JImUoPSfp1HDYti5N8kRdFoXc1z1Oct68YaoK5BOCgfFzLycNFs1ilJmXEykWtPAXxzxj+TekmuDLgt8ZHLpRU3PWlf\/+XCq7gKWLSbWfv\/q+NBdtjZv5\/\/\/\/+Pu\/zLWDFr8Xh6ff7\/rf0nplvs+jTRIO\/\/j69neL7h3+WbO9VtL\/\/\/PU7lgfQCIwLqQcmaKFuPwqj\/IQS4\/pAj4uhfEKb0ePERgQNVJeEcyFP\/ziMQkQVRqaAOPeABmJZS3OFOk3JopmdDW1SGaQVJCBMCWThiAe1CklbCjOIBWAXk7VBhFxoAwGWFYWFhUJhE9SqeEjDjDeIEBoF6GoPspCaCKJEfhC24fQapihl9UxQnOiyTn4ZygIMOAhBzixnsxEOD9HmepBkE+hp2DAjVJSQYlxNl0p47AbIaa6QoeLU1pcyUuhh9nMV6PbbdEi2ktq3OUKNms6uY8rqLErr1\/\/UMVWxdfNcbx\/\/WvzX\/OM6\/\/\/x8b\/3eese00eST2\/z6+2\/6Z9rRVbuL\/86x\/86xn\/P3a38uP\/\/559f\/\/5e1VdFUrLY4uZlzRQIUzHSubqqV1Zp\/pWnKXhf8="} 01235{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"mpeg.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1434379491,"pkt_ts_usec":161458,"pkt_caplen":665,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":665,"pkt_l4_len":631,"pkt":"PBXCt3IOyGyHABajCABFAAKLobdAADIGx5AuZZ13wKhQoABQ2fyPIlwFT+vGvYAYAHY9pgAAAQEICgC7m+4VKIZNQSlxWCwU16Cy6pgGmFF2UpCoOqaxROb\/84jEMUn8QdgB2MAAQDNNj0WmX9nE0jCg1oW6XOMYC+UXazArSkxoOZUxKXtZdVuwJAYxJ0vUkMkUsZxr8pf2Xd1TWplcpd0tq2zSVivzEnelaPJeGH0EqKMOJfJ1MbMTThFAckaYAloVczkNQ9Gn1ZyzmHajtNaXcy6DEvkinWgFdrLaR2n9jMMv7LaBgSEpAM4rpKBKDMSi0RYasWHpl2Xdh2zWhp\/rM1Gpda3SxmM5VaWl5qtTWsdZVsu1YzGbVWlpbP1qamx1lll3dWly\/eOOP5ZY\/\/\/rLLL8ssvx5+X\/+OP5U1NytTZfjz9Y\/rLLLcpjNrdLS2cf\/94444\/WppVS4kxBTUUzLjgyqqqqqqqqqqqqqqqqqqqqqqqqqqr\/84jEAAAAA0gAAAAATEFNRTMuODKqqqqqqqqqqqqqqqpMQU1FMy44Mqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo="} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":19,"source":"mpeg.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":19,"flow_first_seen":1434379491040,"flow_last_seen":1434379491221,"flow_tot_l4_data_len":9991,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":525,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.80.160","dst_ip":"46.101.157.119","src_port":55804,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":19,"source":"mpeg.pcap","alias":"nDPId-test"} diff --git a/test/results/mpegts.pcap.out b/test/results/mpegts.pcap.out index 8a97363e3..b5a29439d 100644 --- a/test/results/mpegts.pcap.out +++ b/test/results/mpegts.pcap.out @@ -1,2 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"mpegts.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 02637{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"mpegts.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435209297,"pkt_ts_usec":954335,"pkt_caplen":1362,"pkt_type":33024,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":1362,"pkt_l4_len":0,"pkt":"AQBeSMkXrPHfGMSBgQANHwgARQAFQAAAQAAHEaScCgEQMObIyRefIQTSBSxl6UcBARcAD7wd249nI5BqMCydEQCD1YeFyAwoYGMeHIwcYCWAHEkET\/taR\/5YANOTSagKaodBkABeSU4ooP2cAgISCfI7GswCLhYGUDAuoQXALotIDoDAaSxnQetyw1wSf\/AKkMmAETWkokF4lgj\/+lAZSgnOA6QAiGVAYA8goTB50WWTRpqMHIxOOJ8\/G9fR\/gRwAyKEkesyBkAB8oyaCwrrgKE0mAZ74p+4IoA5RfCyWS8HBk6egclHP3xARwEBGEEXVAcUcasfHBwWuxBEA0AR3\/itnAslgP4YRyyuCUAHIGOdlcBl0VAUgAPrJ4fANDAD4iy\/w8TBHHBQGqzAH4UZAHtGCiNQgPA1JISSwngX6AHm4Jf\/mKVIQhIaSD8CMAMGBoJf\/aEdACJNQ4OIkGi0bLH9Meczk8i+AAAAAQ4ShEUQIiWUxLGqxZhYCkaHcmBJHgFBLPZRvGhAjlBpCLwBHUOLiXyWkJ41IhP4BH1T\/uSXFhIJn\/tHAQEZ0kepcDEADUYFzAA1cjMHnioWBMyEDwGRt7NwM5CBuOLJQCnAKi98MAR7oiygHZNJiEoKSG4lmBgaTAxKQSf+iYWQguoQIAGwERxFmI3UAusNyXAUqSlbJ5X4WGOUAQUpObs+A8kBs4JQAaEE6oSWAdQMP\/9ghf9DiGSh5LAYDApaSdFFANnYrBjoHYtBPLLKRUBQDgP0DT\/\/ORgDyJQaGBg0vAKAK8BxyZ0AZ4JIBBDDOFjeKiGBUEcBARooBUCpMQWTeQxgYA46QHYBoSgCIhAOgHYCcAhDKgLuTwFgEYGcAGAZAG8AmQkA1JqS0AOwG5KwBKBQAa\/Alf+AOvwSQA\/sLgKAB+GoBCAGJrko0b0gVRwSf9QHYDoNQCQAIMqMFwDWAfgQnBg\/\/mSg85hwCgAiQkoDIXkxWGAeSTGBGAFG4YCT\/6WQ+AQpqEegNiL\/GrDRqRZackiI5OrlAZ43r4E0jenh7oKAIKjCCsBbeNw5Yo42RwEBGwAfQcAcRNBC\/5Z3JpRQI\/\/QCAlBZTk2chBKACsMQM4Iv\/Q0sAiADYCqACG5YMNXMdDDQLDOOlKiWGYBLwLsCN\/1yL7bI7FfbAAoJBHItxAyYj9CFdLCexAmGGF7vB7MBLz9L5WGDsERwDwKSQJIfcYImKe4c7uIjWFSGKP7CWSAC2zwgfUBhAEzwVP\/g6IJ5OIEAD+DAC0NAQgh\/9kMhk0B1uxSAKllJDAEQYAZFAUAQgk\/+DYh9IBHH\/8Q\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/0cf\/xD\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/"} 00156{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"mpegts.pcap","alias":"nDPId-test","type":33024} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"mpegts.pcap","alias":"nDPId-test"} diff --git a/test/results/mssql_tds.pcap.out b/test/results/mssql_tds.pcap.out index 9b8034283..1822d3b49 100644 --- a/test/results/mssql_tds.pcap.out +++ b/test/results/mssql_tds.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"mssql_tds.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1240877917888,"flow_last_seen":0,"flow_tot_l4_data_len":222,"flow_min_l4_data_len":222,"flow_max_l4_data_len":222,"flow_avg_l4_data_len":222,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":1111,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00683{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"mssql_tds.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1240877917,"pkt_ts_usec":888015,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"AAwpiUrKAFBWwAABCABFAADynIJAAEAGGaUKb29vCgAAAQRXBZk+5C72WSFQkoAYAFx5qQAAAQEICgQLsN8AAVvMAQEAvgAAAQAWAAAAEgAAAAIAAAAAAAAAAAABAAAAIABzAGUAdAAgAHQAcgBhAG4AcwBhAGMAdABpAG8AbgAgAGkAcwBvAGwAYQB0AGkAbwBuACAAbABlAHYAZQBsACAAIAByAGUAYQBkACAAYwBvAG0AbQBpAHQAdABlAGQAIAAgAHMAZQB0ACAAaQBtAHAAbABpAGMAaQB0AF8AdAByAGEAbgBzAGEAYwB0AGkAbwBuAHMAIABvAGYAZgAgAA=="} 00513{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1240877917888,"flow_last_seen":0,"flow_tot_l4_data_len":222,"flow_min_l4_data_len":222,"flow_max_l4_data_len":222,"flow_avg_l4_data_len":222,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":1111,"dst_port":1433,"l4_proto":"tcp","ndpi": {"proto":"MsSQL-TDS","breed":"Acceptable","category":"Database"}} @@ -66,3 +67,8 @@ 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1278068444666,"flow_last_seen":0,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":340,"flow_max_l4_data_len":340,"flow_avg_l4_data_len":340,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":33333,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00849{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1278068444,"pkt_ts_usec":666075,"pkt_caplen":374,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":374,"pkt_l4_len":340,"pkt":"ADAFzckRADAFzck9CABFAAFoT95AAIAGJdMKb29vCgAAAYI1BZl4aO73Gv+xN1AY\/dgFJQAAAwkBQAAAAQAWAAAAEgAAAAIAAAAAAAAAAAABAAAAHQBkAGIAbwAuAHAAcgBvAGMAXwBHAGUAdABNAHkAUwBhAG0AcABsAGUARABhAHQAYQBJAHQAZQBtAHMAAAANQABTAGEAbQBwAGwAZQBJAHQAZQBtAEkAZAAAJBAQZhrDThSiU0infucGD\/\/\/BwdAAEQAYQB0AGEASQBkAADnAgAJBBAAAP\/\/DUAARABhAHQAYQBJAHQAZQBtAFQAeQBwAGUAACQQEJtFubyog2RFsdPp4ZhHj04IQABUAGEAYgBsAGUASQBkAADnAgAJBBAAAP\/\/DUAATQBhAHgARgBlAHQAYwBoAFMAaQB6AGUAACYEBGQAAAASQABTAG8AbQBlAE8AdABoAGUAcgBTAGEAbQBwAGwAZQBJAGQAACYEBAAAAAA="} 00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1278068444666,"flow_last_seen":0,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":340,"flow_max_l4_data_len":340,"flow_avg_l4_data_len":340,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":33333,"dst_port":1433,"l4_proto":"tcp","ndpi": {"proto":"MsSQL-TDS","breed":"Acceptable","category":"Database"}} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1278068444614,"flow_last_seen":0,"flow_tot_l4_data_len":219,"flow_min_l4_data_len":219,"flow_max_l4_data_len":219,"flow_avg_l4_data_len":219,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":11111,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1278068444650,"flow_last_seen":0,"flow_tot_l4_data_len":288,"flow_min_l4_data_len":288,"flow_max_l4_data_len":288,"flow_avg_l4_data_len":288,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":22222,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1278068444584,"flow_last_seen":0,"flow_tot_l4_data_len":238,"flow_min_l4_data_len":238,"flow_max_l4_data_len":238,"flow_avg_l4_data_len":238,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":9999,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1278068444666,"flow_last_seen":0,"flow_tot_l4_data_len":340,"flow_min_l4_data_len":340,"flow_max_l4_data_len":340,"flow_avg_l4_data_len":340,"midstream":1,"l3_proto":"ip4","src_ip":"10.111.111.111","dst_ip":"10.0.0.1","src_port":33333,"dst_port":1433,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"mssql_tds.pcap","alias":"nDPId-test"} diff --git a/test/results/mysql-8.pcap.out b/test/results/mysql-8.pcap.out index 64ae25177..8298ecf92 100644 --- a/test/results/mysql-8.pcap.out +++ b/test/results/mysql-8.pcap.out @@ -1,6 +1,9 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"mysql-8.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"mysql-8.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946708780103,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"10.42.18.198","src_port":8738,"dst_port":3306,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"mysql-8.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946708780,"pkt_ts_usec":103266,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"IiIiIiIiRERERERECABFAAA8OA9AAEAGI6zAqAFpCioSxiIiDOqSBUElAAAAAKACchDH0wAAAgQFtAQCCAoAA3kqAAAAAAEDAwY="} 00433{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"mysql-8.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946708780,"pkt_ts_usec":103549,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"REREREREIiIiIiIiCABFAAA8AABAAD8GXLsKKhLGwKgBaQzqIiISTcRTkgVBJqAScSDgsQAAAgQFtAQCCAoAARFeAAN5KgEDAwc="} 00421{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"mysql-8.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946708780,"pkt_ts_usec":103766,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"IiIiIiIiRERERERECABFAAA0OBBAAEAGI7PAqAFpCioSxiIiDOqSBUEmEk3EVIAQAcl+1QAAAQEICgADeSoAARFe"} 00541{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"mysql-8.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946708780,"pkt_ts_usec":104285,"pkt_caplen":153,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":153,"pkt_l4_len":119,"pkt":"REREREREIiIiIiIiCABFCACL1QpAAD8Gh1kKKhLGwKgBaQzqIiISTcRUkgVBJoAYAONr2QAAAQEICgABEV4AA3kqUwAAAAo4LjUuNDQtMCtkZWI4dTEAJgAAADFeaXQqciJNAP\/3CAIAD4AVAAAAAAAAAAAAAEA6PmshXjc2SlA1WABteXNxbF9uYXRpdmVfcGFzc3dvcmQA"} 00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"mysql-8.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":946708780103,"flow_last_seen":946708780104,"flow_tot_l4_data_len":231,"flow_min_l4_data_len":32,"flow_max_l4_data_len":119,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"10.42.18.198","src_port":8738,"dst_port":3306,"l4_proto":"tcp","ndpi": {"proto":"MySQL","breed":"Acceptable","category":"Database"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4,"source":"mysql-8.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":946708780103,"flow_last_seen":946708780104,"flow_tot_l4_data_len":231,"flow_min_l4_data_len":32,"flow_max_l4_data_len":119,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"10.42.18.198","src_port":8738,"dst_port":3306,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4,"source":"mysql-8.pcap","alias":"nDPId-test"} diff --git a/test/results/nats.pcap.out b/test/results/nats.pcap.out index 7f26aba30..7d529a8c6 100644 --- a/test/results/nats.pcap.out +++ b/test/results/nats.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nats.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"nats.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1586288040,"pkt_ts_usec":558498,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AgAAAEUAAEAAAEAAQAYAAH8AAAF\/AAAB1iQQfvCJzTwAAAAAsAL\/\/\/40AAACBD\/YAQMDBQEBCAo2lJ5iAAAAAAQCAAA="} 00173{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"nats.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"nats.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1586288040,"pkt_ts_usec":558594,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AgAAAEUAAEAAAEAAQAYAAH8AAAF\/AAABEH7WJA7LPw3wic09sBL\/\/\/40AAACBD\/YAQMDBQEBCAo2lJ5iNpSeYgQCAAA="} @@ -52,3 +53,4 @@ 00174{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":26,"source":"nats.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00367{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":27,"source":"nats.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1586288042,"pkt_ts_usec":776134,"pkt_caplen":56,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":56,"pkt_l4_len":0,"pkt":"AgAAAEUAADQAAEAAQAYAAH8AAAF\/AAABEH7WJfixMVfQ63fXgBAx0v4oAAABAQgKNpSm4zaUpuM="} 00174{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":27,"source":"nats.pcap","alias":"nDPId-test","datalink":0,"header":33554432} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":27,"source":"nats.pcap","alias":"nDPId-test"} diff --git a/test/results/nest_log_sink.pcap.out b/test/results/nest_log_sink.pcap.out index c9e1368af..ce9d09a11 100644 --- a/test/results/nest_log_sink.pcap.out +++ b/test/results/nest_log_sink.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nest_log_sink.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1536712992228,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63340,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00421{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536712992,"pkt_ts_usec":228658,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"AJD7JidrGLQwJjRACABFAAAoL2IAAP8GYxrAqPIPI65S7fdsK1cIqL8\/xIBhhVAQD+Vl6gAAAAAAAAAA"} 00414{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"nest_log_sink.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1536712992,"pkt_ts_usec":289465,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"GLQwJjRAAJD7JidrCABFAAAoNpRAAC0G7egjrlLtwKjyDytX92zEgGGFCKi\/QFAQgdDz\/QAA"} @@ -268,3 +269,5 @@ 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":882,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":49,"flow_first_seen":1536718202984,"flow_last_seen":1536718206546,"flow_tot_l4_data_len":10447,"flow_min_l4_data_len":20,"flow_max_l4_data_len":699,"flow_avg_l4_data_len":213,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63351,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":882,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":20,"flow_first_seen":1536718209313,"flow_last_seen":1536718211968,"flow_tot_l4_data_len":2666,"flow_min_l4_data_len":20,"flow_max_l4_data_len":698,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.188.154.186","src_port":63353,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":924,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1536718202959,"flow_last_seen":1536718202959,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"192.168.242.1","src_port":52849,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nest_log_sink.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":96,"flow_first_seen":1536718206572,"flow_last_seen":1536719715232,"flow_tot_l4_data_len":5774,"flow_min_l4_data_len":20,"flow_max_l4_data_len":696,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.15","dst_ip":"35.174.82.237","src_port":63352,"dst_port":11095,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1000,"source":"nest_log_sink.pcap","alias":"nDPId-test"} diff --git a/test/results/netbios.pcap.out b/test/results/netbios.pcap.out index 56524e962..85a32efa0 100644 --- a/test/results/netbios.pcap.out +++ b/test/results/netbios.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"netbios.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00465{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"netbios.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1447772210350,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.4.131","dst_ip":"10.0.5.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00467{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"netbios.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1447772210,"pkt_ts_usec":350540,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/ABj+bLz3CABFAABOYvYAAIARuScKAASDCgAF\/wCJAIkAOr8ep0kBEAABAAAAAAAAIEZJRkRGRUZDRUZFQkVORlBFSUZKQ0FDQUNBQ0FDQUFBAAAgAAE="} 00499{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"netbios.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1447772210350,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.4.131","dst_ip":"10.0.5.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}} @@ -89,3 +90,11 @@ 00462{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"netbios.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1447772251,"pkt_ts_usec":795162,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"ABzEEHkPACFislxDCABFAABOJRwAAH8R\/RQKAAFXCgAEGOJBAIkAOqRfIKgAAAABAAAAAAAAIENLQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBAAAhAAE="} 00502{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":186,"source":"netbios.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1447772251795,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.1.87","dst_ip":"10.0.4.24","src_port":57921,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}} 00632{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"netbios.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1447772251,"pkt_ts_usec":795278,"pkt_caplen":217,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":217,"pkt_l4_len":183,"pkt":"ACFislxDABzEEHkPCABFAADLQERAAIARoG8KAAQYCgABVwCJ4kEAt5PzIKiEAAAAAAEAAAAAIENLQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBAAAhAAEAAAAAAHcER1VOTkFSICAgICAgICAgAAQAVklHSUxBTlRfR1JPVVAgAIQAR1VOTkFSICAgICAgICAgIAQAVklHSUxBTlRfR1JPVVAgHoQAABzEEHkPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":59,"flow_first_seen":1447772211392,"flow_last_seen":1447772269350,"flow_tot_l4_data_len":3422,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.5.233","dst_ip":"10.0.5.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1447772238479,"flow_last_seen":1447772248481,"flow_tot_l4_data_len":482,"flow_min_l4_data_len":58,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.5.233","dst_ip":"10.0.4.24","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":181,"flow_first_seen":1447772210350,"flow_last_seen":1447772269972,"flow_tot_l4_data_len":10498,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.4.131","dst_ip":"10.0.5.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1447772221776,"flow_last_seen":1447772221776,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":58,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.1.87","dst_ip":"10.0.4.24","src_port":57836,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1447772251795,"flow_last_seen":1447772251795,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":58,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.1.87","dst_ip":"10.0.4.24","src_port":57921,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1447772216537,"flow_last_seen":1447772216537,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":20,"flow_max_l4_data_len":21,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.4.24","dst_ip":"10.0.4.131","src_port":139,"dst_port":1398,"l4_proto":"tcp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1447772216537,"flow_last_seen":1447772216537,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":20,"flow_max_l4_data_len":21,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.4.24","dst_ip":"10.0.4.131","src_port":139,"dst_port":1398,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":260,"source":"netbios.pcap","alias":"nDPId-test"} diff --git a/test/results/netbios_wildcard_dns_query.pcap.out b/test/results/netbios_wildcard_dns_query.pcap.out index 5ffedc693..0de23b31b 100644 --- a/test/results/netbios_wildcard_dns_query.pcap.out +++ b/test/results/netbios_wildcard_dns_query.pcap.out @@ -1,3 +1,6 @@ +00403{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1597866040493,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.1.67.250","dst_ip":"10.1.66.20","src_port":41335,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00477{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1597866040,"pkt_ts_usec":493657,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"AAkPCQEKAFBWvdjVCABFAABOhIlAAEARHAYKAUP6CgFCFKF3ADUAOgSEgPAAEAABAAAAAAAAIENLQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBAAAhAAE="} 00666{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1597866040493,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.1.67.250","dst_ip":"10.1.66.20","src_port":41335,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"ckaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","num_queries":0,"num_answers":0,"reply_code":0,"query_type":33,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1597866040493,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.1.67.250","dst_ip":"10.1.66.20","src_port":41335,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00145{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"netbios_wildcard_dns_query.pcap","alias":"nDPId-test"} diff --git a/test/results/netflix.pcap.out b/test/results/netflix.pcap.out index d8c0cf091..838b3cc40 100644 --- a/test/results/netflix.pcap.out +++ b/test/results/netflix.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"netflix.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"netflix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1484319030789,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.24.87.6","src_port":52929,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"netflix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1484319030,"pkt_ts_usec":789585,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"gCqoTGHM5JjWH70UCABFAAA0e0NAAEAGcrPAqAEHNBhXBs7BAbvkIOdkTYzTZoAREADl8AAAAQEICh9kr+C2r\/ET"} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"netflix.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1484319032865,"flow_last_seen":0,"flow_tot_l4_data_len":46,"flow_min_l4_data_len":46,"flow_max_l4_data_len":46,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":51543,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -916,3 +917,61 @@ 02381{"flow_id":62,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6937,"source":"netflix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1484319118,"pkt_ts_usec":927052,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"5JjWH70UgCqoTGHMCABFIAXcl8dAADwGW2G4GcwKwKgBBwBQ0ASr4SSkxYJHF4AQA6uy3AAAAQEICv\/9arQfZfnIRD8Y6nTwviEMXmzebCwSMfPI2CMf3Hg0FyXQStBdtJAwStTHG+WLln8NWr6jqdc8vkdvrIB7fhVRsa47nnc73KpYNsrSfpOCtb4CBuaLHqFu6nhmbveh0lHyXfZXRs1EjLOM91hcx5koEiu6vBlBoOduvkHFLN2u25sczL2naeDSsjjkj+mSlkadS6z4h+yTZZ78zbCd2u1dJsjo2mxn1tcPqD3yS2QfybXU8XcLzS5s58WTyizeAmPlnLx2YYT\/AO9N9yu9Oz+062jg98rivj8Ca3Ebr4HAXRl1TXtNU3HJWr37sRRpfNonD\/F5WWZzgCQcO5C06Ijw52H9WQs01g7aUm9vqWY5enxuXhSQPRMPLO1fZI2XXSTrW+75eerezsdDlt+pYMF0BA\/daOnwB2q855wPuuLpnSMfcbqcGk2uhotXqpXb2+GHA3dcH2U0dT1X\/EMQO6lpo4WgyN0rA4Nydy8r0\/TPOvjjcxweXVtIyuxpdL1PqHUofCnHzUrw1ri7v+Quvp+kdQf8ZN0\/UJHu1e8B0jQPTBBGFMJJNM51ztdpepdK1UEet0ohEo3Mvml9q6c7d03TO9Ym\/wCy8R8U\/CfV9ZqdJJDqJeoFgIJeGtLM+y9zoIHabp+nhf8AUyNod96XXHt2eTlu5KvS7qVZQQq5Eq5nmKMlgBccC+FbS8\/8YdSZ03o7nPeW+Idtt5Qk2r6h1j5Vr9s5llbktY0BrR7nsvBdf+NNbrW\/KRSNjibhz4nG3flcDXde1usHhsf4UIwGMxf39Vyy2Qi9pAS5aejDh+aukmc3Lrce5HJVJ8xyThIz7eSR9ggPDrDXgn3wsd67yREkNJwCPZVuk9P5UZC7dVZTY0ucA4lRdJi39lItxnCsotb5RQHcqh8pzdFJaEQ2+VDYKNuH4Ud99kt1WiGCO3FfsmHCqJKWD2ykMH1VStDJNosEr1XQfjTqHSXMYZTNAOWPzheOtSa8h3NLUysYzwmXavv3SPijSdVha4Ascawu22WN1U4flfnrpnVZum6gPjeCCfMx+QV9U+HPiWHXaUyMt5j\/ANSIm3N9x6ha7XvHmywuL2wLTwQUwOVmhmh1ETZYbLXZFK5jjuAN\/lZSJopNBwFAlJL2RyinhKkIQMBOkrRaGzpFIKVoCkqTQgVITSQFI4KaXZVCRypJIFnlCZFGkIhUhNCBCkUhNAsITQgPyknSSAQnSECQnSKQJFUnSKRCRyikUij3SpOk6VRGkUpIr3UCr1QnSKzwgXdH7JkIpFJCdIpEKu6E6RSo56FKvulSpfIQhMeybCTpAT4QKkUmPdFZQFIT5CSA4RSdcIrCBdkJnhCISdYRSEUJIooz3QNACPwnRQKkJjIRSBITq0ICkk6wnSCNJp0kiAgFFIpMIoSpSpCbEaymU6R+ECQn2KKvhAIpFfdCBJoQgAlSlSKUCpCdZQgXKAE00CISpNCARX7oPKaBITpCBcpoRSKEITRCQmhAqQmjsgSE0IFSE+eE6RSpCOE0CQn+EIEhMBFICkk\/siq5QCOyaKQRTpOkIEhPCECRWUyEDhAkcpo745RCyAmhOvVRSQik1UJCdIpFFZXlPjrRNl6fBqCMRuIJ9ivWcFYOu6L+odE1enH1OYS37jKlawurt8m0vT36uOSSEMEcZovcaF+i5HU5ZtBMYZWlpq\/x6rdoOuQ6CKbQ64PELpNx2fyP4XK+K+sw9a6iyTTs2wsYGNBwTS8kucz1fD6e8Lh+3PjnYdSXvG4XZHquq2WNnU9PIWAiTbWeF52J1PIPddSV9aXSTDlpon7FdcvL1eiy3M5+v+zpdb023xWbaLXfwsHTZGtIp1bwWn2K39U1kWoDmtsl4Gfdefid4MxabAJu\/RTGdtPJl52970xp1uhMDpPPFgfZXQ9Ll0b3yMO4vFGwuF0rXnRObMCHEHY="} 02388{"flow_id":62,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6939,"source":"netflix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1484319118,"pkt_ts_usec":950724,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"5JjWH70UgCqoTGHMCABFIAXcl8hAADwGW2C4GcwKwKgBBwBQ0ASr4SpMxYJHF4AQA6twsgAAAQEICv\/9arQfZfnIuB7hex0+u0+rg8SJwN9ryF5spcbuPVx5SzTganp0r3h07iXAUCTwFkfp4mDzfp\/lei1DC8ZJAXnutTw6XTFjMyyYFZKuNta1jjNuZ0lwf1nxskRhxA72RQC9NB0eKPQOjlY0vkFuv1K5vwl0wv1Xjv4Av\/svV6u2Aq597pOPHWO6+YdR0TtHqHxGy2\/KUaGbezwnHzt7leg63D8zdfU04XlXB8L8ggtPIXfG7mq8\/Jj03cjoFrmkBzQQtUXhmrYsDOo0wB7WuJ7g0pf1KvphH3LkuNZmcjpvYxuQBayzysiaS40sj+pTSDaKHsBlVx6TUaqQEg16u5STXkuW\/wCmE\/WPkdtYKHotEGne1heRTj3W3S9NZEAas+pWrwc1SmWX0uOF33ed1OmLTlp5VLGucA0j2XqpdA2VlurlZT0oxyWcrE5G7huuHEAx92b9Ao6qj5rF+ncLqS6UQ6q3\/SMlc\/VNEmpcQ2y7iu61Mt3s7Y8mXHhcfhme01wqSLPqutHonStcH20geX7+6wOhcxxG3Pp6LrK8OktFnVBvAcCFt0DPC1bonCieLWSGJ7ZWvGKNrswFpfJ4\/wDqvADHOHv2Quvh7P4P0rZPiLR7i0Fm6Sq7gYX1IxsJvY3d61leI\/4e9Idp4dXrJSXB0hZGXDkDk\/8ARe5W54ePku8iKSaFXIu6aFyuu9f0XQtE6bUSef8ATGOXH0RdNXUOpaXpenM+qlbGwd3Gr+y+RfF\/xU74hlbAwBmljNj1J9Vy+u9f1fXdU6XUP8pPljvDQuQZGDFF3vdKW\/T08fF80PkjZneL9AFWdYC2tpI+6qfISThoHoAqyXH0H3Cw7f2Sc4SX5ar1VZFBuf8A1TsEZyljdVWfuqnwkC7klXBwFYNqcMTQ3c4FSe4VdKba0qkdYWcm\/wDorZHDsMKsuBIvsiIgX3SIzwT9lI01H5\/hVLvSN3Q7JccKRAOKNhRO4ClUT3AgeWkqF7go7gcFG7acDCCwHuQtmg18+h1DJ9PK9kgOC0\/\/AHhc8Eu7hWA0B7Ky6S6s0+yfDHxL48TZXOa6wPFY3lp9fsvbb2SRtcxwvkL87dK6nP07UiWF3GCDwfYr7H8NdVi1kETg\/fu5s5afRb8x5c8bjXq94TBBKQaTyR+yntAWWCATTpMKLpBOlKkUENI0ilOkqQRRSlQ7IpBEopSpHbhBGkJopEJFJoRSRXunwilUI8oTpCGiRSdIpAkqUqx6o\/dAklI8opQKkKVIooI0nSYCdVlNrpCkUpopDSNIpSr1RSGkaRSlVIrCGkaRSlynhNrpBFKSOybTSOeydJoRSpKlNIqJ2KkUmD6otU7FSKQmg5yKTpFLbJIpOk0EavlP7popQCEFHKBcEpp9rSpUGD2RSdIUCAu7RSfdFIEj7YTrCAgRQnSK9kBSKwaTpCBBCaECQmhAUj3TpFIEj7p0ikC5RSdZTpDSIFopSr0QgVdkqTTpAkUmhFJCaEAhCaISEIpFFo4TRSBUhNCgVJ0ghCoEYKKRSAwhACaBITQoEhNNUKsIpPuikCpCYRSgSE0FAfZFITpUJATrKKUCR7FNMD1QRrCadJ7U2aqCAFPajaU2vTUaRSntPontU2dNV0ilZtRtTZ01XSdKzaltTZ01CkUplpRt9k2aQpACntRtV2aqFIpT2lFKGkKTpSpFK7TSACdKVIUUgE6sVSOFIeqD4V8f9H\/pXxBPtbUMv91hHFHlcvp3w67qOjZOJwJJHlscYFkkBfXvj7oJ6x0N00Lb1Om87fUt7hfE4uoa7p29umnfEMnHY91yzls\/i9nBnjJ3jnyQuZqHRuFFrtv2pbrE0Bj4a0kLnu3GQvuy42SfVTLnC3MPIyFbLZp6+DlnFlbZ2sv\/AFXRPc13h3dGgrpNHLPIxrGlz3cNGSU9Ppm6lhLcvGSFs6dNLoNbHqE="} 01334{"flow_id":61,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6945,"source":"netflix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1484319119,"pkt_ts_usec":102211,"pkt_caplen":733,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":733,"pkt_l4_len":699,"pkt":"5JjWH70UgCqoTGHMCABFIALPblxAADwGh9m4GcwKwKgBBwBQ0APyPSFFJksT84AYA6upbgAAAQEICv\/9bDgfZfp3IFWjPMIowIVXy5JfcpHvebMeiKxVpzPgoYUIAwUKFMZHQyYgyGmrUyyLKEyyLGitUJGquRhizRXMqJdOmzodGi3D6nFqnzRuqs5lQn0mlv6czs6XU4xzPk9PfjHM62n1HLqXKmx794I1v4zwzSm\/mplKp\/bmv4M+jPJfhpx1afis+HWzxXqlmGeimv8AdfyPWdyOLzc526fF1\/4iQG5A3GWL9oLYpGwZHiL0gGTJBotQBANjSjFI2AZBIrzhjyZX1ZUI07I11ysnJRhFOUm+yXVn5c8VcZnxzxFruIyeVbY9i9ILlFfoke6\/Ebir4T4M1soT226jGnh\/q6\/wyfm+2eWzbxzJoUWSM02WWSKJMsFyR9MsGQZ9SaFVnqUyLbHyKX0yJUKwN4XQDFbEsWLkjfIDfISk7AQA9EBowAyTIjQj6kRAAEATIgPYgOxBgyCKEAvQyEQyEzrPY82SfuKR9WQTaIEBBlTZChV0CgI6YyYgew0nTHiytdBkUmr4y5FsJGdMsi+Y4it1czVXYc6DZorbKhOrVbjudCjUY7nErkzZVJ8ipSfS8P4jZpNVTqKpYsqmpxfunk\/R3C+JVcU4ZptbS04XVqax2fdfqflqqbz1PcPhTq7bvDN1U5ZjTqHGHsmk\/wCZHl53nSnyvQdwclOWHLObF6tyTJXkmWGDVmQZEyTIYRmxWwNi5HgM2DcLkA8AtkxgVdRmMPHvjXxP9twzhkXyjGWon9X8q\/kzxy2XU+7+LGosu8e66E5ZjVCuuC9FtT\/m2ef2M6J8kJVNlEnzHm2Ut8xUGyLJgyLJvJJpZySM7fIttb2ooYlSAxWFg7CXAfQVsjAgVBQG8hYvqI0IDsHogCdwZCugBBCEICsQASBCxEEAUMn\/2Q=="} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":230,"flow_first_seen":1484319036854,"flow_last_seen":1484319110632,"flow_tot_l4_data_len":202128,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":878,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"104.86.97.179","src_port":53141,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":1484319118629,"flow_last_seen":1484319118652,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":47,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":57093,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1484319042988,"flow_last_seen":1484319043002,"flow_tot_l4_data_len":164,"flow_min_l4_data_len":50,"flow_max_l4_data_len":114,"flow_avg_l4_data_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":59180,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":71,"flow_first_seen":1484319064669,"flow_last_seen":1484319117874,"flow_tot_l4_data_len":55747,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":785,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.191.17.51","src_port":53193,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":38,"flow_first_seen":1484319064671,"flow_last_seen":1484319065592,"flow_tot_l4_data_len":17226,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.191.17.51","src_port":53202,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":27,"flow_first_seen":1484319049465,"flow_last_seen":1484319081182,"flow_tot_l4_data_len":15587,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":577,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.89.39.139","src_port":53152,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":41,"flow_first_seen":1484319048780,"flow_last_seen":1484319080085,"flow_tot_l4_data_len":31776,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":775,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.201.191.132","src_port":53151,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":28,"flow_first_seen":1484319032984,"flow_last_seen":1484319063913,"flow_tot_l4_data_len":5698,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":203,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.32.196.36","src_port":53115,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":148,"flow_first_seen":1484319032986,"flow_last_seen":1484319080084,"flow_tot_l4_data_len":68910,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":465,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.32.196.36","src_port":53116,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":20,"flow_first_seen":1484319033206,"flow_last_seen":1484319063914,"flow_tot_l4_data_len":2325,"flow_min_l4_data_len":20,"flow_max_l4_data_len":955,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.32.196.36","src_port":53117,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1484319033886,"flow_last_seen":1484319113019,"flow_tot_l4_data_len":2104,"flow_min_l4_data_len":130,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"239.255.255.250","src_port":53776,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":63,"flow_first_seen":1484319043012,"flow_last_seen":1484319085476,"flow_tot_l4_data_len":44863,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":712,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.25","src_port":53148,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":126,"flow_first_seen":1484319043013,"flow_last_seen":1484319077933,"flow_tot_l4_data_len":124319,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":986,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.25","src_port":53149,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":21,"flow_first_seen":1484319043665,"flow_last_seen":1484319075730,"flow_tot_l4_data_len":12545,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":597,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.25","src_port":53150,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":637,"flow_first_seen":1484319049672,"flow_last_seen":1484319109285,"flow_tot_l4_data_len":724246,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1136,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.24","src_port":53153,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":31,"flow_first_seen":1484319114406,"flow_last_seen":1484319117555,"flow_tot_l4_data_len":9868,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":318,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.32.22.214","src_port":53238,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":22,"flow_first_seen":1484319117651,"flow_last_seen":1484319117994,"flow_tot_l4_data_len":9491,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":431,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.32.22.214","src_port":53248,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":41,"flow_first_seen":1484319118657,"flow_last_seen":1484319120726,"flow_tot_l4_data_len":33577,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":818,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.10","src_port":53251,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":41,"flow_first_seen":1484319118658,"flow_last_seen":1484319120053,"flow_tot_l4_data_len":40845,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":996,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"184.25.204.10","src_port":53252,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1484319032865,"flow_last_seen":1484319032884,"flow_tot_l4_data_len":670,"flow_min_l4_data_len":46,"flow_max_l4_data_len":337,"flow_avg_l4_data_len":167,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":51543,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1484319036827,"flow_last_seen":1484319036847,"flow_tot_l4_data_len":154,"flow_min_l4_data_len":51,"flow_max_l4_data_len":103,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":57719,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":40,"flow_first_seen":1484319035079,"flow_last_seen":1484319073564,"flow_tot_l4_data_len":12115,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":302,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.89.39.139","src_port":53132,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":69,"flow_first_seen":1484319035080,"flow_last_seen":1484319073578,"flow_tot_l4_data_len":41580,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":602,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.89.39.139","src_port":53133,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":25,"flow_first_seen":1484319035342,"flow_last_seen":1484319066108,"flow_tot_l4_data_len":7339,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":293,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.89.39.139","src_port":53134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":4,"flow_first_seen":1484319114365,"flow_last_seen":1484319114400,"flow_tot_l4_data_len":670,"flow_min_l4_data_len":46,"flow_max_l4_data_len":337,"flow_avg_l4_data_len":167,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":51622,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":48,"flow_first_seen":1484319117605,"flow_last_seen":1484319119338,"flow_tot_l4_data_len":28029,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":583,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.41.30.5","src_port":53239,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":52,"flow_first_seen":1484319117826,"flow_last_seen":1484319118687,"flow_tot_l4_data_len":24118,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":463,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.41.30.5","src_port":53249,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":17,"flow_first_seen":1484319117827,"flow_last_seen":1484319118041,"flow_tot_l4_data_len":4736,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1416,"flow_avg_l4_data_len":278,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.41.30.5","src_port":53250,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1484319049641,"flow_last_seen":1484319049665,"flow_tot_l4_data_len":124,"flow_min_l4_data_len":46,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":51728,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1484319035004,"flow_last_seen":1484319035024,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":63,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":51949,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1484319048757,"flow_last_seen":1484319048776,"flow_tot_l4_data_len":203,"flow_min_l4_data_len":45,"flow_max_l4_data_len":158,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":58102,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":2,"flow_first_seen":1484319117511,"flow_last_seen":1484319117538,"flow_tot_l4_data_len":254,"flow_min_l4_data_len":63,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":127,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":52095,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1484319032882,"flow_last_seen":1484319032884,"flow_tot_l4_data_len":252,"flow_min_l4_data_len":62,"flow_max_l4_data_len":190,"flow_avg_l4_data_len":126,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":52116,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1484319049645,"flow_last_seen":1484319049681,"flow_tot_l4_data_len":383,"flow_min_l4_data_len":46,"flow_max_l4_data_len":337,"flow_avg_l4_data_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":52347,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":53,"flow_first_seen":1484319050652,"flow_last_seen":1484319052229,"flow_tot_l4_data_len":43203,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":815,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.145","src_port":53163,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":58,"flow_first_seen":1484319052216,"flow_last_seen":1484319054100,"flow_tot_l4_data_len":45204,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":779,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.10.139","src_port":53164,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":55,"flow_first_seen":1484319054101,"flow_last_seen":1484319056189,"flow_tot_l4_data_len":45137,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":820,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.3.140","src_port":53171,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":50,"flow_first_seen":1484319056204,"flow_last_seen":1484319063297,"flow_tot_l4_data_len":23332,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":466,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.133","src_port":53172,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":49,"flow_first_seen":1484319056210,"flow_last_seen":1484319062135,"flow_tot_l4_data_len":30439,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":621,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.133","src_port":53173,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":54,"flow_first_seen":1484319056214,"flow_last_seen":1484319063597,"flow_tot_l4_data_len":23512,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":435,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53174,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":53,"flow_first_seen":1484319056221,"flow_last_seen":1484319063369,"flow_tot_l4_data_len":28811,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":543,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53175,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":57,"flow_first_seen":1484319056232,"flow_last_seen":1484319064277,"flow_tot_l4_data_len":26547,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":465,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53176,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":55,"flow_first_seen":1484319056233,"flow_last_seen":1484319063283,"flow_tot_l4_data_len":27363,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":497,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53177,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":52,"flow_first_seen":1484319056233,"flow_last_seen":1484319063789,"flow_tot_l4_data_len":26295,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":505,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53178,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":60,"flow_first_seen":1484319056234,"flow_last_seen":1484319063566,"flow_tot_l4_data_len":38100,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":635,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53179,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":55,"flow_first_seen":1484319056241,"flow_last_seen":1484319062003,"flow_tot_l4_data_len":26450,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":480,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53180,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":54,"flow_first_seen":1484319056264,"flow_last_seen":1484319064524,"flow_tot_l4_data_len":23416,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":433,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53181,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":58,"flow_first_seen":1484319056264,"flow_last_seen":1484319063421,"flow_tot_l4_data_len":30824,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":531,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53182,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1307,"flow_first_seen":1484319064590,"flow_last_seen":1484319117695,"flow_tot_l4_data_len":1198312,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":916,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.3.140","src_port":53183,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":178,"flow_first_seen":1484319064593,"flow_last_seen":1484319070693,"flow_tot_l4_data_len":151306,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":850,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53184,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":788,"flow_first_seen":1484319070636,"flow_last_seen":1484319117609,"flow_tot_l4_data_len":732491,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":929,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.133","src_port":53210,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1872,"flow_first_seen":1484319091296,"flow_last_seen":1484319117694,"flow_tot_l4_data_len":1794659,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":958,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"23.246.11.141","src_port":53217,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":37,"flow_first_seen":1484319032888,"flow_last_seen":1484319063911,"flow_tot_l4_data_len":8015,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":216,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.69.204.241","src_port":53105,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":34,"flow_first_seen":1484319033631,"flow_last_seen":1484319064012,"flow_tot_l4_data_len":11560,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":340,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.69.204.241","src_port":53118,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":36,"flow_first_seen":1484319033943,"flow_last_seen":1484319064790,"flow_tot_l4_data_len":11638,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":323,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"54.69.204.241","src_port":53119,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":45,"flow_first_seen":1484319064711,"flow_last_seen":1484319096924,"flow_tot_l4_data_len":26410,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":586,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"52.37.36.252","src_port":53203,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":2,"flow_first_seen":1484319064683,"flow_last_seen":1484319064699,"flow_tot_l4_data_len":263,"flow_min_l4_data_len":49,"flow_max_l4_data_len":214,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"192.168.1.1","src_port":60962,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6999,"source":"netflix.pcap","alias":"nDPId-test"} diff --git a/test/results/netflow-fritz.pcap.out b/test/results/netflow-fritz.pcap.out index 149c2901a..26727088f 100644 --- a/test/results/netflow-fritz.pcap.out +++ b/test/results/netflow-fritz.pcap.out @@ -1,3 +1,6 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"netflow-fritz.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"netflow-fritz.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1498072707863,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.1.1","src_port":23384,"dst_port":2055,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00647{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"netflow-fritz.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1498072707,"pkt_ts_usec":863157,"pkt_caplen":222,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":222,"pkt_l4_len":188,"pkt":"AAwRERERAAwRIiIiCABFKADQAABAAD8R1PvAqAABwKgBAVtYCAcAvAAAAAoAtFlKxZ0CWWXEAAQBAAACAHABzQAWAAEABIDPAAQAAGjygMz\/\/wAAaPKAzf\/\/AABo8gAHAAIACwACAAYAAgCxAAEAsAABALQAAgC1AAIAAgAEAM0AAgC5AAQAuAAEAAgABAAMAAQANgAEAFgAAgAEAAEAwAABgAH\/\/wAAaPIAAwA0AdIABwABAI8ABAApAAgAKgAIACgACAEwAAIBMQAEATIABAHTAAIAAQCOAAQAUv\/\/"} 00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"netflow-fritz.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1498072707863,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.1.1","src_port":23384,"dst_port":2055,"l4_proto":"udp","ndpi": {"proto":"NetFlow","breed":"Acceptable","category":"Network"}} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"netflow-fritz.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1498072707863,"flow_last_seen":0,"flow_tot_l4_data_len":188,"flow_min_l4_data_len":188,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":188,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.1.1","src_port":23384,"dst_port":2055,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"netflow-fritz.pcap","alias":"nDPId-test"} diff --git a/test/results/netflowv9.pcap.out b/test/results/netflowv9.pcap.out index 15d5c36d8..b89927d01 100644 --- a/test/results/netflowv9.pcap.out +++ b/test/results/netflowv9.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"netflowv9.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"netflowv9.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1568213026961,"flow_last_seen":0,"flow_tot_l4_data_len":1384,"flow_min_l4_data_len":1384,"flow_max_l4_data_len":1384,"flow_avg_l4_data_len":1384,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.134","dst_ip":"192.168.2.222","src_port":48629,"dst_port":2057,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02256{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"netflowv9.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568213026,"pkt_ts_usec":961189,"pkt_caplen":1418,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1418,"pkt_l4_len":1384,"pkt":"ACWQ1Mz5rB9rrWosCABFAAV8LBZAAEARgqbAqAKGwKgC3r31CAkFaHVWAAkAECROCO5dZ6gMFm+miAAAAAEBAwQkAAoEJE1qKCRNaigAAAAAAAAAKAAAAAAAAAABBo0ou7J9QF7TxAskWgIAkwAAlYsAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJEzp1CRNjMsAAAAAAAUbtAAAAAAAAASjBhdDjcSK9gL7ko0BuxoAkwAAMhAAAFHMhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJEzp3CRNjKAAAAAAAB2wnwAAAAAAAAZqBor2AvsXQ43EAbuSjRoAkwAAUcwAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1ybSRNcm0AAAAAAAAAKAAAAAAAAAABBoOfghRcdiVS2B5evAIAkwAAixYAAzG32GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1rLyRNay8AAAAAAAAAKAAAAAAAAAABBor09llcdiVKtb1pkQIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2QhyRNkIcAAAAAAAAAKAAAAAAAAAABBor0qxxcdiVS2B5S8QIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2JWyRNiVsAAAAAAAAAKAAAAAAAAAABBoOfWVu53tNywXcEGgIAkwADMXgAAzG32GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1qjSRNao0AAAAAAAAALAAAAAAAAAABBor2xOMr4aaiqY0AFgIAkwAAseAAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE2OYCRNjmAAAAAAAAAAKAAAAAAAAAABBo1UlODIXai05wABvQIAkwAAS+UAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE11kyRNdisAAAAAAAACRwAAAAAAAAAKBoG7\/klQ1h8GKsoBuxsAkwAAFSIAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE11kyRNdisAAAAAAAAWPwAAAAAAAAAIBlDWHwaBu\/5JAbsqyh4AkwAAMhAAABUihHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2HTSRNh00AAAAAAAAAKAAAAAAAAAABBor1FpC5r10bvgPWnAIAkwAAiv4AADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2Q4yRNkOMAAAAAAAAAKAAAAAAAAAABBoOfV4ZcdiVS2B5ZXgIAkwAAixYAAzG32GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEAQIAVAAKBCRNhcskTYXLAAAAAAAAAHoAAAAAAAAAARHN+8cOjVQJ2YZdADUAkwAAMhAAAEB9hHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAQcA1AAKBiRNJ\/YkTYzBAAAAAAAAELEAAAAAAAAADwYgARa4LRoyANRG8rtzEZ1EIAFMoAAAAQMAAAAAgbv\/\/PfhAbvbAGwAACKxAAAyENhn2RiP2oR4rBWdQgAAAAAAAAAAAAAAAAAAAAAAAAoGJE0n9iRNjMEAAAAAAAAIZQAAAAAAAAAMBiABTKAAAAEDAAAAAIG7\/\/wgARa4LRoyANRG8rtzEZ1EAbv34RsAbAAAMhAAACKxhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAA="} 00519{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"netflowv9.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1568213026961,"flow_last_seen":0,"flow_tot_l4_data_len":1384,"flow_min_l4_data_len":1384,"flow_max_l4_data_len":1384,"flow_avg_l4_data_len":1384,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.134","dst_ip":"192.168.2.222","src_port":48629,"dst_port":2057,"l4_proto":"udp","ndpi": {"proto":"NetFlow","breed":"Acceptable","category":"Network"}} @@ -10,3 +11,5 @@ 02179{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"netflowv9.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568213026,"pkt_ts_usec":961900,"pkt_caplen":1362,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1362,"pkt_l4_len":1328,"pkt":"ACWQ1Mz5rB9rrWosCABFAAVELB1AAEARgtfAqAKGwKgC3r31CAkFMPm\/AAkAECROCO5dZ6gMFm+mjwAAAAEBAwUUAAoEJE2QqyRNkKsAAAAAAAAAKAAAAAAAAAABBoG7XKJcdiVS2B5atgIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1tKCRNbSgAAAAAAAAAKAAAAAAAAAABBor2ZebBHQ88f\/8RXAIAkwAAAAAAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2PaiRNj2oAAAAAAAAAKAAAAAAAAAABBor1AQE0bQwWAbvoNBQAkwAAH4sAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2MByRNjAcAAAAAAAAAKAAAAAAAAAABBor0fre5sBtatrgNPgIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2HpCRNh6QAAAAAAAAAKAAAAAAAAAABBoOf7oKnchtzx+MBvQIAkwAAP5QAAzG32GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2OFiRNjhYAAAAAAAAAKAAAAAAAAAABBoG7RUy5sBv6wucQ0QIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1t7yRNbe8AAAAAAAAALAAAAAAAAAABBor0kdXfxf7Zyq8AFwIAkwAAEpgAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE1\/WyRNf1sAAAAAAAAAKAAAAAAAAAABBor08Jm4aYtEli4VswIAkwAAGxsAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2HASRNhwEAAAAAAAAAKAAAAAAAAAABBo0oygkfuNHO6mAnDwIAkwAAAAAAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE1sBSRNbDoAAAAAAAAC7wAAAAAAAAAGBryk7iSBu\/5VrbQAUBsAkwAAMhAAAwYBhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1sFiRNbDoAAAAAAAAD7wAAAAAAAAADBoG7\/lW8pO4kAFCttBsAkwADBgEAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE15riRNea4AAAAAAAAAKAAAAAAAAAABBor022hzlYpsEe0AFwIAkwAAECYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE181yRNfNcAAAAAAAAAKAAAAAAAAAABBo1UJo17vucYdW4AFwIAkwAAEuUAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2B1iRNgdYAAAAAAAAAKAAAAAAAAAABBoG7SSgr4Wwfpe8BvQIAkwACBGYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE1qdiRNa+wAAAAAAAAChwAAAAAAAAACBor2Et2DvCi9yWgjKBgAkwAAAqgAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1qdiRNa+cAAAAAAAAChwAAAAAAAAACBoO8KL2K9hLdIyjJaBgAkwAAMhAAAAKohHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAA"} 02215{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"netflowv9.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568213026,"pkt_ts_usec":962005,"pkt_caplen":1390,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1390,"pkt_l4_len":1356,"pkt":"ACWQ1Mz5rB9rrWosCABFAAVgLB5AAEARgrrAqAKGwKgC3r31CAkFTKWaAAkAECROCO5dZ6gMFm+mkAAAAAEBAwTEAAoEJE2B\/iRNgf4AAAAAAAAAKAAAAAAAAAABBo1U6kBcd6AhqNceJAIAkwAAwWEAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE2L+SRNi\/kAAAAAAAAAKAAAAAAAAAABBo0ojNxcdiVKtb2zcAIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2ScCRNknAAAAAAAAAAKAAAAAAAAAABBor0RW65sBu2oskjoAIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2ArSRNgK0AAAAAAAAAKAAAAAAAAAABBor0Q2hSwtKCbeaRXwIAkwAAwS8AADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2HRyRNh0cAAAAAAAAAKAAAAAAAAAABBo0o87S5sBu2oskYwAIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE104yRNdOMAAAAAAAAAKAAAAAAAAAABBor2wB25sBu2oskgaQIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE19TiRNfU4AAAAAAAAAKAAAAAAAAAABBoG7gQm5sBu2oskNYgIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2HJCRNhyQAAAAAAAAAKAAAAAAAAAABBo1UlCZcdiVS2B5RDAIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1s0SRNgMkAAAAAAAAGpgAAAAAAAAAMBo1U+KKNYlEqXToNPdoAkwAA3tMAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE1s0iRNgMoAAAAAAAAHsQAAAAAAAAAIBo1iUSqNVPiiDT1dOh4AkwAAMhAAAN7ThHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE0TaSRNkqcAAAAAAAB3nwAAAAAAAAApBmgQnPOBu0rBqxABuxoAkwAAMhAAADQXhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE0TciRNkqYAAAAAAAAUrAAAAAAAAAAXBoG7SsFoEJzzAburEBoAkwAANBcAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2ELCRNhCwAAAAAAAAAKAAAAAAAAAABBo0ozbtcdiVKtb0yhgIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2EKiRNhCoAAAAAAAAAKQAAAAAAAAABBpdlcPaK9gJp9WIBuxAAkwAAMhAAANNhhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2EMyRNhDMAAAAAAAAANAAAAAAAAAABBor2AmmXZXD2Abv1YhAAkwAA02EAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAEGAGwACgYkTWgTJE2FWQAAAAAAAAIEAAAAAAAAAAIRKgIJCAQWSACFWHuzCSH+HiABTKAAAAEIAAAAAAAAABbKpgGFAGwAABquAAAyENhn2RiP2oR4rBWdQgAAAAAAAAAAAAAAAAAAAAAAAA=="} 02251{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"netflowv9.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568213026,"pkt_ts_usec":962107,"pkt_caplen":1414,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1414,"pkt_l4_len":1380,"pkt":"ACWQ1Mz5rB9rrWosCABFAAV4LB9AAEARgqHAqAKGwKgC3r31CAkFZN5EAAkAECROCO5dZ6gMFm+mkQAAAAEBAwR0AAoEJE2RsyRNkbMAAAAAAAAAKAAAAAAAAAABBor2nvZcdiVS2B5mSgIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2CECRNghAAAAAAAAAAKAAAAAAAAAABBor2OXclMedoxbwTrgIAkwADMZMAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE0kxiRNhT0AAAAAAAAAeAAAAAAAAAADBo0oJv55orZfIKsAFwIAkwAAEp4AADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE15tyRNebcAAAAAAAAAKAAAAAAAAAABBor2DuK5sBu2oskHfwIAkwADHowAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2PliRNj5YAAAAAAAAAKAAAAAAAAAABBoOfFgrZPRSt14MAFgIAkwADDMsAAzG32GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE1q9CRNavQAAAAAAAAAKAAAAAAAAAABBoOfvGdcdiVS2B5piAIAkwAAixYAAzG32GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE158iRNefIAAAAAAAAAKAAAAAAAAAABBo1UAydcd6AhqNceJQIAkwAAwWEAADIQ2GfZGI\/ahHisFZ1CAAAAAAAgAAAAAAAAAAAAAAAAAAoEJE1\/6SRNf+kAAAAAAAAAKAAAAAAAAAABBo0o31BQUkB\/4JoGfwIAkwADFrkAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2B1CRNgm8AAAAAAAAEPQAAAAAAAAAHBlCeFGiK9gJ+voIBuxoAkwAAMhAAAIUmhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2B4yRNgksAAAAAAAAS1AAAAAAAAAAHBor2An5QnhRoAbu+ghoAkwAAhSYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE2OwyRNjsMAAAAAAAAAKAAAAAAAAAABBo1UqqB9QF7Tg04kWgIAkwAAlYsAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE0FlCRNfq0AAAAAAAANngAAAAAAAAAWBg1riAmK9gJw5gwBuxsAkwAAMhAAAB+EhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE0FqSRNfqkAAAAAAAA3dAAAAAAAAAAWBor2AnANa4gJAbvmDBsAkwAAH4QAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoEJE149yRNePcAAAAAAAAAKAAAAAAAAAABBor01gdcdiVS2B5s7wIAkwAAixYAADIQ2GfZGI\/ahHisFZ1CAAAAAAAAAAAAAAAAAAAAAAAAAAoBBwDUAAoGJE13nyRNd94AAAAAAAAEDwAAAAAAAAAGBiABTKAAAPI\/qZ7QTVkjzpUqABRQQAwMBwAAAAAAAAC8rw4UbBsAbAAAMhAAADtBhHisFZ1C2GfZGI\/aAAAAAAAAAAAAAAAAAAAAAAAACgYkTXevJE138gAAAAAAAAIDAAAAAAAAAAUGKgAUUEAMDAcAAAAAAAAAvCABTKAAAPI\/qZ7QTVkjzpUUbK8OGgBsAAA7QQAAMhDYZ9kYj9qEeKwVnUIAAAAAAAAAAAAAAAAAAAAAAA=="} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":10,"source":"netflowv9.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1568213026961,"flow_last_seen":1568213026962,"flow_tot_l4_data_len":13548,"flow_min_l4_data_len":1328,"flow_max_l4_data_len":1384,"flow_avg_l4_data_len":1354,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.134","dst_ip":"192.168.2.222","src_port":48629,"dst_port":2057,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":10,"source":"netflowv9.pcap","alias":"nDPId-test"} diff --git a/test/results/nintendo.pcap.out b/test/results/nintendo.pcap.out index ea7be1845..f72c138f8 100644 --- a/test/results/nintendo.pcap.out +++ b/test/results/nintendo.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"nintendo.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1500731320644,"flow_last_seen":0,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":68,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"91.8.243.35","src_port":52119,"dst_port":49432,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00474{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"nintendo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1500731320,"pkt_ts_usec":644357,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"pkt":"AA6OGXEMfLuKifuECABFAABYEUEAAEARTg7AqAxyWwjzI8uXwRgARM2+MquYZAJWA8uWATPgxkj4NJP7aMnpzfBBRQUJGYsmvR+Tfti6\/9NW0mVVtdYfmAlO0lOZx8+qpE3Q9Qrr"} 00501{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1500731320644,"flow_last_seen":0,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":68,"flow_max_l4_data_len":68,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"91.8.243.35","src_port":52119,"dst_port":49432,"l4_proto":"udp","ndpi": {"proto":"Nintendo","breed":"Fun","category":"Game"}} @@ -242,3 +243,30 @@ 00502{"flow_id":20,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":280,"source":"nintendo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1500731343,"pkt_ts_usec":915131,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"AA6OGXEMfLuKifuECABFAABoEdMAAEARq9DAqAxyUT2eitpryjkAVAuZMquYZAIAAADw67bGKdUJvCWWmpPUMVRbVSL\/ms6fyAPfdbX8V8Af6wGuIohN10vP0qGmIALU3oiGmRStZydUMdiUu614eU0zknGtnw=="} 00504{"flow_id":20,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"nintendo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1500731343,"pkt_ts_usec":976502,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"AA6OGXEMfLuKifuECABFAABoEdcAAEARq8zAqAxyUT2eitpryjkAVJ\/GMquYZAIAAADxKbcEiVxWTHQXYLkMmEhv3TFhCu1eRL0sUh1f7FBB1\/G+YP0VNDfxB721Ce35pyWVGkhESdXdbwDAoVBGzMqD\/f7vOg=="} 00503{"flow_id":20,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":291,"source":"nintendo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1500731343,"pkt_ts_usec":976639,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"AA6OGXEMfLuKifuECABFAABoEdgAAEARq8vAqAxyUT2eitpryjkAVNzKMquYZAIAAADxKbcEiVxWTHQXYLkMmEhv3TFhCu1eRL0sUh1f7FBB1\/G+YP3LwBCwXe5s\/c9OgLdxBm6BM5UFqxh65snYF+XPEFQpmw=="} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":10,"flow_first_seen":1500731340831,"flow_last_seen":1500731340889,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":10025,"l4_proto":"udp","ndpi": {"proto":"Amazon","breed":"Acceptable","category":"Web"}} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":10,"flow_first_seen":1500731340831,"flow_last_seen":1500731340889,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":10025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1500731341194,"flow_last_seen":1500731341194,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":76,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":161,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"192.168.12.1","src_port":51035,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":8,"flow_first_seen":1500731340951,"flow_last_seen":1500731340966,"flow_tot_l4_data_len":496,"flow_min_l4_data_len":58,"flow_max_l4_data_len":74,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"192.168.12.1","src_port":10184,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1500731329336,"flow_last_seen":1500731329520,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"54.146.242.74","src_port":11534,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1500731329336,"flow_last_seen":1500731329520,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"54.146.242.74","src_port":11534,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":54,"flow_first_seen":1500731322454,"flow_last_seen":1500731343995,"flow_tot_l4_data_len":6651,"flow_min_l4_data_len":32,"flow_max_l4_data_len":949,"flow_avg_l4_data_len":123,"midstream":1,"l3_proto":"ip4","src_ip":"54.187.10.185","dst_ip":"192.168.12.114","src_port":443,"dst_port":48328,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":54,"flow_first_seen":1500731322454,"flow_last_seen":1500731343995,"flow_tot_l4_data_len":6651,"flow_min_l4_data_len":32,"flow_max_l4_data_len":949,"flow_avg_l4_data_len":123,"midstream":1,"l3_proto":"ip4","src_ip":"54.187.10.185","dst_ip":"192.168.12.114","src_port":443,"dst_port":48328,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":160,"flow_first_seen":1500731343266,"flow_last_seen":1500731348756,"flow_tot_l4_data_len":46304,"flow_min_l4_data_len":68,"flow_max_l4_data_len":852,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"81.61.158.138","src_port":55915,"dst_port":51769,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1500731326599,"flow_last_seen":1500731326628,"flow_tot_l4_data_len":323,"flow_min_l4_data_len":76,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":161,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"192.168.12.1","src_port":18874,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1500731340826,"flow_last_seen":1500731340827,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":33334,"l4_proto":"udp","ndpi": {"proto":"Amazon","breed":"Acceptable","category":"Web"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":5,"flow_first_seen":1500731340826,"flow_last_seen":1500731340827,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":24,"flow_max_l4_data_len":24,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":33334,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":3,"flow_first_seen":1500731340941,"flow_last_seen":1500731340946,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":33335,"l4_proto":"udp","ndpi": {"proto":"Amazon","breed":"Acceptable","category":"Web"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":3,"flow_first_seen":1500731340941,"flow_last_seen":1500731340946,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":55915,"dst_port":33335,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1500731340981,"flow_last_seen":0,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":264,"flow_max_l4_data_len":264,"flow_avg_l4_data_len":264,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"52.10.205.177","src_port":55915,"dst_port":34343,"l4_proto":"udp","ndpi": {"proto":"Amazon","breed":"Acceptable","category":"Web"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1500731340981,"flow_last_seen":0,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":264,"flow_max_l4_data_len":264,"flow_avg_l4_data_len":264,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"52.10.205.177","src_port":55915,"dst_port":34343,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":157,"flow_first_seen":1500731343061,"flow_last_seen":1500731348745,"flow_tot_l4_data_len":48020,"flow_min_l4_data_len":68,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":305,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"93.237.131.235","src_port":55915,"dst_port":56066,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_first_seen":1500731323269,"flow_last_seen":1500731323270,"flow_tot_l4_data_len":252,"flow_min_l4_data_len":84,"flow_max_l4_data_len":84,"flow_avg_l4_data_len":84,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"35.158.74.61","src_port":52119,"dst_port":33335,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":21,"flow_first_seen":1500731326644,"flow_last_seen":1500731327201,"flow_tot_l4_data_len":7049,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1380,"flow_avg_l4_data_len":335,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"54.192.27.217","src_port":41517,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":20,"flow_first_seen":1500731341201,"flow_last_seen":1500731341710,"flow_tot_l4_data_len":7019,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1380,"flow_avg_l4_data_len":350,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"54.192.27.8","src_port":31329,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":447,"flow_first_seen":1500731342849,"flow_last_seen":1500731348749,"flow_tot_l4_data_len":172476,"flow_min_l4_data_len":68,"flow_max_l4_data_len":852,"flow_avg_l4_data_len":385,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"185.118.169.65","src_port":55915,"dst_port":27520,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":39,"flow_first_seen":1500731320644,"flow_last_seen":1500731325506,"flow_tot_l4_data_len":4764,"flow_min_l4_data_len":68,"flow_max_l4_data_len":820,"flow_avg_l4_data_len":122,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"91.8.243.35","src_port":52119,"dst_port":49432,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":16,"flow_first_seen":1500731320774,"flow_last_seen":1500731322059,"flow_tot_l4_data_len":1504,"flow_min_l4_data_len":68,"flow_max_l4_data_len":164,"flow_avg_l4_data_len":94,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"109.21.255.11","src_port":52119,"dst_port":50251,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":15,"flow_first_seen":1500731320764,"flow_last_seen":1500731321914,"flow_tot_l4_data_len":1452,"flow_min_l4_data_len":68,"flow_max_l4_data_len":164,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.114","dst_ip":"134.3.248.25","src_port":52119,"dst_port":56955,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00461{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":9,"flow_first_seen":1500731343274,"flow_last_seen":1500731343874,"flow_tot_l4_data_len":324,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"151.6.184.98","dst_ip":"192.168.12.114","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":21,"flow_first_seen":1500731342860,"flow_last_seen":1500731343591,"flow_tot_l4_data_len":756,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"151.6.184.100","dst_ip":"192.168.12.114","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1000,"source":"nintendo.pcap","alias":"nDPId-test"} diff --git a/test/results/no_sni.pcap.out b/test/results/no_sni.pcap.out index 457bb62d1..ac7ad10a0 100644 --- a/test/results/no_sni.pcap.out +++ b/test/results/no_sni.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"no_sni.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1604822444474,"flow_last_seen":0,"flow_tot_l4_data_len":59,"flow_min_l4_data_len":59,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":59,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.16.249.249","src_port":51331,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00459{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"no_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1604822444,"pkt_ts_usec":474923,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"EBMxuRBeeDHBvV4kCABFAABPAABAAEAGFoDAqAF3aBD5+ciDAbvkc0fPNh\/971AYEABWfwAAFwMDACKpSo7n5l1NtXHPvYJ17DEID+iXo6vcSBPbb4QBvLt6N\/RR"} 00440{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"no_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1604822444,"pkt_ts_usec":475424,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMxuRBeeDHBvV4kCABFAABAAABAAEAGFo\/AqAF3aBD5+ciDAbvkc0f2Nh\/971AYEAB\/fAAAFwMDABPsQXLhLYpNcnxO3uEm2chWzCNj"} @@ -132,3 +133,13 @@ 00411{"flow_id":7,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1009,"source":"no_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1604822447,"pkt_ts_usec":734379,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMxuRBeeDHBvV4kCABFAAAoAABAAEAGx\/DAqAF3aBZIqsm2AbtLPo7b62h22VAQD\/glLwAA"} 00442{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1010,"source":"no_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1604822447,"pkt_ts_usec":735095,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMxuRBeeDHBvV4kCABFAABAAABAAEAGx9jAqAF3aBZIqsm2AbtLPo7b62h22VAYEAAZDAAAFwMDABNCZtDGQgvXBCNH\/tUJ7EBq2y2E"} 00410{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1011,"source":"no_sni.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1604822447,"pkt_ts_usec":735154,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMxuRBeeDHBvV4kCABFAAAoAABAAEAGx\/DAqAF3aBZIqsm2AbtLPo7z62h22VAREAAlDgAA"} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":35,"flow_first_seen":1604822447287,"flow_last_seen":1604822447869,"flow_tot_l4_data_len":8114,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":231,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.22.72.170","src_port":51637,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":22,"flow_first_seen":1604822447287,"flow_last_seen":1604822447844,"flow_tot_l4_data_len":4796,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":218,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.22.72.170","src_port":51638,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":22,"flow_first_seen":1604822447287,"flow_last_seen":1604822447839,"flow_tot_l4_data_len":4796,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":218,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.22.72.170","src_port":51639,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1604822444474,"flow_last_seen":1604822444595,"flow_tot_l4_data_len":203,"flow_min_l4_data_len":20,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":29,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.16.249.249","src_port":51331,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"}} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1604822444474,"flow_last_seen":1604822444595,"flow_tot_l4_data_len":203,"flow_min_l4_data_len":20,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":29,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.16.249.249","src_port":51331,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":268,"flow_first_seen":1604822444486,"flow_last_seen":1604822448523,"flow_tot_l4_data_len":22542,"flow_min_l4_data_len":20,"flow_max_l4_data_len":702,"flow_avg_l4_data_len":84,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.16.249.249","src_port":51606,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":785,"flow_first_seen":1604822444913,"flow_last_seen":1604822448604,"flow_tot_l4_data_len":502495,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":640,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.16.124.96","src_port":51612,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":23,"flow_first_seen":1604822447227,"flow_last_seen":1604822447785,"flow_tot_l4_data_len":5192,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":225,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.17.198.37","src_port":51635,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":23,"flow_first_seen":1604822447249,"flow_last_seen":1604822447807,"flow_tot_l4_data_len":5192,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":225,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.119","dst_ip":"104.17.198.37","src_port":51636,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1185,"source":"no_sni.pcap","alias":"nDPId-test"} diff --git a/test/results/ocs.pcap.out b/test/results/ocs.pcap.out index 1295b30a7..6eb4c01bb 100644 --- a/test/results/ocs.pcap.out +++ b/test/results/ocs.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ocs.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00368{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"ocs.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1449652784,"pkt_ts_usec":341686,"pkt_caplen":60,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"RQAAPKbzQABABiV4wKi0AkDpuLy6UxRsAv3YCQAAAACgAjkIdPYAAAIEBbQEAggKADWBtgAAAAABAwMG"} 00155{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"ocs.pcap","alias":"nDPId-test","datalink":12} 00371{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"ocs.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1449652786,"pkt_ts_usec":71163,"pkt_caplen":63,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":63,"pkt_l4_len":0,"pkt":"RQAAP4JiQABAETORwKi0AggICAiWSAA1ACtxaqbPAQAAAQAAAAAAAAVvY3UwMwhsYWJnZW5jeQJ3cwAAAQAB"} @@ -1890,3 +1891,4 @@ 00157{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":945,"source":"ocs.pcap","alias":"nDPId-test","datalink":12} 00378{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":946,"source":"ocs.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1449652846,"pkt_ts_usec":380718,"pkt_caplen":64,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":64,"pkt_l4_len":0,"pkt":"RQAAQD9rQABABgLXwKi0ArL40NKmXgBQrzComDk0Q6ywEAgki50AAAEBCAoANZnyGkFqZAEBBQo5NE6EOTRZXA=="} 00157{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":946,"source":"ocs.pcap","alias":"nDPId-test","datalink":12} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":946,"source":"ocs.pcap","alias":"nDPId-test"} diff --git a/test/results/ookla.pcap.out b/test/results/ookla.pcap.out index f7b396340..d0f2723bb 100644 --- a/test/results/ookla.pcap.out +++ b/test/results/ookla.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ookla.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ookla.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1491069108756,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"46.44.253.187","src_port":51207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ookla.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491069108,"pkt_ts_usec":756336,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"gCqojWksxCwDBkn+CABFAABAClpAAEAGAADAqAEHLiz9u8gHAFAHQx4AAAAAALAC\/\/\/tyQAAAgQFtAEDAwUBAQgKDd4HoAAAAAAEAgAA"} 00433{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ookla.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491069108,"pkt_ts_usec":793565,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xCwDBkn+gCqojWksCABFAAA8AABAADMGWiUuLP27wKgBBwBQyAdRUNK1B0MeAaASOJAJ5wAAAgQFrAQCCAp\/4XDqDd4HoAEDAwU="} @@ -32,3 +33,6 @@ 00423{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"ookla.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491069115,"pkt_ts_usec":342981,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"gCqojWksxCwDBkn+CABFAAA05IBAAEAGAADAqAEHLiz9u8gPH5CtI6z0KpHVcYAQECntvQAAAQEICg3eIN5\/4XdP"} 00451{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"ookla.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491069115,"pkt_ts_usec":440646,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"gCqojWksxCwDBkn+CABFAABHO+BAAEAGAADAqAEHLiz9u8gPH5CtI6z0KpHVcYAYECnt0AAAAQEICg3eIT5\/4XdPUElORyAxNDkxMDY5MTE1NDQwCg=="} 00451{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"ookla.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491069115,"pkt_ts_usec":476067,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"xCwDBkn+gCqojWksCABFAABHohNAADMGuAYuLP27wKgBBx+QyA8qkdVxrSOtB4AYAcUjAwAAAQEICn\/hd3EN3iE+UE9ORyAxNDkxMDY5MDc1MjIyCg=="} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5086,"source":"ookla.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5066,"flow_first_seen":1491069115107,"flow_last_seen":1491069155251,"flow_tot_l4_data_len":4513181,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":890,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"46.44.253.187","src_port":51215,"dst_port":8080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":5086,"source":"ookla.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1491069108756,"flow_last_seen":1491069114084,"flow_tot_l4_data_len":3640,"flow_min_l4_data_len":32,"flow_max_l4_data_len":489,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"46.44.253.187","src_port":51207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5086,"source":"ookla.pcap","alias":"nDPId-test"} diff --git a/test/results/openvpn.pcap.out b/test/results/openvpn.pcap.out index e19b27c73..676ccabe6 100644 --- a/test/results/openvpn.pcap.out +++ b/test/results/openvpn.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"openvpn.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"openvpn.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1467904946700,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"46.101.231.218","src_port":60140,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"openvpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467904946,"pkt_ts_usec":700231,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"hCYVLjtSAA6OGXEMCABFAAA8ANVAAEAGYbLAqAFNLmXn2ursAbu+lXueAAAAAKACchBbjAAAAgQFtAQCCAoADXtLAAAAAAEDAwE="} 00434{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"openvpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467904946,"pkt_ts_usec":755145,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AA6OGXEMhCYVLjtSCABFoAA8AABAADQGbecuZefawKgBTQG76uxsxVWWvpV7n6AScSBx2QAAAgQFtAQCCAoANCgCAA17SwEDAwE="} @@ -51,3 +52,5 @@ 00593{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"openvpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472334892,"pkt_ts_usec":690212,"pkt_caplen":184,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":184,"pkt_l4_len":150,"pkt":"MFLLbJwbmAyC0zx8CABFAACqgopAADERuDmLO5eJwKgrEjVwNXAAlrYaIDWQheTdAi5EsaMKlfbbtjLx3yiNPYco3f3t8tMAAAAGV8IMLQAAAAAEESnvtXTC2KmNMf52XQZMT\/ynVaoEa3I9\/AWZx+ZRVMtKTUukC\/HqCjZv+fi\/R5zCagjkN1yj2rlntWK9LJFrUykFCoazdmXISBIDNtA95B\/+ZHNhgqNRrWy2MUDB4ZUseXMEug=="} 00461{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":192,"source":"openvpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472334892,"pkt_ts_usec":690288,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"mAyC0zx8MFLLbJwbCABFAABOfQRAAEARrxvAqCsSizuXiTVwNXAAOg7LKGYO4pqkkLBZaAa3k0FcKmOJijbq3ehJRczebO8AAAAIV8IMKgEAAAAENZCF5N0CLkQ="} 00591{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":193,"source":"openvpn.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1472334892,"pkt_ts_usec":875376,"pkt_caplen":184,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":184,"pkt_l4_len":150,"pkt":"MFLLbJwbmAyC0zx8CABFAACqgqFAADERuCKLO5eJwKgrEjVwNXAAloHZIDWQheTdAi5EGn+8Hpjn1EX+kGpde81XFbgwab0AAAAHV8IMLQAAAAAFXs16Z1Oqb5\/NXvcN\/JPmFRsB9Qn433GGYzVrij\/603Hf3x8+jZjnDWISqi+KCm7yOhv+vC+HduaYS8lkNp0MRD+iOTf9JQGGMbbarVk+UP2lQsnNAgMBAAGjIDAeMAkGA1UdEw=="} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":298,"source":"openvpn.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":120,"flow_first_seen":1472334890224,"flow_last_seen":1472334909465,"flow_tot_l4_data_len":24092,"flow_min_l4_data_len":50,"flow_max_l4_data_len":1253,"flow_avg_l4_data_len":200,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.18","dst_ip":"139.59.151.137","src_port":13680,"dst_port":13680,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":298,"source":"openvpn.pcap","alias":"nDPId-test"} diff --git a/test/results/os_detected.pcapng.out b/test/results/os_detected.pcapng.out index 91832d6ec..e23f393a0 100644 --- a/test/results/os_detected.pcapng.out +++ b/test/results/os_detected.pcapng.out @@ -1,3 +1,6 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"os_detected.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"os_detected.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1611427514609,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"8.8.8.8","src_port":39821,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02109{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"os_detected.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1611427514,"pkt_ts_usec":609727,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAZdFAAEAR\/ePAqAGACAgICJuNAbsE7AYLxP8AAB0Inw\/JO07eNjIIgxX\/XKNBIUIARMqZ8UiDvq\/ZLsUdz0scSMu9YDA5XC\/EJ\/VWdcKmIJjpSLXMxg05sWM0HmWuizvek0EXnlQzmUN9ovr2\/hk4L4+drmSHxo9NOB+GUfgxVDY8jS5sYut7pzwyS1v0Tzd0E1TyJIWDsBfvZlI4bbIIRlefQgOB0WdUqMEfHzxzcbGs6dNO+9vDaznNJ4dGUWqyjTrP1xrbA5ARI5dTVb4R+7D0v8orWpuNvxjoiVb36LCsfL0SbVo2GhqQoHke+Z\/B2D+0+r7INWQc1iHzAG+HeNlA1LtOtYyHAJVB+P59vqKsfmDTE8RgVpXe1x30lS+4YR7jaekw9qCyZHC0kKXvmsPCqZ\/9qa5gMMsfGTjnOTdcid5WA6CyHhSK2HTQW4GkzXHYPreaFIFRc0y9+aMq1Mfl97S1vnvDvIbG91Np67AM6LV1xuilkclYvUim1l1JoFQCUfe6m3PyP+gIQTFerpfrZHjXHVmed8ZubnloXre0\/Z3B2Oh1fmjBjrSNQGdC4YK\/DVld8Ug+FRG0kxgDMCgRJ2S9dOYEMkKgzq\/BKvgwUYmMidXS+F+tMJvoHQSzv3bhpGgehHuZOqNIC3d6Rty6h0nPb+BYsf5E1IpIcwzMB2CvZbT77jViKMoAt5RtufWUmoQ2qymcAa7AXbvCL5L7qI\/1oplTPNm0Ysi0JSUXXf61rlCNL1vc+XNbLSeTg2Vz2fPTbPH7hg\/8qinCri68WhuYiT\/rvuXkVqGxWKJq5b1oM\/AIky7+yMfObOfk9kQ3thgac0pRO1LAAwjECH\/XdGHuEsxIejknnknLjBpjmS+2c+909N0TGc\/NPsDPdaLmN10HnCVLaT1WmruOxWZDa3gV1s3K4IKU6NwqVeHNSYO5xx5HEC7tZU+y4E74cmfLayIxxbdgkahHRv9ATyXrtMLRAHqK8ZsoIIw0D9NAPBA355APW3UhJ\/Z9ZHxppKcR2\/OPN1KQqoIrhRGT9bUzB7Xkn\/VMWRYSTXTiaAYMcb8dRkENbKtVWSIk9LJFrE8pIXivmB2tWlt1t6y+TR30oU1\/NUX3jGhxE7t44s+NhGXfBpl2YQbF4zUhYeZAUzU9QbWzyGdZYarMNxVUgYeW9stlVHB0y\/otPwbX9mpoJ+Dy1FXdgrsIv1LAkh1\/3bdSFFfKVJUwX6EGqQRQU02j\/r+E7RZ0bE01QtNNSuMRMdJX2zJtopXBwZLz8h67datSO+I1wfoRzj4VUG35Q8hcFywG\/xq04McVVySWGNnMos9RmQkhysf\/lc3FuHHnMMA\/XcGqeB2biYiiwAKDCGuBCGTLrEYhV1yIzE4vEhvJvg325fJl3DNeUSuAwqKe9SjUjQtv+EVpEiYxaR6X90zwFDBlHdBDDCfh3iS1o2jSGLUvocncy0jQz8qak7nPw6oMW\/gU8WvBhkEaY\/b26hw+tYWakl5yNVwxnF\/7PKfJyyyPpmjSH2ycL45nydbEY1t1GYpcV+P7AunIs6enuyUp9NNdtbH\/d0RuYFGsVW1287YLi13LwF56RtlC\/tVGquwfxdqcbniCbYb8LvlGF6r32UjuoiuACdgmkrt6Wf7sAVkRHeYLY5bLkD+o6H+JIwDjoOA\/yI8iOw0QceAwvS35vC2IO56LiInTgA=="} 00810{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"os_detected.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1611427514609,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"8.8.8.8","src_port":39821,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"24":"SNI TLS extension was missing"},"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"user_agent":"Mozilla\/5.0 (Windows NT 5.2; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit\/531.21.10 (KHTML, like Gecko)","version":"TLSv1.3","alpn":"h3-29","ja3":"9addef84847d700f759746b237c405c8","tls_supported_versions":"TLSv1.3"}} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1,"source":"os_detected.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1611427514609,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"8.8.8.8","src_port":39821,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1,"source":"os_detected.pcapng","alias":"nDPId-test"} diff --git a/test/results/pinterest.pcap.out b/test/results/pinterest.pcap.out index 4bc1a8058..5d06ec06d 100644 --- a/test/results/pinterest.pcap.out +++ b/test/results/pinterest.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"pinterest.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00506{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1605289710318,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33164,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289710,"pkt_ts_usec":318889,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gCMmjACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXhUgYwBu9VDYL21LWgegBAB9TESAAABAQgKz6ojDMK4Yvg="} 00455{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289710,"pkt_ts_usec":576735,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPQBk\/5sAAAAAAAAAAJdleFQqAcsBIEmLB5kd7IUo3\/YpAbuBjLUtaB7VQ2C+gBALgY8wAAABAQgKwrkTpM+oCrY="} @@ -433,3 +434,58 @@ 01876{"flow_id":37,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17607,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289733,"pkt_ts_usec":468842,"pkt_caplen":1134,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1134,"pkt_l4_len":1080,"pkt":"5EKm5WPyqtsDr8lkht1gAAAABDgGPQBk\/5sAAAAAAAAAAJdlem4qAcsBIEmLB5kd7IUo3\/YpAbucsmOjtqMAcZgPgBgLMNtJAAABAQgKwrltScW6TKNkZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqrKM7vX5KZ+\/+rPQprvfOSRYCynIjzc0wwUdQrsX5vbFbUH7xlLyYcP+uiMzprDU+gYHz51aDxDvCVEVQaNrioKCE65d+zQlPIrtplIEOQ7mVk\/a0DbrrNUtXMBAZMyJP9bSxZ4pyY7m6WG86zbbAwENvxFRn8FPIAe1qHhs4Uwgv+01lU60Xa+PwNFFm0rR9rj6ztkjCHCT5eQGpzjf5Iwooq0ViOGHeve23nozVi0qCgL4RdddFvz\/gVmZ4RDnvcm3+acranxNeaoH3NzK6SMSadamHJgqyLZA6h42zzIpeNJ3EoqDhOCLXgaV4jGQI9DExCqDkyi1ctR2f7HdvAgMBAAGjgccwgcQwHwYDVR0jBBgwFoAUqSuH4c4kRzsbv8+FNwJVnQ2UWOYwTAYDVR0gBEUwQzBBBgkrBgEEAaAyAV8wNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wDwYJKwYBBQUHMAEFBAIFADATBgNVHSUEDDAKBggrBgEFBQcDCTAdBgNVHQ4EFgQUJzerGfqxBfrD93SB0OZc5bk+qIswDgYDVR0PAQH\/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQBYrdMQ3rHOvEDcQ\/YXiDSa+YOGH5vdKUsoY4dIE1OOsKbzkTcy0SQjXbu885v9FU639im6wjcM4r4y0z2dv0wThyQd5M+OxuNkGxxxhmSJ1YCialDCOmiBvCCoAUmHKEjw3+CTGTYjdqtssj0d6vdpfB9BEw0p8+z7luyF8J1rOpaXSYPNjtGC7wymh4Fnj6MdtE1fTVPtTOq6DBqTdOdoZ34DHXRegFj5kHqavxkjKlWlTUxM3LZHbU\/pcuo7+9HNYTVANftUq1\/UvXTvFjE1V70rzSeNFVbRUfmLx1ZmUCHo9YxvYDQpPBjDJGSORiX97b12+9Gq7cGOKQYlI+5pFgMDASwMAAEoAwAdIFr5lFggT4Gtqcf05p5j9TWlaPancoWOGslEZykcLaQ2CAQBAETQlqljPZX7dWO7khUxXHv2TUyQIn8IYE1JUm1vb\/hyjC40eW2xd4IabhxPxJUwVVfW6bFw7RefZ62QMZ0pEi6sqAMvEG\/DzJgOpszQRYkluTfh80t+IgfgGc2RP3ZQ8NIM0gLwAmHXxnBomUkv\/\/y\/05xqj51n0NmALxf9Cmg5UiGY90UDAPfDoVMDoqTt1I3J6bu0ZH\/wrSe2f6jdXKjWZ+PCZz+8TaVTlQi2l0q3pjzz5zSn7oK5NTVyq5jMRQy8y8RO+bClxOinaPbCR6v24JJWHzySDSmApU263+jK"} 00459{"flow_id":37,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17608,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289733,"pkt_ts_usec":468857,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gBe6sACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXpunLIBuwBxmA9jo65zgBAB9ZJfAAABAQgKxbpM0sK5bUk="} 00459{"flow_id":37,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17609,"source":"pinterest.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605289733,"pkt_ts_usec":468886,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gBe6sACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXpunLIBuwBxmA9jo7KLgBAB845JAAABAQgKxbpM0sK5bUk="} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1605289712203,"flow_last_seen":1605289712420,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:807::200a","src_port":40876,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1605289712203,"flow_last_seen":1605289712420,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:807::200a","src_port":40876,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":41,"flow_first_seen":1605289714558,"flow_last_seen":1605289715083,"flow_tot_l4_data_len":9192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":224,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2600:1901::7a0b::","src_port":47032,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":126,"flow_first_seen":1605289717548,"flow_last_seen":1605289731068,"flow_tot_l4_data_len":53771,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2482,"flow_avg_l4_data_len":426,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::200d","src_port":40894,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00537{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":61,"flow_first_seen":1605289732972,"flow_last_seen":1605289733399,"flow_tot_l4_data_len":26817,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":439,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200e","src_port":45126,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":48,"flow_first_seen":1605289733399,"flow_last_seen":1605289733529,"flow_tot_l4_data_len":20483,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":426,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7a6e","src_port":40114,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1605289726574,"flow_last_seen":1605289726621,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51446,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1605289726574,"flow_last_seen":1605289726621,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51446,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51472,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51472,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":224,"flow_first_seen":1605289715133,"flow_last_seen":1605289716126,"flow_tot_l4_data_len":313269,"flow_min_l4_data_len":32,"flow_max_l4_data_len":31440,"flow_avg_l4_data_len":1398,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2003","src_port":51582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1605289720502,"flow_last_seen":1605289720592,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38402,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00522{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1605289720502,"flow_last_seen":1605289720592,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38402,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1605289722610,"flow_last_seen":1605289722642,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38406,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00522{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1605289722610,"flow_last_seen":1605289722642,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38406,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00556{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":50,"flow_first_seen":1605289716168,"flow_last_seen":1605289716373,"flow_tot_l4_data_len":33785,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":675,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2003","src_port":43562,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00537{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":50,"flow_first_seen":1605289716168,"flow_last_seen":1605289716373,"flow_tot_l4_data_len":33785,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":675,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2003","src_port":43562,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1605289726582,"flow_last_seen":1605289726637,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::200a","src_port":47682,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1605289726582,"flow_last_seen":1605289726637,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::200a","src_port":47682,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00544{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":71,"flow_first_seen":1605289715274,"flow_last_seen":1605289715612,"flow_tot_l4_data_len":69305,"flow_min_l4_data_len":32,"flow_max_l4_data_len":12452,"flow_avg_l4_data_len":976,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a03:2880:f030:13:face:b00c::3","src_port":51292,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1605289718346,"flow_last_seen":1605289718372,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":56940,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1605289718346,"flow_last_seen":1605289718372,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":56940,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":12778,"flow_first_seen":1605289714142,"flow_last_seen":1605289717307,"flow_tot_l4_data_len":20547303,"flow_min_l4_data_len":32,"flow_max_l4_data_len":65268,"flow_avg_l4_data_len":1608,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":17,"flow_first_seen":1605289714142,"flow_last_seen":1605289714258,"flow_tot_l4_data_len":6339,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":372,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38514,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":18,"flow_first_seen":1605289714142,"flow_last_seen":1605289714259,"flow_tot_l4_data_len":6359,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":353,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38516,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":15,"flow_first_seen":1605289714142,"flow_last_seen":1605289714258,"flow_tot_l4_data_len":6299,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":419,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38518,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":15,"flow_first_seen":1605289714142,"flow_last_seen":1605289714258,"flow_tot_l4_data_len":6299,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":419,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38520,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":15,"flow_first_seen":1605289714142,"flow_last_seen":1605289714259,"flow_tot_l4_data_len":6299,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":419,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38522,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":52,"flow_first_seen":1605289732959,"flow_last_seen":1605289733342,"flow_tot_l4_data_len":28658,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":551,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::84","src_port":38546,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":55,"flow_first_seen":1605289715966,"flow_last_seen":1605289733391,"flow_tot_l4_data_len":8134,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":147,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::200a","src_port":47790,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":808,"flow_first_seen":1605289714782,"flow_last_seen":1605289715303,"flow_tot_l4_data_len":1807508,"flow_min_l4_data_len":32,"flow_max_l4_data_len":16688,"flow_avg_l4_data_len":2237,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a04:4e42:1d::720","src_port":57050,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1605289714251,"flow_last_seen":1605289714288,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::acd9:13e2","src_port":34626,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00524{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1605289714251,"flow_last_seen":1605289714288,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::acd9:13e2","src_port":34626,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":54308,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":54308,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":116,"flow_first_seen":1605289715221,"flow_last_seen":1605289715740,"flow_tot_l4_data_len":136730,"flow_min_l4_data_len":32,"flow_max_l4_data_len":16944,"flow_avg_l4_data_len":1178,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":54416,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714281,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33156,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00524{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714281,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33156,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1605289710318,"flow_last_seen":1605289710576,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33164,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1605289710318,"flow_last_seen":1605289710576,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33164,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714288,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":58726,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1605289714250,"flow_last_seen":1605289714288,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":58726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":171,"flow_first_seen":1605289715782,"flow_last_seen":1605289724655,"flow_tot_l4_data_len":155615,"flow_min_l4_data_len":32,"flow_max_l4_data_len":12452,"flow_avg_l4_data_len":910,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a03:2880:f11f:83:face:b00c::25de","src_port":60340,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2804,"flow_first_seen":1605289713743,"flow_last_seen":1605289734948,"flow_tot_l4_data_len":3761459,"flow_min_l4_data_len":32,"flow_max_l4_data_len":13656,"flow_avg_l4_data_len":1341,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":33,"flow_first_seen":1605289714658,"flow_last_seen":1605289714873,"flow_tot_l4_data_len":8379,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":253,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:7854","src_port":33280,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2004","src_port":40560,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2004","src_port":40560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":107,"flow_first_seen":1605289714590,"flow_last_seen":1605289716476,"flow_tot_l4_data_len":42420,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":396,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2004","src_port":40694,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":48890,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1605289728586,"flow_last_seen":1605289728804,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":48890,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::200a","src_port":57130,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1605289718347,"flow_last_seen":1605289718378,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::200a","src_port":57130,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1605289722442,"flow_last_seen":1605289722621,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2600:1901::7a0b::","src_port":46918,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1605289722442,"flow_last_seen":1605289722621,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2600:1901::7a0b::","src_port":46918,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00132{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":17657,"source":"pinterest.pcap","alias":"nDPId-test"} diff --git a/test/results/pps.pcap.out b/test/results/pps.pcap.out index 68b50f5de..cd37d484a 100644 --- a/test/results/pps.pcap.out +++ b/test/results/pps.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"pps.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1467353136432,"flow_last_seen":0,"flow_tot_l4_data_len":1073,"flow_min_l4_data_len":1073,"flow_max_l4_data_len":1073,"flow_avg_l4_data_len":1073,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01837{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":432546,"pkt_caplen":1107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1107,"pkt_l4_len":1073,"pkt":"ABxCjnAxTF4M6gNlCABFAARFnt8AAHkRY4kBrQXiwKhzCFhsWQkEMf8ywISVs7ORwenTFHKVo6On5uSI0FSEcN6hpKSkpNyhoaGhoaGhpZUqLaxIFnIc1o9j1V\/jBxJYgTJzuNolbzVZ0R0xZInD9kisn9RUmqrxmfaOfWLidBLnlikkHNGned0J8w\/52jjY0bi7jWD1Ne30q1o07ZUYUv\/QbvJH0F4eDOmx08v7Bn20GVMFMCjodWpNTNXJ2SexjrFeI6FN4QYXCHMojb7c\/PEThAYazMCmu0O\/roaBRseEPs6rkTe8cp9cAvQ\/n5mjopI2U8mnsMzLdAnslhYT0HUp9qJVwLrEv01esKN2ht\/bwWWVF5TQquAB9v7Wt6e2OQ8vuih+Atb\/n4iLmHyAs8+DFzXEuSUKcpvamkMM7UM6hef8q9KNvY9qWQR1Tk9ycKmbR0smL1JeXfm85kJMbN\/EYgsXVxKaRK2Rv1yY1dyGePuc3UEjPL+KzMtadixFRQ2hL7UpDi17vDigTJ7AYF91J2Ja6BY8r45GbA0qcKjT\/2PMj0bcxGB5DZVExfvPgmT3pnLIXAIQCOuPxcK1euFQEq3Apr\/U+RUfsQg\/rkRxZFaG23hIOWdbuHAYWf162Ln84BIDQyIvmVPxm8HZfjSFxo5lT3SAnYhEraONvTPmIXSleQ0yKdGJXnTmaDvKNiI7tvMq4Ue8NItBFyrpaz\/ey7wisHK9g6RaTXC2Chi58N03IkAUbldcXIkAS5oXnhiCl8IRbYlSyiMzSearcyriLmt1A2oCZsMGjLI+Vg\/QQvFWKc8MUtJXDD\/3\/zP8XOVOsXbwqPjP0oQ7zs+cPcwh\/zsX++z5sEE67YjR9MZx16gb1c6v0nV6LooYTawJrbu4mQmfFZzBirmdYpVDc4DqSieyA3bfOctfLgZnR3dYSCqNYYEecOcnZB43DJPn8EapO45onRSmMzS98N7TjaXmivBMLMEYQUMWDdAQR+RohVRWZ8yz03QldhdX5BlmxjsyF+QH4XhdR0TNLGfQpBdbvPuC7brPT34pQ\/bB6DZ6ODmbu+A2bFlwaKRZQmJpDJEqSpl\/j8OazBmvo4z1ZZoiN2qDNKYSKtk5sX2V4oom7Mnsk9hlp\/P7QgLEBpxQ6BCZB+MVDHR5MiRiLZDeVw70iySjxEYrchS3jdcNstavegpWpk9whZhUojqFPGvCcQT6tmKjbQIj5Hu8ksUMNE+8BTHM8uZtK\/5DEb5Sp8gJi14\/rPknXLsL1+u4QhASTCXJWfbflBR6pE5s+QTIeXdrRWYqM9thmBhP+C3ZF+iPYB\/m3bwwcBgmvlLrzojH5FQZ4K8lHE7ijUN9HVDnNUbnZc73qehkk0VqLJlMqTyl7jKytXnNXEqS0p7S2OdJ0s12tQ48KCHUsQqmAui3sLr0tFku+q\/\/8h3kbG7OZisKcU6BzQvEtOBdMqyPELwAAAAA"} 00442{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353136,"pkt_ts_usec":432852,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"TF4M6gNlABxCjnAxCABFAABBfzYAAIARgDbAqHMIAa0F4lkJWGwALVw+2oCeu7uZyeHbHHqdq6urqq6n\/nt+fn5+wr+\/v7+\/v7+7W6Rb\/w=="} @@ -608,3 +609,136 @@ 00815{"flow_id":110,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2555,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353202,"pkt_ts_usec":428117,"pkt_caplen":356,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":356,"pkt_l4_len":322,"pkt":"TF4M6gNlABxCjnAxCABFAAFWNPFAAIAGGfPAqHMITeopI8AWAFDGfUDpP88xLlAYAfC3\/AAAR0VUIC9SL0EzZ0tJRGxqWTJJM09Ea3lNMk5pTVRSbE1UQmlOelJtWkdRM09URTRPRGRoTkRabEVnUUNNQVlXR0tBRUlnSF9LZ2NJQkJEbXpObERLZ2NJQXhDcm5fdEJNZ29JQkJEbXpObERHSUFLT00yUmhGaENJQ3NCNTkzdkt4UTZjVnpBZ0NMX2I5WFdsc0ZRVng3NTRaZ0NIdjFYYVZwMVNJQ0NtQWc9IEhUVFAvMS4xDQpBY2NlcHQ6ICovKg0KQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0NClByYWdtYTogbm8tY2FjaGUNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkhvc3Q6IHN1LmZmLmF2YXN0LmNvbQ0KDQo="} 00577{"flow_id":76,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2556,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353203,"pkt_ts_usec":65844,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"pkt":"AQBef\/\/6cBiLE+IdCABFAAChI7sAAAER38jAqAUm7\/\/\/+uYRB2wAjbWjTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDoyMzkuMjU1LjI1NS4yNTA6MTkwMA0KU1Q6dXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNYW46InNzZHA6ZGlzY292ZXIiDQpNWDozDQoNCg=="} 00579{"flow_id":105,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1467353203,"pkt_ts_usec":157237,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"pkt":"AQBef\/\/6dNArkea6CABFAAChdKwAAAERIPzAqHMB7\/\/\/+scBB2wAjWbYTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSG9zdDoyMzkuMjU1LjI1NS4yNTA6MTkwMA0KU1Q6dXJuOnNjaGVtYXMtdXBucC1vcmc6ZGV2aWNlOkludGVybmV0R2F0ZXdheURldmljZToxDQpNYW46InNzZHA6ZGlzY292ZXIiDQpNWDozDQoNCg=="} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.26.193.119","src_port":22793,"dst_port":7133,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.26.193.119","src_port":22793,"dst_port":7133,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":23,"flow_first_seen":1467353151975,"flow_last_seen":1467353165019,"flow_tot_l4_data_len":25110,"flow_min_l4_data_len":197,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":1091,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"77.234.40.96","src_port":50486,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"115.157.62.243","src_port":22793,"dst_port":29006,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"115.157.62.243","src_port":22793,"dst_port":29006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.250.102.66","src_port":22793,"dst_port":1107,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.250.102.66","src_port":22793,"dst_port":1107,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":2,"flow_first_seen":1467353159222,"flow_last_seen":1467353159428,"flow_tot_l4_data_len":645,"flow_min_l4_data_len":289,"flow_max_l4_data_len":356,"flow_avg_l4_data_len":322,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.15","dst_ip":"68.233.253.133","src_port":65127,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":2,"flow_first_seen":1467353181295,"flow_last_seen":1467353181515,"flow_tot_l4_data_len":653,"flow_min_l4_data_len":297,"flow_max_l4_data_len":356,"flow_avg_l4_data_len":326,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.5.15","dst_ip":"68.233.253.133","src_port":65128,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.26.74.190","src_port":22793,"dst_port":1037,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.26.74.190","src_port":22793,"dst_port":1037,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.232.243","src_port":22793,"dst_port":21044,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1467353136835,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.232.243","src_port":22793,"dst_port":21044,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1467353136835,"flow_last_seen":1467353136836,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":32,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":94,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"1.169.136.116","src_port":22793,"dst_port":17951,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1467353136835,"flow_last_seen":1467353136836,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":32,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":94,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"1.169.136.116","src_port":22793,"dst_port":17951,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1467353139305,"flow_last_seen":1467353139309,"flow_tot_l4_data_len":1025,"flow_min_l4_data_len":246,"flow_max_l4_data_len":779,"flow_avg_l4_data_len":512,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"203.66.182.24","src_port":50466,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":53,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"220.130.154.23","src_port":22793,"dst_port":35941,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":53,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"220.130.154.23","src_port":22793,"dst_port":35941,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":6,"flow_first_seen":1467353152692,"flow_last_seen":1467353167734,"flow_tot_l4_data_len":846,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.57","dst_ip":"239.255.255.250","src_port":59648,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":3,"flow_first_seen":1467353156641,"flow_last_seen":1467353156700,"flow_tot_l4_data_len":2244,"flow_min_l4_data_len":277,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":748,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50488,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":27,"flow_first_seen":1467353157138,"flow_last_seen":1467353157157,"flow_tot_l4_data_len":33380,"flow_min_l4_data_len":392,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":1236,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50491,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":1467353159731,"flow_last_seen":1467353159746,"flow_tot_l4_data_len":805,"flow_min_l4_data_len":396,"flow_max_l4_data_len":409,"flow_avg_l4_data_len":402,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.66","src_port":50494,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":246,"flow_first_seen":1467353189325,"flow_last_seen":1467353189439,"flow_tot_l4_data_len":311669,"flow_min_l4_data_len":164,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":1266,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50505,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":2,"flow_first_seen":1467353190040,"flow_last_seen":1467353190044,"flow_tot_l4_data_len":1207,"flow_min_l4_data_len":178,"flow_max_l4_data_len":1029,"flow_avg_l4_data_len":603,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50507,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":2,"flow_first_seen":1467353190634,"flow_last_seen":1467353190638,"flow_tot_l4_data_len":550,"flow_min_l4_data_len":164,"flow_max_l4_data_len":386,"flow_avg_l4_data_len":275,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50508,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.47.91.129","src_port":22793,"dst_port":22576,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.47.91.129","src_port":22793,"dst_port":22576,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_first_seen":1467353138757,"flow_last_seen":1467353138794,"flow_tot_l4_data_len":1759,"flow_min_l4_data_len":207,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":586,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50463,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":5,"flow_first_seen":1467353140755,"flow_last_seen":1467353140794,"flow_tot_l4_data_len":4383,"flow_min_l4_data_len":622,"flow_max_l4_data_len":1044,"flow_avg_l4_data_len":876,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.32.39","src_port":50476,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":3,"flow_first_seen":1467353165456,"flow_last_seen":1467353165492,"flow_tot_l4_data_len":1759,"flow_min_l4_data_len":207,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":586,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50496,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_first_seen":1467353160157,"flow_last_seen":1467353163154,"flow_tot_l4_data_len":290,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.48","dst_ip":"239.255.255.250","src_port":63930,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1467353136439,"flow_last_seen":1467353136440,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.249.53.196","src_port":22793,"dst_port":32443,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1467353136439,"flow_last_seen":1467353136440,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.249.53.196","src_port":22793,"dst_port":32443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":2,"flow_first_seen":1467353191500,"flow_last_seen":1467353191505,"flow_tot_l4_data_len":623,"flow_min_l4_data_len":164,"flow_max_l4_data_len":459,"flow_avg_l4_data_len":311,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50766,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":8,"flow_first_seen":1467353191521,"flow_last_seen":1467353191606,"flow_tot_l4_data_len":2640,"flow_min_l4_data_len":164,"flow_max_l4_data_len":496,"flow_avg_l4_data_len":330,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50767,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":2,"flow_first_seen":1467353191604,"flow_last_seen":1467353191608,"flow_tot_l4_data_len":656,"flow_min_l4_data_len":164,"flow_max_l4_data_len":492,"flow_avg_l4_data_len":328,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.19","src_port":50768,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":529,"flow_first_seen":1467353196856,"flow_last_seen":1467353197680,"flow_tot_l4_data_len":674975,"flow_min_l4_data_len":146,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":1275,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50778,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":542,"flow_first_seen":1467353198532,"flow_last_seen":1467353199507,"flow_tot_l4_data_len":691957,"flow_min_l4_data_len":269,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":1276,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50780,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1467353200271,"flow_last_seen":0,"flow_tot_l4_data_len":269,"flow_min_l4_data_len":269,"flow_max_l4_data_len":269,"flow_avg_l4_data_len":269,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"223.26.106.20","src_port":50781,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":2,"flow_first_seen":1467353190168,"flow_last_seen":1467353190235,"flow_tot_l4_data_len":330,"flow_min_l4_data_len":165,"flow_max_l4_data_len":165,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip4","src_ip":"202.108.14.219","dst_ip":"192.168.115.8","src_port":80,"dst_port":50295,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":5,"flow_first_seen":1467353190178,"flow_last_seen":1467353202194,"flow_tot_l4_data_len":705,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.28","dst_ip":"239.255.255.250","src_port":60023,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.171.1","src_port":22793,"dst_port":29702,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.44.171.1","src_port":22793,"dst_port":29702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1467353156959,"flow_last_seen":1467353156998,"flow_tot_l4_data_len":615,"flow_min_l4_data_len":219,"flow_max_l4_data_len":396,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50489,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":2,"flow_first_seen":1467353157063,"flow_last_seen":1467353157103,"flow_tot_l4_data_len":768,"flow_min_l4_data_len":323,"flow_max_l4_data_len":445,"flow_avg_l4_data_len":384,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.13.188","src_port":50490,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":2,"flow_first_seen":1467353191688,"flow_last_seen":1467353191722,"flow_tot_l4_data_len":827,"flow_min_l4_data_len":257,"flow_max_l4_data_len":570,"flow_avg_l4_data_len":413,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"101.227.200.11","src_port":50769,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":40,"flow_first_seen":1467353136439,"flow_last_seen":1467353136982,"flow_tot_l4_data_len":11052,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1091,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.197.138.12","src_port":22793,"dst_port":6956,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":40,"flow_first_seen":1467353136439,"flow_last_seen":1467353136982,"flow_tot_l4_data_len":11052,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1091,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"222.197.138.12","src_port":22793,"dst_port":6956,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":101,"flow_first_seen":1467353136433,"flow_last_seen":1467353136982,"flow_tot_l4_data_len":35385,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1073,"flow_avg_l4_data_len":350,"midstream":0,"l3_proto":"ip4","src_ip":"118.171.15.56","dst_ip":"192.168.115.8","src_port":5544,"dst_port":22793,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":101,"flow_first_seen":1467353136433,"flow_last_seen":1467353136982,"flow_tot_l4_data_len":35385,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1073,"flow_avg_l4_data_len":350,"midstream":0,"l3_proto":"ip4","src_ip":"118.171.15.56","dst_ip":"192.168.115.8","src_port":5544,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1467353136616,"flow_last_seen":1467353136617,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50462,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1467353136616,"flow_last_seen":1467353136617,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50462,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1467353139505,"flow_last_seen":1467353139595,"flow_tot_l4_data_len":760,"flow_min_l4_data_len":165,"flow_max_l4_data_len":595,"flow_avg_l4_data_len":380,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50467,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1467353139627,"flow_last_seen":1467353139779,"flow_tot_l4_data_len":704,"flow_min_l4_data_len":165,"flow_max_l4_data_len":539,"flow_avg_l4_data_len":352,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50469,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_first_seen":1467353139662,"flow_last_seen":1467353139771,"flow_tot_l4_data_len":550,"flow_min_l4_data_len":160,"flow_max_l4_data_len":390,"flow_avg_l4_data_len":275,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50470,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":4,"flow_first_seen":1467353139819,"flow_last_seen":1467353142600,"flow_tot_l4_data_len":2160,"flow_min_l4_data_len":165,"flow_max_l4_data_len":918,"flow_avg_l4_data_len":540,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50471,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1467353140709,"flow_last_seen":1467353140888,"flow_tot_l4_data_len":1075,"flow_min_l4_data_len":165,"flow_max_l4_data_len":910,"flow_avg_l4_data_len":537,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50473,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":1467353140628,"flow_last_seen":1467353140677,"flow_tot_l4_data_len":1226,"flow_min_l4_data_len":160,"flow_max_l4_data_len":1066,"flow_avg_l4_data_len":613,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50474,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1467353140655,"flow_last_seen":1467353140720,"flow_tot_l4_data_len":1072,"flow_min_l4_data_len":165,"flow_max_l4_data_len":907,"flow_avg_l4_data_len":536,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50475,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1467353141138,"flow_last_seen":1467353141308,"flow_tot_l4_data_len":745,"flow_min_l4_data_len":165,"flow_max_l4_data_len":580,"flow_avg_l4_data_len":372,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50477,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_first_seen":1467353147705,"flow_last_seen":1467353147794,"flow_tot_l4_data_len":548,"flow_min_l4_data_len":165,"flow_max_l4_data_len":383,"flow_avg_l4_data_len":274,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50483,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":2,"flow_first_seen":1467353147927,"flow_last_seen":1467353148016,"flow_tot_l4_data_len":753,"flow_min_l4_data_len":165,"flow_max_l4_data_len":588,"flow_avg_l4_data_len":376,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50484,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1467353150114,"flow_last_seen":1467353150272,"flow_tot_l4_data_len":1078,"flow_min_l4_data_len":165,"flow_max_l4_data_len":913,"flow_avg_l4_data_len":539,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50485,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":2,"flow_first_seen":1467353157468,"flow_last_seen":1467353157533,"flow_tot_l4_data_len":1077,"flow_min_l4_data_len":165,"flow_max_l4_data_len":912,"flow_avg_l4_data_len":538,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50493,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":6,"flow_first_seen":1467353165300,"flow_last_seen":1467353165845,"flow_tot_l4_data_len":3237,"flow_min_l4_data_len":165,"flow_max_l4_data_len":918,"flow_avg_l4_data_len":539,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50495,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":3,"flow_first_seen":1467353172912,"flow_last_seen":1467353180202,"flow_tot_l4_data_len":1990,"flow_min_l4_data_len":165,"flow_max_l4_data_len":913,"flow_avg_l4_data_len":663,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50501,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_first_seen":1467353180357,"flow_last_seen":1467353180443,"flow_tot_l4_data_len":1078,"flow_min_l4_data_len":165,"flow_max_l4_data_len":913,"flow_avg_l4_data_len":539,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50502,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":2,"flow_first_seen":1467353185940,"flow_last_seen":1467353186002,"flow_tot_l4_data_len":814,"flow_min_l4_data_len":165,"flow_max_l4_data_len":649,"flow_avg_l4_data_len":407,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50503,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":5,"flow_first_seen":1467353202192,"flow_last_seen":1467353202428,"flow_tot_l4_data_len":3139,"flow_min_l4_data_len":83,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":627,"midstream":1,"l3_proto":"ip4","src_ip":"77.234.41.35","dst_ip":"192.168.115.8","src_port":80,"dst_port":49174,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.37.142.173","src_port":22793,"dst_port":1074,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136835,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.37.142.173","src_port":22793,"dst_port":1074,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":45,"flow_first_seen":1467353136440,"flow_last_seen":1467353136952,"flow_tot_l4_data_len":13333,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1073,"flow_avg_l4_data_len":296,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"219.228.107.156","src_port":22793,"dst_port":1250,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":45,"flow_first_seen":1467353136440,"flow_last_seen":1467353136952,"flow_tot_l4_data_len":13333,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1073,"flow_avg_l4_data_len":296,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"219.228.107.156","src_port":22793,"dst_port":1250,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.233.39.81","src_port":22793,"dst_port":18590,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.233.39.81","src_port":22793,"dst_port":18590,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1467353138931,"flow_last_seen":1467353139050,"flow_tot_l4_data_len":1383,"flow_min_l4_data_len":673,"flow_max_l4_data_len":710,"flow_avg_l4_data_len":691,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.112.49","src_port":50464,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1467353136838,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.133.182","src_port":22793,"dst_port":17788,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1467353136838,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"119.188.133.182","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":3,"flow_first_seen":1467353165563,"flow_last_seen":1467353165659,"flow_tot_l4_data_len":1197,"flow_min_l4_data_len":20,"flow_max_l4_data_len":970,"flow_avg_l4_data_len":399,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.112.49","src_port":50497,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1467353144819,"flow_last_seen":1467353144913,"flow_tot_l4_data_len":659,"flow_min_l4_data_len":249,"flow_max_l4_data_len":410,"flow_avg_l4_data_len":329,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"140.205.243.64","src_port":50482,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.227.170.88","src_port":22793,"dst_port":20227,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.227.170.88","src_port":22793,"dst_port":20227,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"121.248.133.93","src_port":22793,"dst_port":12757,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"121.248.133.93","src_port":22793,"dst_port":12757,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":2,"flow_first_seen":1467353195852,"flow_last_seen":1467353195956,"flow_tot_l4_data_len":1077,"flow_min_l4_data_len":165,"flow_max_l4_data_len":912,"flow_avg_l4_data_len":538,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.236","src_port":50771,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.112.31.89","src_port":22793,"dst_port":29072,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.112.31.89","src_port":22793,"dst_port":29072,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":2,"flow_first_seen":1467353196104,"flow_last_seen":1467353196204,"flow_tot_l4_data_len":1050,"flow_min_l4_data_len":165,"flow_max_l4_data_len":885,"flow_avg_l4_data_len":525,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.221","src_port":50773,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":2,"flow_first_seen":1467353196393,"flow_last_seen":1467353196523,"flow_tot_l4_data_len":718,"flow_min_l4_data_len":165,"flow_max_l4_data_len":553,"flow_avg_l4_data_len":359,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.108.14.219","src_port":50774,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1467353136835,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":32,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":94,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.41.144.153","src_port":22793,"dst_port":10492,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1467353136835,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":32,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":94,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"114.41.144.153","src_port":22793,"dst_port":10492,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.223.204.67","src_port":22793,"dst_port":11102,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"61.223.204.67","src_port":22793,"dst_port":11102,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":2,"flow_first_seen":1467353167288,"flow_last_seen":1467353167373,"flow_tot_l4_data_len":825,"flow_min_l4_data_len":165,"flow_max_l4_data_len":660,"flow_avg_l4_data_len":412,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50498,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":3,"flow_first_seen":1467353157433,"flow_last_seen":1467353157718,"flow_tot_l4_data_len":1321,"flow_min_l4_data_len":355,"flow_max_l4_data_len":483,"flow_avg_l4_data_len":440,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.13.3","src_port":50492,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":2,"flow_first_seen":1467353170523,"flow_last_seen":1467353171307,"flow_tot_l4_data_len":1228,"flow_min_l4_data_len":165,"flow_max_l4_data_len":1063,"flow_avg_l4_data_len":614,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.76","src_port":50499,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":3,"flow_first_seen":1467353190892,"flow_last_seen":1467353190978,"flow_tot_l4_data_len":617,"flow_min_l4_data_len":25,"flow_max_l4_data_len":463,"flow_avg_l4_data_len":205,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"106.38.219.107","src_port":50509,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":2,"flow_first_seen":1467353195855,"flow_last_seen":1467353195998,"flow_tot_l4_data_len":606,"flow_min_l4_data_len":241,"flow_max_l4_data_len":365,"flow_avg_l4_data_len":303,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"123.125.111.70","src_port":50772,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1467353199417,"flow_last_seen":0,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":241,"flow_max_l4_data_len":241,"flow_avg_l4_data_len":241,"midstream":1,"l3_proto":"ip4","src_ip":"123.125.111.70","dst_ip":"192.168.115.8","src_port":80,"dst_port":50775,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_first_seen":1467353136483,"flow_last_seen":1467353136483,"flow_tot_l4_data_len":155,"flow_min_l4_data_len":51,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"183.228.182.44","dst_ip":"192.168.115.8","src_port":13913,"dst_port":22793,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_first_seen":1467353136483,"flow_last_seen":1467353136483,"flow_tot_l4_data_len":155,"flow_min_l4_data_len":51,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"183.228.182.44","dst_ip":"192.168.115.8","src_port":13913,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":5,"flow_first_seen":1467353189820,"flow_last_seen":1467353201861,"flow_tot_l4_data_len":705,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.41","dst_ip":"239.255.255.250","src_port":50374,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1467353136838,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.61.167.104","src_port":22793,"dst_port":17788,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1467353136838,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.61.167.104","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1467353136836,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.61.167.82","src_port":22793,"dst_port":17788,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1467353136836,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":120,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"183.61.167.82","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"1.175.128.104","src_port":22793,"dst_port":5185,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"1.175.128.104","src_port":22793,"dst_port":5185,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.61.39.87","src_port":22793,"dst_port":17788,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136838,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":96,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.61.39.87","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":232,"flow_min_l4_data_len":116,"flow_max_l4_data_len":116,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.61.39.103","src_port":22793,"dst_port":17788,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136833,"flow_tot_l4_data_len":232,"flow_min_l4_data_len":116,"flow_max_l4_data_len":116,"flow_avg_l4_data_len":116,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"218.61.39.103","src_port":22793,"dst_port":17788,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":6,"flow_first_seen":1467353180830,"flow_last_seen":1467353195837,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.50","dst_ip":"239.255.255.250","src_port":52529,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.20","src_port":22793,"dst_port":33738,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.20","src_port":22793,"dst_port":33738,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.19","src_port":22793,"dst_port":33738,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1467353136837,"flow_last_seen":1467353136837,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"210.47.12.19","src_port":22793,"dst_port":33738,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":2,"flow_first_seen":1467353191538,"flow_last_seen":1467353191606,"flow_tot_l4_data_len":395,"flow_min_l4_data_len":165,"flow_max_l4_data_len":230,"flow_avg_l4_data_len":197,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.110.220.15","src_port":50765,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":2,"flow_first_seen":1467353196441,"flow_last_seen":1467353196535,"flow_tot_l4_data_len":520,"flow_min_l4_data_len":160,"flow_max_l4_data_len":360,"flow_avg_l4_data_len":260,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50776,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":2,"flow_first_seen":1467353196740,"flow_last_seen":1467353196835,"flow_tot_l4_data_len":1312,"flow_min_l4_data_len":160,"flow_max_l4_data_len":1152,"flow_avg_l4_data_len":656,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50777,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":3,"flow_first_seen":1467353197951,"flow_last_seen":1467353198052,"flow_tot_l4_data_len":1530,"flow_min_l4_data_len":90,"flow_max_l4_data_len":1280,"flow_avg_l4_data_len":510,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.206.22.77","src_port":50779,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":9,"flow_first_seen":1467353179045,"flow_last_seen":1467353203065,"flow_tot_l4_data_len":1269,"flow_min_l4_data_len":141,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.38","dst_ip":"239.255.255.250","src_port":58897,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.117.101.81","src_port":22793,"dst_port":10162,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1467353136834,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"111.117.101.81","src_port":22793,"dst_port":10162,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":9,"flow_first_seen":1467353197131,"flow_last_seen":1467353203157,"flow_tot_l4_data_len":1233,"flow_min_l4_data_len":131,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":137,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.1","dst_ip":"239.255.255.250","src_port":50945,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":400,"flow_first_seen":1467353136432,"flow_last_seen":1467353136981,"flow_tot_l4_data_len":151646,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1075,"flow_avg_l4_data_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"1.173.5.226","dst_ip":"192.168.115.8","src_port":22636,"dst_port":22793,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":5,"flow_first_seen":1467353136439,"flow_last_seen":1467353136660,"flow_tot_l4_data_len":3311,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1075,"flow_avg_l4_data_len":662,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.198.7.89","src_port":22793,"dst_port":16039,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":5,"flow_first_seen":1467353136439,"flow_last_seen":1467353136660,"flow_tot_l4_data_len":3311,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1075,"flow_avg_l4_data_len":662,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"202.198.7.89","src_port":22793,"dst_port":16039,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":2,"flow_first_seen":1467353172446,"flow_last_seen":1467353172450,"flow_tot_l4_data_len":1060,"flow_min_l4_data_len":255,"flow_max_l4_data_len":805,"flow_avg_l4_data_len":530,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"23.41.133.163","src_port":50500,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":18,"flow_first_seen":1467353189784,"flow_last_seen":1467353196145,"flow_tot_l4_data_len":8715,"flow_min_l4_data_len":439,"flow_max_l4_data_len":519,"flow_avg_l4_data_len":484,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.5.38","dst_ip":"239.255.255.250","src_port":1900,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.237.154.69","src_port":22793,"dst_port":4316,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1467353136833,"flow_last_seen":1467353136834,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.115.8","dst_ip":"36.237.154.69","src_port":22793,"dst_port":4316,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2557,"source":"pps.pcap","alias":"nDPId-test"} diff --git a/test/results/ps_vue.pcap.out b/test/results/ps_vue.pcap.out index 216ab40c8..2ccdda05f 100644 --- a/test/results/ps_vue.pcap.out +++ b/test/results/ps_vue.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ps_vue.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1568831054386,"flow_last_seen":0,"flow_tot_l4_data_len":1338,"flow_min_l4_data_len":1338,"flow_max_l4_data_len":1338,"flow_avg_l4_data_len":1338,"midstream":1,"l3_proto":"ip4","src_ip":"8.252.2.139","dst_ip":"192.168.1.132","src_port":80,"dst_port":59198,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 02202{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ps_vue.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568831054,"pkt_ts_usec":386409,"pkt_caplen":1372,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1372,"pkt_l4_len":1338,"pkt":"QJkivOG5AKC8brI7CABFaAVOJd8AADQGjbAI\/AKLwKgBhABQ5z6u3wY0Ay5J4VAQgjL2BgAAKErv4VCv5XHq3VugakpTkhrL+kb9dEp7ZqV8OhbiblbF4ucSVzx\/MP1oilcz0crd02QqcE8+devTItKmafCbWnAwE\/9DOgi7ce43g2BD\/nJGwrypV0n\/lpKlZCPvunYTTeqjhwGKc6502l87Xs+zfJVWBneqtMKdkFu9Luvy+dyqO7rHnCabtAWrpEy0TRcv6LTWKIFUotAIaLkmY7WgSmFIZ62TK8CnvaxwDwzYvJ5ZjQiFN8X5DxilG\/df4sIjuAdwJhNDFhHUfzAE+UueG\/lVfoML5Xk9w+TPsk3F5uGAaPkC86EBn82kkWRI6MGF8SyydVvt5HnewuoCF8DHruY5qPlbl5yLGmUCy6LuKc8s6KM27nygc3Bte7e7XAKflW8Wcvmd0+7YASMoWJ\/SESHwJfo+tjoKQJDCuUg0eYkktG8s\/htBFaRrrEIIIogo1I1rceufguXuUufTPlgB4e4clivmC\/NVWuNR4Wlwc23B3RImV9O2fDK8pRwdsflldfN+2wrlemyOmIEW44MXIVRj4Jx0AiJHgrkz1UzanBUfeGRbpCbnANXha\/D+RxGqI9Y56kLfgbJA9toJuDdEp381WrPm4dk\/35T1ydquleaKrCQ4GUMJvemfq4+2BDWl9ZtzetW\/B52p73A\/IWp9\/JZFCoDaxRJxW2x+nAmeXg4dqTNcnSkj6r0ZKGpEmQibRROebc4N\/OonXc34WkAxZUnA1lC9DEfcItjHPS5bD37cnbpH0gQpDyjOpktkp2UlMdh3PUqigdjHcpUokGd4mAs+\/YFOJPQYT3L5Unc7NDJXghAQbx2nr+oAPx57SB2pRpLcQeD0J57sEpedBQn4XuPnJzaT3OIKdVjZBmwQsn6OHZjEK0I+7BC1eT+jxrPCCQKfpdarqx0mvDgQYWl9uo48EyOvlFkhXjzwZ\/g0nNk9VvOJk9J0L3HSGeXT5\/gmBR6HQc0jiTIlo7hsvOPQ3KzYvH0dkO6gGhTpZwbviYuyiUwG5\/Cp\/e2WVNyZPfnGcN5Yq8w9HkqxHdyOS\/V+K2Nr+z\/t9oTBcSlldci4yuZPSv54jSSzyl3XBHOkOKXk2uUGuEDrbGYDWDjiFbdv1FyP59FHXvE3S1kPDwZrclBqLVjCjaLRSpmxaO1vC1mUHsA9VdUzyhj6QCrLBTQmgQihfCEu5hhGU+ion9NQlLrK9oTWfzfxnTcAEZ5yGWkanmygLm+9oYrRVZ1F4Jvwb0tE+fDeLs7wGIQyOmoBn+nQCxSGP5d2AHoe92SDjy1zgLy7so5DxG+8kuTVKra\/VLGpeSv2BMHOhHwp+IbvaRN9HIXUwkF9r83JbUly94XxqcakWod6a1mV\/LGqgeo3kxq1FxWfhMN8rjVKFZGzFJ6mX2\/YZXsaSJZjewY6Cu2UYcvpY\/FkSF0lYeAQdYHKmAcZsWkEdMu300Gbvn2i0tmmx+0Pfx0fG70baFTfErZgkBhLstjRnhKlAAv8h\/BrE0FKt0hIVWumNRn+jd40MiH0FOkDtxG4SoZU5omb184ogJwSJ1DwMEnXaquhJ3BQtsRwGkEeGNf7HTidpttGUz8zz4MqSXh\/sHhtofPp0atPWf22qfpEefudIXIpM5OWo9PlSNER5a99KtuZQYrTPKfXeWMWl2r\/veNAfvGyupDsDnRcFsQsCPz\/BLfBLXAKixhxb3aK2FeGHnQ0jNhJL+CcLA+EE3AEmb4MU+e4t50YO+Eu7L+xkGD57kzrugTcmBgrRjBcEA=="} 02211{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ps_vue.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568831054,"pkt_ts_usec":386505,"pkt_caplen":1372,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1372,"pkt_l4_len":1338,"pkt":"QJkivOG5AKC8brI7CABFaAVOJeAAADQGja8I\/AKLwKgBhABQ5z6u3wtaAy5J4VAQgjIehwAAVmjXm6oo5VKTUUlxb0W3E81vB9ZxFtPKR4EIgDSzsMZRuBrZPVK+DJqL7elqQHFVnXmO54z2TD4Dj28sHaJvK3ncn6xerjIN7sy9I36\/eZVwP5Cn0qrC8AIkY36VwGWTyBzL7+xIagZlNa3RdzULDJLPoM7D0T0YcEi6MyZXBujPuViaYGsfAbwbgn5b6DYRWR+vA4m5e\/vJZrAW\/bO4lnM1BJsWdGV\/8pd\/FUa\/3fjHFNsT+sPBcZz6Pr9JhudnxHr0rYuSfPsMmCecU46VRczeyiL7GPuOWst16kiLytaPfmw3b1JemKUaLWf0Rhd7tiVMf+y\/xU92Yy8WKPlolDC+\/eoXKonvA6y22W6UVrQQj\/bE6aLoNFWCbKIU5dr\/\/8\/3LL2uDEkYeNu6isLGfN0uRj3j0syq\/3uWBBmJ1HnVgrOeWkVzjv7lh7mcjbm2aVY\/UEDPaGHqh8zm9yJsZvX01bLzllIV9mMdL8yprJYLmavuYMfBWKaAN3U9UQGvKECDlN4z2HO+J4xPvhH9iLqWBk0QkGYyEvJHvbEmgGYw0eiixXhbN61PL3vQszMz94fqlK5pwlcB6VB6WX6b6uBWQe8dUh+NRho\/TQ37e5+A+Gh2Dw+2aiXdKyItQFRaQIXpZvNp5UAOLjzRBJsDz6gL+L0e0Ft\/W+qfc0TfuOzULkgJCEdw2MvcfrnjeNyRqupEjBZ7VEG\/2PUqnoLlpBKavWueOqgdsWHlTk\/70r\/COI\/Gl1\/3TznIXWoErnC6X3PL+X68zzTEJ7Hnq5x2c95lQPmzFya\/bpfdWqx4WzM8awJD5g2lvQc+eqSPoA05rpB8AcIXF9rTPSGtqGjaYy0Btc8vA7gQG8\/5Wu3iN5SY9Ao2+ToNukNfVF5IcKGIL8V+ArUNIPL9bQ9Z7Vg922vlIcv9TsMg929w5q7QEWv\/1TB6gF7LEvo\/bZQBZwabLgVwUBRYTPcY4IYiNuRlgk6wEb3fGZdMxf5Cn8MdzbzHfSl7f2ifhduyGTvWdkVFSSaJMMTDFRh3Qsazze15JppJmOciPxTmUO6Doee7Zo9IwS5y\/MEFNqTe11Hq1tQB1sV8cRFS5yPS+g4NdOqnGEYVPT0YGGGhbjvrV+h7NQE6hzPLeHiqcpcB\/4x2WRwnNJLU4NV0l7Miq8XZJdl++t2uQwMhig32aEu66660GGqxvLiNfVTxzHnAW58k8RPs5R1Xd3elrqRaZXuypABSN8g0qP8atp9wdXFmAJcctJZBbgKspLsXP7kteWGM05W4GK0LoHcsLFvSHoJ\/wNGLjta9O+jdr1rpfvwHG9SoCfh8jrG9nN0fDkh6IU+sCQTC9vES4Pu3Vth\/t2elcn0yJFisar8rl0RF3rg9qx79lgeRTQxnydxILQw446KDk\/GPez\/zajHb\/6\/pWMcrOQhb0qIFF9cJ\/FhPavhImumyOd7eg9JvHdlByzw+wVWZgjo5gi664xi0E0lvkPN0BuMXnAOfvlyGr0h\/+zwKPH8AL7teqATUH+w6vUQtF+pCPMRfDUp7eadX7iztaCTNtt6VzyVkR\/y2PkT3DZQQJ9R\/dRTOnKuedYFQQIpAyGs2fI5PDSqa2Dx8h4p6rb304eiIRR76+o0\/0pJOOaus6W4DFqvp0xHo+nK7hqgIi+XLyhUT47YdAs7H16OeAnlSXD1GmM\/0zTAkev4sFFwerrPSec73af72KjqmDVr4SSOTm5yIv28qFzzqKQ7fiETThx19Awk29yOa1w=="} @@ -41,3 +42,16 @@ 00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1011,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1568831062289,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":1,"l3_proto":"ip4","src_ip":"34.217.165.102","dst_ip":"192.168.1.132","src_port":443,"dst_port":63577,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00408{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1369,"source":"ps_vue.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568831068,"pkt_ts_usec":497909,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"QJkivOG5AKC8brI7CABFSAAow6oAAO4GOi8NIf9gwKgBhAG71yS9fOulSelfaVAQgjIznwAA"} 01141{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1370,"source":"ps_vue.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568831068,"pkt_ts_usec":662597,"pkt_caplen":593,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":593,"pkt_l4_len":559,"pkt":"QJkivOG5AKC8brI7CABFSAJDMqtAAO4GiRMNIf9gwKgBhAG71yS9fOulSelfaVAYgjJp1AAAFwMDAhYGD4WalIgakbxjV3BNVNYcp3yOwJ52gynPGm8mjwAUtT7dYij2hh\/dSwSb7tUScv9p7RPVmT\/SgNSmyy04QnF4qJffmxksL\/sOF76QRXC7971BbNTRYsimK+PkLfgqlhqEv4b6m4ovXhAiRk+Zm80idUbTEZnIUUbuyHgjN293FAOaYO8b7wKQeCXC7ENqPVfxGkNpoupL47IyfwRFcGmWFY8cVMOkwq6KM3DEEEerxs+LVxCCzqaE7S3aNN8M2Cck\/\/QDmZ3sJhTXoaqiP3XD9fiNHSx9rK242Rx\/+wCdgsHUqIWndG4AB5DKgoSKOv8VktQE7lCS4ksD6btUmT2pl1H9XKngtKyHFCMmW1l3TGQ72\/Eu8k1mfsO7iWnevk3n6P4xl2ROn52nNFKQtN7zTnN\/aPCwKZHxkr1SUBj3zkM8L5Aq2R4hEzXX5YALMrcTUEuKTm+xwxt8GHNnQjfMR35eeBwTjPIpZmR\/2BS98CCxmueWRw2UOGOzoQ6OguTnkTVYR9JRpcw+5F86nBOPgcFzjjql5YmusFERtylZw0s193luLs8Sg6RAtVTXJKTQ\/b0wztU3ClKdYIWuVzKKspQhGwgNev2KkCLwex3rMg1bZywuk7as7hvo3ITY6I99wT02VvbfhOm6OcX6ptt99Jg+mx7P0+s92qhzZrY1Him5b57g1UYPWtq234exl29j9rZbRBg="} +00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1568831063948,"flow_last_seen":1568831063948,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":62694,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1568831063948,"flow_last_seen":1568831063948,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":62694,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1568831058486,"flow_last_seen":1568831068662,"flow_tot_l4_data_len":1158,"flow_min_l4_data_len":20,"flow_max_l4_data_len":559,"flow_avg_l4_data_len":289,"midstream":1,"l3_proto":"ip4","src_ip":"13.33.255.96","dst_ip":"192.168.1.132","src_port":443,"dst_port":55076,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1568831058486,"flow_last_seen":1568831068662,"flow_tot_l4_data_len":1158,"flow_min_l4_data_len":20,"flow_max_l4_data_len":559,"flow_avg_l4_data_len":289,"midstream":1,"l3_proto":"ip4","src_ip":"13.33.255.96","dst_ip":"192.168.1.132","src_port":443,"dst_port":55076,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1568831063828,"flow_last_seen":1568831063828,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":55648,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1568831063828,"flow_last_seen":1568831063828,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":55648,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1568831063571,"flow_last_seen":1568831063589,"flow_tot_l4_data_len":723,"flow_min_l4_data_len":20,"flow_max_l4_data_len":703,"flow_avg_l4_data_len":361,"midstream":1,"l3_proto":"ip4","src_ip":"63.140.57.73","dst_ip":"192.168.1.132","src_port":443,"dst_port":61267,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1568831063571,"flow_last_seen":1568831063589,"flow_tot_l4_data_len":723,"flow_min_l4_data_len":20,"flow_max_l4_data_len":703,"flow_avg_l4_data_len":361,"midstream":1,"l3_proto":"ip4","src_ip":"63.140.57.73","dst_ip":"192.168.1.132","src_port":443,"dst_port":61267,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1568831064128,"flow_last_seen":1568831064128,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":52217,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1568831064128,"flow_last_seen":1568831064128,"flow_tot_l4_data_len":71,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":35,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.89.123","dst_ip":"192.168.1.132","src_port":443,"dst_port":52217,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1568831055576,"flow_last_seen":1568831063575,"flow_tot_l4_data_len":91,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"209.102.209.13","dst_ip":"192.168.1.132","src_port":443,"dst_port":65112,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1568831055576,"flow_last_seen":1568831063575,"flow_tot_l4_data_len":91,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":30,"midstream":1,"l3_proto":"ip4","src_ip":"209.102.209.13","dst_ip":"192.168.1.132","src_port":443,"dst_port":65112,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1740,"source":"ps_vue.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-23.pcap.out b/test/results/quic-23.pcap.out index c5ffc06e8..50e4fb097 100644 --- a/test/results/quic-23.pcap.out +++ b/test/results/quic-23.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-23.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00533{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-23.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1568282515655,"flow_last_seen":0,"flow_tot_l4_data_len":1288,"flow_min_l4_data_len":1288,"flow_max_l4_data_len":1288,"flow_avg_l4_data_len":1288,"midstream":0,"l3_proto":"ip6","src_ip":"2e4a:774d:26fd:7f9b:785b:2d1b:4f8a:63c7","dst_ip":"3bcc:9991:faba:bae1:cd2a:e2fd:b3be:c5ab","src_port":50339,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02160{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-23.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568282515,"pkt_ts_usec":655367,"pkt_caplen":1342,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1342,"pkt_l4_len":1288,"pkt":"nJcmWLFfnLbQWTW8ht1gDdl5BQgRQC5Kd00m\/X+beFstG0+KY8c7zJmR+rq64c0q4v2zvsWrxKMBuwUI0EbI\/wAAFwhgax2p4Mt\/UAjcZWkdxzWqcwBE5rEFViXUV0In7d2dXZD4W8++zjZDJBAgmoI+svdNaYLoeL2jqHl80IO9pEfUmkgFWLrT4IlQo8t\/87yXQq3IRCWsbaCVh5W99qNLF16ofVb625RKhJQKN3iU3vpP3WaISyCxGoJXiHsP7sj27ny7LXNNKzH3JhZ3bhiQLS2umcd29X6XChqhAWZjn23A4EHWtq4oNdhkFu8LZI\/zfG+rUZSQr5lxakbHyPuebWPbqVuz09T5esBIjonthwzDSYvYZa0ySbIdmaeXdhlU+E4gLC4WHroq5LZx9pnr7yREt9Dp2HJiUOt1EMzTCveDJnfcPHqR1d6\/YEuvBxkwGcxK7MQsgXVVjQjLsVYM3zgE\/nenut5XK3K7bJeAGfZxUrn\/Y\/S6NaLxM1FgdUyaPkXMATL13fHOLn2TPbUyanoNHsWUaGSz60C+oUnJItBjv49AfcrV5AnxAjninyCVT7ilbuKRBYQ5SPLHeBsT\/NbnYJzK0I1Zj3I7weUUkkcrweRBiR069XTJtWYqzSUqWU5sALkglRvuf6xbvYulQ0jX8ozHEripA5ju8KQBmPJZP7WSUIMlyS8g26Pb2k443GZRz9hlPYNrTsHRc88FbzG8+ahhy1UIvmg27b6gKLWKeoPRPqT\/23G0Wo1ikM4FoXKXzvnDWe1X8Z9PVn+LOSHYR1LqJoMp2f2mWQv847crRAwAw1YWxPVKlFpXb0rR+0hsSK+RIdQgAqDBA2QX26xlMLPLaV5FnoRKfTJi7o9j6TamnIQyR\/b\/g\/IDH2Be62ORQ7K4p27Oyqju5N6C9b0vid0F4+gZ13RNe5vPbvcGGwDUSCHzH5HuKrGh25US\/X91xJ8gist97L0Lrq0S80URKpcxHqC0QxbI4sgi04MOC\/6\/5f2icaiX5IcU\/hdojFqggO95m2grFOU8yda1Z+a+0B+UTPAWzUgGxyOkCthMdR1xVGZfRvlXwGjfBMd6dc\/vwfyp1b8YonfSnSW3vRZZoOvGgqRgE1cEyUD4uXR+I9J+U7b3lAENyqEE6S4PVFwPk4xcaNCNEAFsAmLQRfMnqgm4EclQ2fu\/X4rXYn\/w4VPhxSJ7gZUA4NgNeVynLRKqHUa727Gwo4yXA2fLLCZot4qNfI9GV8gEGhiMrmnJDuuHONvYi8VFwSgiQP9jsRAqGAnvDEEaUirzATf+CkE90c9u9BJN208aRmeL0Hgd\/ZHM6TlLySnssgUghAaObIZXCdBIsYxzkTGX3jv35junPGfSl4SRLk2gvnSptlPR\/Rn6scXnHyxcxY1Tth69QcUpqe9cAH3STuQaFNZjD1dVf2R7djGBGP8XFpAEp4Da6SL0QShqq2TI46wOMWpyGEWgp5CuFAlZyh9lsxPPSVCNRF6ZIHFDEA176ay7PnXocWlpL62qyFOm8ITDpOqmFNLCDdEm1Gb4uY5DgmlqhAIdCuIUzNcLPBAucHSIQlvc6jwsUov+EyqsbCmhoguNjYqYWkTXfROVcd+bJTmI+cPOgPBBwa2oOWk+BLrQ6aBz1dQvhb5YuoZMwA09AEkY+2M7NcQxKjjOU+yU4Hx1Fn0nTrg3sFfxY6wAlusfFhQgzHz4cuAwlvBXae00jqiXWXUvQQ1Rtfra3X+TNbZCCp1e2k+Vki2RypB\/ckwHS7gD9wnM+\/\/rgzF\/7w=="} 00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-23.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1568282515655,"flow_last_seen":0,"flow_tot_l4_data_len":1288,"flow_min_l4_data_len":1288,"flow_max_l4_data_len":1288,"flow_avg_l4_data_len":1288,"midstream":0,"l3_proto":"ip6","src_ip":"2e4a:774d:26fd:7f9b:785b:2d1b:4f8a:63c7","dst_ip":"3bcc:9991:faba:bae1:cd2a:e2fd:b3be:c5ab","src_port":50339,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"quic.aiortc.org","version":"TLSv1.3","alpn":"h3-22","ja3":"d9e7bdb15af8e499820ca74a68affd78","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 00630{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-23.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568282515,"pkt_ts_usec":728438,"pkt_caplen":212,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":212,"pkt_l4_len":158,"pkt":"nLbQWTW8nJcmWLFfht1jg4MNAJ4RKzvMmZH6urrhzSri\/bO+xasuSndNJv1\/m3hbLRtPimPHAbvEowCeTupg3GVpHcc1qnMC97qQLALpHRH9g5VkkV84+ZGr\/B23m4txM5qcs\/TUYt+7VjrD8sG3eTIYvK2yUPG0u3+m3aXmzQ8t1rb4GVFKW3GipGc+9f+cQIsrMoj1qdhUI54DW1qjhlWeXHFwz\/mNBQ8bkkA\/ugvgtTABvTfxcwa+XCMT3qmgbQsNKvFnYayUHn+tLvv7O+BCzWE="} 00584{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-23.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568282515,"pkt_ts_usec":728444,"pkt_caplen":180,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":180,"pkt_l4_len":126,"pkt":"nLbQWTW8nJcmWLFfht1jg4MNAH4RKzvMmZH6urrhzSri\/bO+xasuSndNJv1\/m3hbLRtPimPHAbvEowB+Mb5s3GVpHcc1qnPVz8xc9o6RIS2AjHhtHQE2r1rHEdUzCcoOwGvvKVzABDAx0KvRZaIBIpxSb4lmHh3Al38WGs5GCTly3xPKPXS8D4CyH8Q4bP5dENC5CuAagi15\/TVcxc7eCqv5gMEP8L9V\/st9GkbNC7L5KHzN"} 00468{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-23.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1568282515,"pkt_ts_usec":729605,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"nJcmWLFfnLbQWTW8ht1gDdl5ACgRQC5Kd00m\/X+beFstG0+KY8c7zJmR+rq64c0q4v2zvsWrxKMBuwAoDs1PRXPGBLrjR7TqLABTK+TsP5wNYWccDpmpF\/I4\/Gqybg=="} +00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic-23.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1568282515655,"flow_last_seen":1568282515762,"flow_tot_l4_data_len":6111,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1288,"flow_avg_l4_data_len":305,"midstream":0,"l3_proto":"ip6","src_ip":"2e4a:774d:26fd:7f9b:785b:2d1b:4f8a:63c7","dst_ip":"3bcc:9991:faba:bae1:cd2a:e2fd:b3be:c5ab","src_port":50339,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic-23.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-24.pcap.out b/test/results/quic-24.pcap.out index 804777603..f391d92d6 100644 --- a/test/results/quic-24.pcap.out +++ b/test/results/quic-24.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-24.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-24.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1574209133040,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":41436,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02088{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-24.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574209133,"pkt_ts_usec":40250,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"ClnTQ78Jzivom94WCABFAAUA04pAAEARTk4KCQABCgkAAqHcAbsE7BkSw\/8AABgSKZqySaf1jUZ9aFypIIlM688aEfXDUlabjvj32ExHj28K\/LzWAES33jM5bR+MtpU1BLUazwIKZfi2UUsjupyQtwh0cwaTGSNsc3ziOvMvl5HeN7dnqFzrpWV5xSzaGXCCKPfdH3vP8j3J6ZLIzElZQZR3emJo528x+jgZIHOdaSnx3DWXxF2zh+YTIF4T7iX6QufVjaqbZGcqLfU2h5UhvDV4FwyX3uhlDNyKeZHYtgm98LQqq4\/RRT1KTyGKWwsLmYKiT2RZhGfdnj7cabAAzsX7Lk2p9chyJNCYC2rvLfiUJPAyxycnjNSX2Lj6Aqa8nfo2RgXdwfCaQgxab+TGB6bvb9v+EsUoxuSJh+r\/RN\/6YKeOx43w+asFLV8uu4y7ez42UTvh8WhWB9gu2sFvRZZAH2gXrPZjvaMUKjvUztSfZobDePj\/3bGH7ParnvadIlRAYU9Q2+DurqTinGpGLj1JdKLQoxeMx5eGSPtbuqNyirKapdyXJ8ZKCVjdL9m2B38WlanD9I0yGpWtoLvsOi8f8x\/fhHjJnp\/JSreuYABX7IvE9OH17Ka\/DYXSP3horLga3cmeawXPCcyfSVzp0vy3ZIaVNlu8tvkbFVJwffn9HIFK6HKNWjCpRF+ahuWdOTEeIZZ7i7JR8vw5bYFyaufxilZin8M6RIaJMeMrQc4vvfUfbDjsZuuyfMbD+CtkYjt3ODwFx3+9dnCnls3bcnN\/LK\/fVogu1W6dC2V8OgzkkQDp+glgaZFK3x1y9W9tAnAfcG86bUqaAVXac16E+jbjt3xUVxE3wSFwqpaXR87jZ7puVI7a++RK4x\/CPU7cBx4HxakipMRXAW7+Zzm5Uylji8R1ndMJge591UykzR\/a1rIFwcUFafwyzFwutVakAK\/iM4YhBMTpFZmHTyv44rZt\/SzvRW3ChO61o38I1VeCK0g8ZFXOiuIW\/pELm4Rr3xBh76iDlvWF6YcC0+i92ff1n2MDPlwUBp2JPBEhF9KRkoluOW0vEGZjgOTNF0WO0oSPjp6cRmPu7QFACVxUUAGGJ52pSjmae6FO4iTNFAYtrcv+HXjZLY56ae9mCQOyLL1m06CQPGFQiHOPr2CJqh4awJXrhUafIQCu5ugPi3shAySSxxSNpoi1XFyoXHmAfehBuKAMDEBi\/K2+sO4vF3gp9aph5gyVGEs0pc0rnIKidNla3xHEAlRzhJVd750Uscx9utTZFhNIJHFYbXnWol4tLG+jZZli4l18thfxYBatUVfQbpNdD\/lD+eYzZtOp7YtW1ZKF+ROaDrWxEjfCdVtcjK18Uyjgz5TeZuG7pFJ5t3qyXb+n\/5MzCAN9XPJPpQiYdvqPfvMUwezKWPFBlXc3KAr8TrBHXbzxwj68KugT8kPF6Hf1ZknvffVMbgWpKERCnzNCkdVDHz0qsfdTxN1E8gHLdnzTTb4wYHbDra2Qy1AzeGTZ5VuCqGVCxMyMSucpv1SUY2NRHw7nEKVm2pvwZDPcCeEad3kICbdC4XAMVUx0Mf\/rJlO1G38DhZUFTtkiOIXY+C24n5VM7VxZQ+dzu2YG1ROOR1dGwLm4sR7mTJIH6rldcwpGAOA19nihJl7wI7sV3QgaIXVtqDL9j\/YH7Q44xODtLK6dfnLZ9llZp8VromtwQj2StAFDoQ=="} 00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-24.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1574209133040,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":41436,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"localhost","version":"TLSv1.3","alpn":"h3-24","ja3":"b3e43d74f4b790abca2f5fe7dd06e7cf","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 00449{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-24.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574209133,"pkt_ts_usec":73671,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"ClnTQ78Jzivom94WCABFAABG05RAAEARUv4KCQABCgkAAqHcAbsAMhRYUOCYz+cZz4V1CzMLBns\/aZp\/2z7zc0vp3+LcUiaJlNWy50Jlz5CiYB1w"} 00448{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-24.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574209133,"pkt_ts_usec":73692,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"zivom94WClnTQ78JCABFAABFQStAAEAR5WgKCQACCgkAAQG7odwAMRRXRvXDUlabjvj32ExHj28K\/LzW6q1Ilbkulx8QpPDfCg0ahlH9hGpsv1U="} 00449{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-24.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1574209163,"pkt_ts_usec":81103,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"ClnTQ78Jzivom94WCABFAABE3IZAAEARSg4KCQABCgkAAqHcAbsAMBRWReCYz+cZz4V1CzMLBns\/aZp\/25sTROHCqKYw+n6Ol0QxqpRmDt2U2w=="} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":15,"source":"quic-24.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":15,"flow_first_seen":1574209133040,"flow_last_seen":1574209163081,"flow_tot_l4_data_len":7490,"flow_min_l4_data_len":47,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":499,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":41436,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":15,"source":"quic-24.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-27.pcap.out b/test/results/quic-27.pcap.out index 753da66b9..9e66430a4 100644 --- a/test/results/quic-27.pcap.out +++ b/test/results/quic-27.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-27.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00516{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-27.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388075915,"flow_last_seen":0,"flow_tot_l4_data_len":1338,"flow_min_l4_data_len":1338,"flow_max_l4_data_len":1338,"flow_avg_l4_data_len":1338,"midstream":0,"l3_proto":"ip6","src_ip":"3ef4:2194:f4a6:3503:40cd:714:57:c4e4","dst_ip":"2f3d:64d1:9d59:549b::200e","src_port":64229,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02233{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-27.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388075,"pkt_ts_usec":915836,"pkt_caplen":1392,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1392,"pkt_l4_len":1338,"pkt":"AAAAAAAAAAgA1Oceht1gB9AaBToRPz70IZT0pjUDQM0HFABXxOQvPWTRnVlUmwAAAAAAACAO+uUBuwU6BFLF\/wAAGwh7p3UKjzv1VgAARSBBNb8rxExjuvv1Ye++hbc9om0DU4NnwSG\/3UebQzKe+\/ChMR6f65IjHiAPoLAAXROmLqaJFJBg9Sjii5GNpIY1s7jLmFqalAiGP2eQLOW5rgxDWycwtAoSDO71eI9T1Uq7EBmGHvnPmeSBFCTAwbphrP9uMLPyAc17USwCikZDlt2XGVMfiXze2ila5iBclIpM\/nqIjbZDUUYzdC34yYbr54VrUe33DQppusK5QzTfqS+3bRJeNmvfVjhputwGoNup+0y7rJDCwpxgcjG0dCKgMjLHOmSc3TOXpHySWsU8YrZhzLttd3CTZRM5WZ+WibgEID8\/Y94\/jmGwbweD3Pfo3Ppwfbm6t+wCItY8yBKRQ+H5v5jedjzP\/LjrRtljajhGcJZd6HJgjueiAiaEAdj7fx0T9yjCxPVImLtLHfXPo558xAwXVU83pzT9xavzftzVp99vYm\/GU\/kg1VYfnH4H1qpMlTlic\/Q6Q8iLnCNGJ9LIhtmYFfunAmiyObADRsU4B6j4HoJX3if+mucsKdp+8N3ugLjM4uwUvOF7XyACDpCZ\/G3\/5X5J\/zKZkqDPUYvuluMsSOj8B9WlMWtbGerp5EjqolIlNnjYomDTKeHIxZZRBaJp\/QOHxqWVWl+MlH9KWaLg+UuJ1tkD\/z7oSb+H1aPInCB0q4IOfY52jC5M0sAyNUCCRYRJtlGM\/qM0P8wM\/vcpX4GIrlML77jxP6dU5SrTUTaXASv8j9337neVie5dGU901jPeI0ibTEPO5jmp5JTAiUrtWT\/OPLGl6+AqDrvj2iLYI6MfHf54Ll0eSJwKxczdOyajjbkW+wF4mDNBcrHs+Iy+NLs84KPkQaEHysgP5fydEh4OpzytKTjbeDrjBTG9KcUWYmBar2q8HpPFclPVfMJzlgzmG1ymiPOmBJDgqQ3ZUM2g855ht6g7tzCMio0LrDHG0qDTQGyGwGnOACHMF4aRlNBHHPXjD0AWFg5ITC\/muG1btVnHCRMRKjcJbcwgB5knd4j3yLyF5jIDRSKNhE6Ac48oXpl\/X8QX7id\/RdTdMTE+I9ImLp3efowsLaCMtmIEe+7JeD8HXS\/DHY7CcQC7QJJxTExlt1pZ1J8VxZQ\/Rin8crO7sCUZAX\/MAmOTczrCmlYKxmfZCym\/VBLaEls1IO\/vlhGhIazJ4ec+unaATLsbpA8gpl3A6fA\/mtphj6B2kmQmdb4PDBkjLGlUB9TA\/hWCdu8okA42ElpefKLs7iaYvj9eGjbpH4CtZIsn81hYHam0KixsLnFD01WT2G3jWF4\/p32XASEAIX2fGqhIl42kT79V0gWU\/zHFYX4d1dqE0R0QvDLgaBR5adJ\/AQSCQX30uHxQBsrPiDAUle40F0f\/CKLbXDtfvQg3i0EyI3KXCW22kEkJyctCWU066Vqsp6MiM5DPCQw20QD2L38WJTrzFxYD7gmCe1AwoQFfD6gqTnrS3Tj0ht5GTD8vsEYZ0oezjMP8XuBMCjClE8hToMxgRyaUKQoJ4zuAen+tMutEa2m48+u5jHJEJljGjHC4LHZWMR3906vXde+zdCg1ShHY11L\/Bz5vKrplIBCiT9vl3ZYNjO6hBlbKS8VP\/yg6gsLQ9AigFTHxstN+VusbiYbo8JJgQWEcDGy2dI9GZZqPmAAFQeJAEQIBnrb965lc\/aHxPwoSZtBKWldoAMiE22ownQezP3boCQ596Xlhlq\/aTLkj8uddR096XdeUuOzAUI7eEPdA9iCr"} 00787{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-27.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388075915,"flow_last_seen":0,"flow_tot_l4_data_len":1338,"flow_min_l4_data_len":1338,"flow_max_l4_data_len":1338,"flow_avg_l4_data_len":1338,"midstream":0,"l3_proto":"ip6","src_ip":"3ef4:2194:f4a6:3503:40cd:714:57:c4e4","dst_ip":"2f3d:64d1:9d59:549b::200e","src_port":64229,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"client_requested_server_name":"play.google.com","user_agent":"beta Chrome\/84.0.4147.45 Windows NT 10.0; Win64; x64","version":"TLSv1.3","alpn":"h3-27","ja3":"1e022f87823477abd6a79c31d70062d7","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 00464{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-27.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388076,"pkt_ts_usec":69315,"pkt_caplen":95,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":95,"pkt_l4_len":41,"pkt":"AAAAAAAAAAgA1Oceht1gA0UkACkRPz70IZT0pjUDQM0HFABXxOQvPWTRnVlUmwAAAAAAACAO+uUBuwApFwNce6d1Co879VabwAwUTyXQnR3t5SGvwZQ4CIrfkFTg1nE="} 00456{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-27.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388076,"pkt_ts_usec":81560,"pkt_caplen":88,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":88,"pkt_l4_len":34,"pkt":"AAAAAAAAAAIA6W2Tht1gAAAAACIROC89ZNGdWVSbAAAAAAAAIA4+9CGU9KY1A0DNBxQAV8TkAbv65QAixvJT4nwLs2JbuGwUn2PwacyNosM6UeSAkNAE1w=="} 02221{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-27.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388084,"pkt_ts_usec":237837,"pkt_caplen":1388,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1388,"pkt_l4_len":1334,"pkt":"AAAAAAAAAAgA1Oceht1gDrouBTYRPz70IZT0pjUDQM0HFABXxOQvPWTRnVlUmwAAAAAAACAO+uUBuwU2Dg1ae6d1Co879Va2ZZM8syPbsXCspbQN41glVHJVHAlKR4QayFu+64ooEGBAvsbCn8jPDFYncNADtTPv3asuZvQwLMtyR+hCJX\/nHLi6fraIVO8AAG0gdKiCM2xwF4t4DtsgF3WvC+kxionBGo0UshXoxep08Js3Xnpp8rhTL9O63UTuXknIs5TJ4VmNG4WOKJ2nNbb7DSGnE23WI02O3mt\/zI2zGLQrRa2u7\/Cf7QSnMawLIvFuubdQtbFVr3ZbH3\/VJxC0Uo8fqS+f+nUycibOzF03uqAjpE0+7jsdzR\/s0FaLYiEqzhPTVOdTvZHW0+uDaIi0L1XXiaL44H4ftqvR4ZkLqYs87tX8cGlVVb44oxQGUy2+qH1dY8LMiupdzpMCIQZkN96FbuXnJImigQaWL18KPPCU26rDz8x0z\/QbCxvNVh785gzW3sWZg4Vhd6Ys4g0QRB6WHqpU7D4Lim7aA0lRkVbs9Tm3smCV78GqlLKcuv\/LATc0CwL58E3puILDQn5COR9CbSxiT6hDKeHU7oySJ28SV3RUNIhwcYvJcj\/hz3w1rtiiTnVFkM1vzFQv5QLWZXZtFXK4OG0eXndCUFGc3Z5bqHStx28ewBEXbON+8U8loy9G7zZXXzMDdGp5F5wTsARLAKIGIVRNYoIyaozwMB6PpgXEHoKypd2e3UZZl6NBgCs9vUWAuVv6agH6u2dqIJKzgZUVv3C5jLPcm\/49skYrQBOVnTF\/VAgGfscx0aef5fvSGQMV1q5VlZZID8NZtA3EIMn3Ze5dGghaPfpEk58u7A9qXqLQaQxDJX9z2RgHP1YVvdITOwLj\/zBchuC92Tlw\/YkgxjjzjLZQc2Vb9NrOCJPVqJD2JRLptVYJWP43tlAKWxgZLoupXKKJ5e31jI6rVcRPLRu7kj4HC21B+hmVQbgVgZwKrYS91C9moo6ZCgV0Eg5bt8IT+Kqdnr8OoLz\/iPp+geQ2g\/Br1S3Ur1BFTff+VF4okLnpVbHwTyUlKI\/L7kauYykEC5xx5slsr1gD09C\/jI6ZmnMUV9DOwoM8Y7PEyV4K5MbJgbrkVv8i57qPHfcPVmzWgzfYXVsVEbAAcUEky4K\/eVzQ4efxFhzShdWM3hmvFmUJLmNczh431lTzD81m96N1fbOuSlQ45OT1Qyk1I25rqvAG0ookjSvHOKLBnG2+FaNx184FvguqIG0X0YSHOAVWVSRfK5emxBc1AHXiWutXhJ9PIMqqzmGDGUSqdh4m75bkEcKFVwTfjCPwVdcLx+P0uy6AVdZpTXt2Letk+D9MCCIYxfL\/84U7LhHZrEEG\/1LVU3Mn5KKTnOxYOE23i1CzJmAYiJF29J7OpQmaoG2\/tm8DJSYjxOgO0sjt19ggtozhkEHpounRlS7uU5\/\/nitU0qwp+gR5N1cRHHs06M3yRIAb49528nfAjgI8RNOPf6q2ATBVhV9LlPFxzhXRBUdqjesUgw5lGCzrXxP+1G\/yIQ9ZBV6RfRq+diwUk4ouIlXMEOPQDuifMm\/xmzt+u8bTYff8H79e1dD8cvE7ze6FNOtt67qe4+xNsln5jTrtIwas8Tm9H4uljGH3m0owyWvlAetbIFEq8NJyojv0Dj4R16WWUkAz\/O3h6C8rNIx99Zh3unIrOKEFfXOkDOrq6TLHbLznRoVlozOhvcdcwQ93IOtqHykPxljYVIhhzEfwh41fV3jbRQaRL5Rd7lKAIMYGpCdCw\/XhLSaACgfZHeiU+VHVxLMMtJ1aPGsKMZdeO7w="} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic-27.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1592388075915,"flow_last_seen":1592388084373,"flow_tot_l4_data_len":11807,"flow_min_l4_data_len":33,"flow_max_l4_data_len":1338,"flow_avg_l4_data_len":590,"midstream":0,"l3_proto":"ip6","src_ip":"3ef4:2194:f4a6:3503:40cd:714:57:c4e4","dst_ip":"2f3d:64d1:9d59:549b::200e","src_port":64229,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic-27.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-28.pcap.out b/test/results/quic-28.pcap.out index 3e0141cc3..fee40216b 100644 --- a/test/results/quic-28.pcap.out +++ b/test/results/quic-28.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-28.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-28.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591267474847,"flow_last_seen":0,"flow_tot_l4_data_len":1208,"flow_min_l4_data_len":1208,"flow_max_l4_data_len":1208,"flow_avg_l4_data_len":1208,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.2","dst_ip":"104.26.11.240","src_port":60106,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02022{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-28.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591267474,"pkt_ts_usec":847575,"pkt_caplen":1242,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1242,"pkt_l4_len":1208,"pkt":"7jdRvai\/bmImQfCgCABFAATMbsBAAEARSUwKCQACaBoL8OrKAbsEuILewf8AABwQgoOBp4aIL+MPCXOdR4KiFxRAxLpnL0UX1efsgg\/VSxB4df2ozABEgmEZ7SPB63FDIt1\/BNmaABrW7\/a2mJ6Qg87qxio5qp+Au1rZycjjs1xq27TUqOstzWUVkmwpCYXpvpOqlbwTvnFsXueqMWKDAlTPVsrztIv2pHHHaD8h888fq\/JGG\/YMsyu4siFFo62sUPCzYnviiGb9Ejlp4qwUTq4AjO99Rthdv2GbNC\/OStXSWSDjD\/leZL9UJEZcJ3LhlgqAVgxUVrxuE0rbeF3i8aF9iakAqxlqpoDj1+5t7ILe8xHKg8FUG1XnL5zpn1\/qeTvTEm18Ejt5DZJvb7rSMM3y0kFKOsdK3+oTGrisBL0Fe\/eBZ9f4xHzZvM5y3BCl2N6qMFMX+sMnr8ggfIKSQlAxo6qy68ZM170NeiI1bIaY98nIrG3zZt3dnHbbcgfFiN6lFzYaQLJBtV\/WEYTHy0okUamYC\/5cNM9tSXVBXfneC5HIpPjBuuyE4+LzF5EWg6rp8zulZ5VOTIetNIdJsnU+GlxyeY+BVtCQCCyWElUlL9X91YgIZ8MpCHxRq8ZJCkmY4nF34gFHgfsegffKnBAav99zdzm50AvMu4lP1B1F6cRA2HMPmAvCgUL1IKMcacz2eCZBB7FWHguZbpDdL2+wruFSVOAWeB+lE\/kuyF3MF8D5tAMKtEitOKdhqy3C3qGvZcZVGOZKPWGr2BC7JbZdFGIyYmNwp\/bvvX8XvDggJHwe6xhqAz5sua3BsvUJ1vySN4kKaHQ3EYKLbPPRjDwQinHrO49sFr8oWJyt7OK1yq06uwrlP3p4sqV3\/tL4FsOHtHVAI5LvRB8KISYciiug2cmuSgzkDgaTo\/e3D\/u+rCXDQ3xoip3ktBsckfTnGfFRGZIYxKdaQnHhOXiTzFQ6mSTNof1wHefWEQube1a92cmaAPSGQOt3LWbH6N8\/qM1mTakjE+QJv0K3HWVx+nbk2qFqJc+rHv1Ie37Z2+wHGh0NjwgX3P+8AdCqq6tgRzOpAdLNRrnirmseM\/zZQ0+cDRuw83pFP+UWZ+PCK3wKRZu1IhQ2h6D6lcGAbZA9ehc5yOvz0v1LsR84aEk1FsEGNTqF56I+GB\/2xRH4N5F5aeUjnenJzGpEQkofmIzcU+knq+dcQuuDHuOTLNDIaiPO+4HYzT5IY6vCSgCHcPgQVRcUuuSg\/GpGaVSknd81XIsamcRfeqURHQ1MVwmLxgOMP3+I5HFeghmJ+ki2zeRb+13f3SNlS\/RoVNOTrzjA86oM8wlv5t\/i38dgJDMR2ZvO+tz4iV7y7Y3T7RFYvvK2F7LLOH5ZrOKSeJb1SNqfpAw6nEHN8am8q6WcZIClcZqDQiuuDV2HpT1RM8QezzenJxkksNL2P07lZwI9HU4P7Ayp4wWZ6zeiRYoRywRS5R5VWfF7StuaGYuXatUeylxdjHJ8UwmFRvFoXP+8SlDa8jkz\/qhABAK7x0AzjsV\/3jzRSi1nVL9yl92ydFm7OXWFMLaMdafTsMx6SG3eTR9qPpGQqQKfrm9F1wk7utXsAM9DKqSLm\/MYVhMIgqodecjchaLAXg4QPX1N"} 00693{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-28.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1591267474847,"flow_last_seen":0,"flow_tot_l4_data_len":1208,"flow_min_l4_data_len":1208,"flow_max_l4_data_len":1208,"flow_avg_l4_data_len":1208,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.2","dst_ip":"104.26.11.240","src_port":60106,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Cloudflare","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"www.wireshark.org","version":"TLSv1.3","alpn":"h3-28,h3-27","ja3":"1e022f87823477abd6a79c31d70062d7","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 00453{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-28.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591267474,"pkt_ts_usec":879037,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"7jdRvai\/bmImQfCgCABFAABHbslAAEARTcgKCQACaBoL8OrKAbsAM35ZW9Kz5ailcaIQtAa5gzqaXWC7OfUwXJ6VLRyKaTyz6VcnmNQFy8EoKn8anQ=="} 00565{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-28.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591267474,"pkt_ts_usec":879047,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"7jdRvai\/bmImQfCgCABFAACabspAAEARTXQKCQACaBoL8OrKAbsAhn6sVdKz5ailcaIQtAa5gzqaXWC7OfUwfNrDJ9FUz7BbKMSk23g0f9C997D0tLAXYe+EfonSiyzkaksBoT3HwiNCgBof9\/w8PmqbAoJLS8yu42Ztsv5uMepcczJWBDOO+j9p9c5c2hfgENNoN6RdSpUcfcK291dLJxXOj1kWkm7z"} 00492{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-28.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1591267474,"pkt_ts_usec":892309,"pkt_caplen":112,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":112,"pkt_l4_len":78,"pkt":"bmImQfCg7jdRvai\/CABFAABi8ZpAADkR0dtoGgvwCgkAAgG76soATqcp7\/8AABsUQMS6Zy9FF9Xn7IIP1UsQeHX9qMwU0rPlqKVxohC0BrmDOppdYLs59TAWLgmItzxBSvZiKyQnISBjChlAVjqW7Q=="} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":253,"source":"quic-28.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":253,"flow_first_seen":1591267474847,"flow_last_seen":1591267477602,"flow_tot_l4_data_len":238191,"flow_min_l4_data_len":50,"flow_max_l4_data_len":1208,"flow_avg_l4_data_len":941,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.2","dst_ip":"104.26.11.240","src_port":60106,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":253,"source":"quic-28.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-29.pcap.out b/test/results/quic-29.pcap.out index cebcf7f18..1d50edb46 100644 --- a/test/results/quic-29.pcap.out +++ b/test/results/quic-29.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-29.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-29.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592171671664,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":36588,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02089{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-29.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592171671,"pkt_ts_usec":664832,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"bmImQfCg7jdRvai\/CABFAAUA8Z1AAEARMDsKCQABCgkAAo7sAbsE7BkSwv8AAB0S824HvwtwiO8oxx1Iisqv85\/8EUOUTtoYvrflSLONN1vzwqO8AES3Q7WQp5eFbP47Q12xYKXOiuR8OKc8Zd+z5\/wDTiaB2gylmmpfXoWWnW9m4cfo29uCTrqUeoQcDlNjFKjOZThrp+QrfaDvzF+TP2mbdVAn5DVFyc3TGw9yc6eNagzixiAUYroBLFYv1DYB54ctmkUUCF38C+LrP5XSP2Zcs3QEOQDdiNvhWKUx+vneyJD2Ddv1Of313oIRItyeXVn2LxKac2RjP4PRAhodOpWDrnkB66u8HOFxUv4Q9HU8anll\/ZatcRtN\/kzzFFzf5YoYXwbtiynEhfyRDYp9NIa5aU5ngHDoeAIY8EqAjkZzDBZrpJEN70XKdgxbZ09x248vkii\/BYPsm8gwjS+Z+NMDUp5BndSqJan6LYduiBKS1FQ2ECMHPifIAeRkFfGsYIjcHELHJvd3bjIuQ5jcLDQ11GM29Aqw0CMdlCZ0GZUFJPoOBYtbWkB+AArzMv7l1fpdC85LE6kYaNSupy\/kxn4q0Fd9nlOil4czF7np40hmUQT5zuUOIMe57G4ak0l7jLPPFgnjPcuJ5+bhZHgxqEou6YPiVeaRUocITEWkE47FVdJ4XctN7CMWrbtrVTRyiKoG5jKjipRDy+FAnWpWY5dsQU4VKty4nhdiXpcyaazCMiTBlzAZlJ+9vVzyUo2gVZTdT1AmyQCJjmCzYg+wq4NqxE5hDx4BVlFY7VlIfT+LOXZeM++nsIOJaY7JaSW2i+1ji7jGvwvZ+l6xB5JTnisqnUTdF8GRkRAiTg25HBspHwtWrq\/Po4lqvzDZYM3JiaCh5C8UbvK9JJyDT8vEGu5LZu4vyW+zCsCEy6HtYm+Tl+y0wBH9TYuhybK9k4L\/MkebKAkQQeZPvBNwHsBWnmGK44Fke47qlm10TFPJJuYjv3s2WkxpofqtAF0qtGkvoZjB6BMweDMLBzljRd+MpcpgKx6R7LMPjs6dfEoyR\/++4fMZPmZ5nKh9L2NomKnJgnI\/Q7cjkj8+4G7DpTq\/5CiPCn768EbsWDr31eOflbsg2q5K0cAqBbvuSWrrcKEWWT9pbchcsh+CF4s8+eUg6FJomv69IBBZDRAHTYWn3VGlccxntEoW7HpxMfIbSnMt1P6bfNeHK9ADAu1LaTZlKkjjmK+gbjyes7l1CGt0SYwE5uDE0ieZjOn+NT2n96TJjl6343hGsZGGMospEVXz6DJx68jscskAGRLftunAK4Wcrbm0MVyZUbf68HXckrAHSl5ZN\/gbwXjHwC\/6kW\/aiMNhQdY8NhboJQcKwTMbOAeVwKF1KGzLGKNIqA8cRIBh1T1WLCqei3k8gd\/C7bxKNgXzYeJGw\/scGAKCWrce0B8GF8XORgu1hVv6Mwd\/suBo\/oG9g9Uq0JP+2Gj4EQHkZYzIbeC00Rkd0VLJzec5p8sOl7k1oJ2JxQnDqWq6c8EgrVrSv8x08C46hCl\/izdOK7GvwGEQaUkOOkL0AriEREHoeCFJRFtP85AqwidJch8tbK+7ugQPN0bUklhiKNfnQ3Ch72i6f0K8Dx8w3Oub6KBk7WsmEtFBIijRDgwb5rVjtiIuJyF+6hegy2WW6xf3iWQ7NMMjWxMe231j5YtMgDPBTVbFARaKzxZnq\/YZAw=="} 00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-29.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592171671664,"flow_last_seen":0,"flow_tot_l4_data_len":1260,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":36588,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"localhost","version":"TLSv1.3","alpn":"h3-29","ja3":"b3e43d74f4b790abca2f5fe7dd06e7cf","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 00445{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-29.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592171671,"pkt_ts_usec":697531,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"7jdRvai\/bmImQfCgCABFAABDmwNAAEARi5IKCQACCgkAAQG7juwALxRVW0OUTtoYvrflSLONN1vzwqO8qoI0h6uPmj71ohDazgvrBpeEXxty"} 00450{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-29.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592171671,"pkt_ts_usec":697674,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"7jdRvai\/bmImQfCgCABFAABEmwRAAEARi5AKCQACCgkAAQG7juwAMBRWXUOUTtoYvrflSLONN1vzwqO8Bw2tbG272BFwPsChAYR5CNKZBI\/ZEg=="} 00451{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-29.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592171671,"pkt_ts_usec":699048,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":84,"pkt_l4_len":50,"pkt":"bmImQfCg7jdRvai\/CABFAABG8aVAAEARNO0KCQABCgkAAo7sAbsAMhRYRLjoRKWduhtWqcE2Jm\/Mgr2pfyylxXskvsjmut\/j6WYYiwt6b+RVGzFH"} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":15,"source":"quic-29.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":15,"flow_first_seen":1592171671664,"flow_last_seen":1592171671699,"flow_tot_l4_data_len":8876,"flow_min_l4_data_len":47,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":591,"midstream":0,"l3_proto":"ip4","src_ip":"10.9.0.1","dst_ip":"10.9.0.2","src_port":36588,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":15,"source":"quic-29.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-33.pcapng.out b/test/results/quic-33.pcapng.out index 9a633ecd6..7d4610834 100644 --- a/test/results/quic-33.pcapng.out +++ b/test/results/quic-33.pcapng.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-33.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-33.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1607938456563,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":51430,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02098{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-33.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1607938456,"pkt_ts_usec":563491,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"AAAAAAAAAAAAAAAAht1gIDHwBNgRQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAByOYRWwTYBOvLAAAAAQiH9eh3C8+VTAijB72XkxHdoQBEtoviUAck6tyLLoPW9VDwFsyJg3YOj5\/ZBBxoLZq+uwOezSI+NQXptD5by+TGWuPRPrDAYZviuXsVHC7HmqDeEDG8QAq3dV\/xeXm5rkywye7b+vdo1p1fctM\/Oux9r7eV+Bkfx5+wJ0fdvlhyFGnTrwdcg8+4C7doPPgPdg\/HlJ+WJBdBNlB5bMDPwE7kBX2Dh4rUsRtMuI8UcuXEYHPlESOyFKyqmw1DOdGJ\/piVc003W0\/LEq1Eo7qm+0VXxD0O2HOCIiEHQSR0LHjT1VxLfzhAmJaat83P4NhBjDwwPEBaziMk5Xx7FlGTbjmQXwNdCCRvlZwHV8Z1FjV1KFEWUlByB6YIRcrWgtYq\/i+4joHr0arERD7m6OPY7fw34Aislp\/J5tfwN5lpBEW4eq0YBQWIW+o0WsbDygLLOE8qK7VrIW545\/s6vWmiqY\/nX3eqKbXLLa\/FVUoUAYah6VY+54jT2WSxlVbjRbKzNCmQ7iFaNpCpIEDqRUT3251KkF2ic95oNqA7SdIHar3DhA1BLknCroi9vMu8dB8ZQzinHdG0dXM7MT\/3xjsj6W1BusBxpaKNCgk4AWnV4woWWMHuv3AkSN3SkyzvUkLVvh69eozjggDPPRwSQSUAzHDWzbhw1M0maJHN9uf4A3ju1BNcFXtgNbzbLvZ8jRjuvbV5+sT2dKCIGszHbDe\/k7VIj14F5Oz9yEIDLSjcjUNYxAEtmmIW3gkE0URoURbr4fR+9IcL0qzkw6dXZu343bgbz5HR6MUnSxTpV9fqwSf9hnrNjraoPMA+2dRpP1Zgg8SJxppmH92oRToz9aDvX2GEC3Onm3NhLiCy9XRFGhGu\/fP4euaO\/LhZROPQcNzbK0KhgrgIkbbcdw+GG0U1DyrSN2MCSa0G\/gdd0iXjRkpuSltfEWcs6h5VKXYCs0nARTLsAmshRBI4tBnyE8czB9KDGhDi69S4dxLc2GhDvI7sBC3oYplXnPFpYJ5UZlYX4x4JzCNfzPKJLkB1GZ\/\/fH4d4Bdn3o+N0leV4SXwVyj8+XQXm2lqcn0l4280XR1PY9wT7WxHSwRDVHU1WF+J6uEthL0G\/TTOA8IENfk0c9FtN1gtuZbVqEenj8UavApG8YgiwEFLw3lw7QwEpdl2suMFgNMJ9GKiLgGbJ0iDoFumS7lgCZ\/nQNWC5kLAQ+6RwzRxTfyP7COmrj9VOCl2+wDLTe3MfV2rc9okYbhZWBQ90PNxn4RsPjc\/Y6ROnBtAhNHbhNOY4vkKTiqPf\/zXa6gyKLJwM4B2ikSmnMEc6pOt0km1BxO3IMATJR3y2TyvQwDT4h3LmpQf0gEdwRzggs5B+E7eqr4GF3leCUThvLN07bE6f2xjlfM9GVfW\/hyXIlfEkPiVHs0uNEuAtqja9wjv+TVSELvsqoLajQtysd2XscH\/uqkhI80k6EzletW\/z347Tefjbi7un6kw52zxXR3upATGEcY8WECkFSms+LV3Cbtq+fVkM8LR8ZIcoDoUWH511e8PHOE07KwOpTJwROur3JKswX2UtackuKBEnRIb2VrFAu8O8Bq\/G9385WeZn1kznfucxDKavwZd9obaQ66d2I\/H3+7RezClYA=="} 00755{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-33.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1607938456563,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":51430,"dst_port":4443,"l4_proto":"udp","ndpi": {"flow_risk": {"24":"SNI TLS extension was missing"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"version":"TLSv1.3","alpn":"h3-33,hq-33,h3-32,hq-32,h3-31,hq-31,h3-29,hq-29","ja3":"0299b052ace53a14c3a04aceb5efd247","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft),TLSv1.3 (draft),TLSv1.3 (draft)"}} @@ -15,3 +16,5 @@ 01018{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-33.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1607938456,"pkt_ts_usec":568629,"pkt_caplen":501,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":501,"pkt_l4_len":447,"pkt":"AAAAAAAAAAAAAAAAht1gLBAvAb8RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABEVvI5gG\/AdI5owe9l5MR3aHaomNbo4wvz7hzOwX9pjNA4xG\/TQWWUW54pduqsedHvQxA5YGyeA+tqxYhFe2PybFzq50trBHfJppt7k8jEhdLWET1hKeQbaL4CGQZkk02gA2kObT1W4kh71yZ6H\/UhIL0qocGjuITvczTNvn8dRSWn4d3XDqFVV4MCpTZswXkaMMpQVgbh65\/B7zzGGjEbshtWV68fYH+fxeF2BmVLoOQyGjocnGDvhjDIiKTps3sAt8nfWOMChw0h08or2Btd69qbFvBb011E55FZ5IkwNCZllm\/H5QPwvDGydavWDiYc63lxHla0wnMPjNgsva3CDRk6EVzD9LGyLMYt5zQY8pbZjR54CyzvSLH1gc6pPm1RnNQJ1EVncilvVdxU1r019RFZPdjuV986n0eqe+7DqG1sJIf\/dsBshUgYi8dcB1tMSCxjlC370TVyBqP2TIzEASkxcjKeMajOy93XOip+qSK1cH7ClMER564mOuQwiZ84pcJE+WhYgPZQTY+TgJoEBvg\/8r8hmlYb+wFuFIGVvtPBTFKMYl+konANYR6vCKqgR2lEsYHCYd0Qax\/8c3T"} 00675{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-33.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1607938456,"pkt_ts_usec":569050,"pkt_caplen":245,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":245,"pkt_l4_len":191,"pkt":"AAAAAAAAAAAAAAAAht1gIDHwAL8RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAByOYRWwC\/ANJRO1cXCNib3PtKqOt8xfy0EEzcOeXpnJcVJZnXfJTiHG506zQ\/okpaI7L1NrRKeH6vXfGArfQkrjS6nu6vN6zNx\/r11pwwpzVuq0ivx5WaY4QTDIKqcrJdMdK9tA5EuZmZ6jD+Wqq12VM1slAj+PbuvLGrsGfC8j2IFoNLQsmBSije\/PdyloR5Opduno6mb+eE3SMzn6H+sqZEDlLiHmhPW4+0yBfbKenzE2barFjKhUz7qNOqP\/M="} 00499{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-33.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1607938456,"pkt_ts_usec":569159,"pkt_caplen":117,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":117,"pkt_l4_len":63,"pkt":"AAAAAAAAAAAAAAAAht1gLBAvAD8RQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABEVvI5gA\/AFIRowe9l5MR3aF28MLH\/69bW3jeVbEpPKzZTDZSAWWOpkR3naiJgy2c4GBD8Ud7hIzlSuhZTuEf"} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":992,"source":"quic-33.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":992,"flow_first_seen":1607938456563,"flow_last_seen":1607938456578,"flow_tot_l4_data_len":1287154,"flow_min_l4_data_len":39,"flow_max_l4_data_len":1448,"flow_avg_l4_data_len":1297,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":51430,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":992,"source":"quic-33.pcapng","alias":"nDPId-test"} diff --git a/test/results/quic-mvfst-22.pcap.out b/test/results/quic-mvfst-22.pcap.out index 20040ea17..d52d14028 100644 --- a/test/results/quic-mvfst-22.pcap.out +++ b/test/results/quic-mvfst-22.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":24710,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.13.86.8","src_port":35601,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02053{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":24,"pkt_ts_usec":710880,"pkt_caplen":1274,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1274,"pkt_l4_len":1240,"pkt":"UlQAEjUCCAAnANMtCABFAATsAABAAEARtN0KAAIPHw1WCIsRAbsE2LapyfrOsAEIVt4FS0mAWdwAAES+glHsK6O\/Oq7IqxunKa1n3XFv8eVEdrO\/buZ2LMAVEB2NyWCg6hfO6EP+vLVLmftkS1PJQqVl7L+7l7BI482Kpj4ofT9JnOQ0xEE4Vys3R4pwXiPc1lMJx32RX9zKYm+Z1fbMOyayi7zU0q+i63OayYrYD3jSt+Vvv7BMyIgMJ2yBRML4Cvl27dkQOy02PKy9hJb4U9IakyZ9jxJvJUG6tfB\/LJZUaX2z8xaFt+J6lEY3AOj1WgBxHOY78xSQcl0cfAaJSIKcA9Vn4sv\/fiPAKil0a5hIx6QXM2jiv4vFSqcgQHPhjbxlmksCUD71+BcElvTx09somsejpTEXOX5DumiTu+RmoxzAPxad\/yoHUmpVtJwSnjk0zwlToGO6SDPnEODnYt3LIvHRsx7mnFExLWnr+yQHfYFCeLNMctGGZBMubCx4gjt048OWguRvM18ud1xw3iRiS5rez8OMJIfcMnRlbnJA4MyOhWSWUbuYwKHXBZjNJSArgDpEssUAVBEOZQpnBVnXDGsqdTXz0eM1y7mnenMoiYqQeMnNMBDyturRKjEAiVgPEzOZ8CufggYEMfnAHCuOwF04gvqplTrrZWKOSNpdQNeFrRsWk7y1RbIKw3b8jWOTzA\/3wnocU7LCIqLpjBDheYw+YKL\/QStNjvcf462QDT2fMTEzd2qFUE5\/HIdvgFCjr11QAYfzSa9caF4orrxStMFBMwLrngiPEoNK2oL1ixSvqcDH1eCryay+ufbCfgtp9mN21cP9bS1fp+KOtJdRjk+WwIrnLE7yFL2kPl4Y1ub8Ic+0DgBOwxUrYa0lSq611ixLqvgBVVHqkVlsmy5FzYlt4nKwAzaE+UMlVSse0y5ciP9QYj7PgUOQsYRJLOdnUB1nb1cLIVzISsr9mEOc4Z\/V5yQfx0Je4KZnrBbnTxqzPJmczioPnEqWI3SSJQvibzfqftopphp69YYIvmngwQ9boqS8nu\/0Z90F4tXrXlEqVlkyt8z345OCJheKM35O3g1+gtDgXes9IlOq0VZHWc1xWYAyu3e5lYps9GawHgztTKd5Dh6phItAr7WJdjC7E5+Hw0Djk+jR2QPNAEyXNvBFWYdDCSKqCL0EW4k8u46MkhLkYoD\/U5LiEaiB5YSuGX8HZDJEwdOPPEWcT2hknjUDiQIy7tuEeBHkZxly3y9r8TtSEnAlDGbBVFAT+DI1sU7ifZHKOelnaNbzJX29JqcLfJH6OdFC035GL8QU1vvk19qbGftY3DBf6EJAhrCyEG8T68nr4mpyNVonkDSzrMh1qFjIZcwFXjgWWM6+wxfrI7EB5HOgW0H2RU+8jBV8bTAp0cYUEIW83AlhSIGJhaN4hzo4QbiQ\/NEKSL4V6HA7r2y3QQu7WQiGeuhWzieHC\/re+NOqmY8UZ2Nbtc52d9K25gQKE7BXNhq2zsjuIhLJme7BBI75RlEqF\/camjLVcquotPgLUp7uXIyomz0zmkrCGiGxy4HlklTCcE1ashYaXZA\/9HX39Pj6qB+WKglzfibh+ldNWXcB79RaHBC3E7rGwoRJM5jkaMEkWLJVppPuZZUXD0CLZZ5SItvsTmJ1D5A5i3llXNLFE2q4czLsPbe5Ft7r2t0="} 00711{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":24710,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.13.86.8","src_port":35601,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Facebook","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"graph.facebook.com","version":"TLSv1.3","alpn":"h3-fb-05,h1q-fb","ja3":"a3795d067fbf6f44c8657f9e9cbae493","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft)"}} @@ -15,3 +16,5 @@ 01890{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":26,"pkt_ts_usec":834454,"pkt_caplen":1142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1142,"pkt_l4_len":1108,"pkt":"UlQAEjUCCAAnANMtCABFAARoAABAAEARtWEKAAIPHw1WCIsRAbsEVB7dQkhjA85S+SrVOmTjyQAGgYMcFSCiIDRU3Yr5wOPFMVlAvU\/K6Wr3CXIaP0cXJ+R8tyJjtHKDEnswAxAW9ujcq6Un+BHUeMIlwUqlMt5dnLJY+ztEuuB40p4o4ZnUfe6R6fCTPQaU6UvlP1G5kwywoeswCziaxdjEEinDz\/gGCUGgBa7OgPoIHh6WGy5Jq\/yDSyxbdZbsf93LRVNy2Ggnit21Fhz0YWqDflukpWp1VnXfeLl4lXjV02bP7ffk5+8Qer2NplZ\/RVb4mAEPIdbfimOcQt6DlOWTFLVZVVdDvOheTVxWz1imIrBNNG1tryn2CNO85cQ525pmOTiepaa3cI4lrQNyUG5EQUT0tdBKht0+gJ2doQDSTrSFw3G+fBTWu0AWfMbnlGO9ypwCCuiUw1jfZLDbF9HPpG2lZBIZRkPRm4X8cLfNx+W\/U2nH1gl9Hg4q2r8J9V6c+Om9R+VCzUsr97BQm2ggblRl2857xTAuPptrFZxjJDYCft54Ldm3Ft+4YARQAl66kGCiI1pxL4N0eBPekc8roAiJpuzCWnRCHwGHWp\/uIJADdNVBDTB1mF\/woWpToTvW3NGTual\/vx70hQTs+QgiIF+osyx5APHU7iMhvot0\/vtEmxGMfELPII+2iBZzyhQhlLJ\/vlW2WhoHSwDxq6Cc1beESGlgYzPm\/dvpDFQ99qYDtLvjUFPeGmdOJsrXoBNOp97t7sEws8yqoFLW5vGkj4ZY6ddO+emVWc3YWtYy1Sg65XHoYQ6LxIvMz5WYebk\/Tofl++nLu4AlvAM4EjKn81lPtSh1Hru9SeNVeRhrIydmlseJoigLjo6dRaZcDOrw1fhX59LC4XA10BF2nd2mYCIN1YVeo\/DGoHd2Du\/MT1KFK1fNAXQ1yR1OW0kmA9WGVFYfLULxqUt9VybRd07gqIa05SMdWOH8auNI4v6+lsOdgY8\/k5DCyPza11DSYOMhIObvQ7We2rRSoznPcGyZD1daIDUlTui6EXJ8zlsdH\/ww8qCAnbgJs3mlOdduLSCypkMGVumajfhmsokvKSu4I5YkfCNQtzI6wIw9tIjDs7joPeghDuql2at4r3RCkmvOnpmYc8aphv1doppEuE+PYP\/cm6nRhVrI3qf2MDy\/pGfMqBIdiQHdOaMNR8OFXMS492GBNpfVKyI+kNDCmKG47Ihh+AC95Mx0thgN82ZrtR1eWjnhQci\/9Nt0u9itothJJyJ86GXt16KvNuy\/n\/\/8TMgJA9C4lX\/V4wuV5fK5IQE9s2SCVLvza1tiSReT5H738YXcNuYnolbB\/Mn+YnSg3lUo3fZZfL+z6DYneOLeMG3FawMuDMX6q9fVgM4iGXDfwm2nr+GouAmzP\/WvaINwdvnYiGLLZllvrckbSEbqd6f\/ocg4T6nzfpvkTZ81oob2N94wjwyDFAvLYfGDiiGgsimERPCXE6qIkuQtsvMXPlz3psc="} 00431{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":26,"pkt_ts_usec":840689,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"CAAnANMtUlQAEjUCCABFAAA4ADIAAEAR+V8fDVYICgACDwG7ixEAJG\/EX4TLOAKrs2dYIXyaoMAVOW1pFSg0o2kLbbCIew=="} 00435{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":26,"pkt_ts_usec":865094,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"UlQAEjUCCAAnANMtCABFAAA8AABAAEARuY0KAAIPHw1WCIsRAbsAKPiYQ0hjA85S+SrV7ZXz\/rdFh3Bql8c0WhU1o790KTEFQHs="} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":490,"source":"quic-mvfst-22.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":490,"flow_first_seen":24710,"flow_last_seen":139922,"flow_tot_l4_data_len":271643,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":554,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"31.13.86.8","src_port":35601,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":490,"source":"quic-mvfst-22.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-mvfst-22_decryption_error.pcap.out b/test/results/quic-mvfst-22_decryption_error.pcap.out index 5134b472c..51b078022 100644 --- a/test/results/quic-mvfst-22_decryption_error.pcap.out +++ b/test/results/quic-mvfst-22_decryption_error.pcap.out @@ -1,3 +1,4 @@ +00407{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 02021{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593498296,"pkt_ts_usec":832000,"pkt_caplen":1260,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":1260,"pkt_l4_len":0,"pkt":"RTgE7B0GAABAEeVBCuYoqF5h4ZLy9AG7BNgTGcP6zrABCEACR1YBz3h7AABEvkgDSkdXT8KDRtZ6SuR9aklyes\/l4Sioa5nXAcPGveAb5Mb0k7uBERsrnzBa9uno+scwKQJ+8HaE7SwNRWaJ0B+VYq5sgzaHE9BksItfZB05b19PkWz3XaOJPeabOxbegkEde\/7BgQc2iMQiMZifq3YQkFbpelKpfZ8UxZbKFKO8T8enNpDFvm79StOLsc58r6VUI7R7RX2Dh+7UvHc8w55LVS4nFdKyvt+gLMAzuTrAqSRX04ucEX43SZLKcpJ+X+iK\/v9u1yLmGT\/8hHS\/A3VBUuWVRkAqUr3zRxflhV5CjsXky9idxKWm4C9Pn6cw4624LuYteYIUWOTHQHv3zV5\/rnXQxed5aHO337llijw0yLFxpnpOUEtoxTKtZZeNyR3\/hCIkY3n14k3gHfYXZl5t7DMoJYBnIHHhmdFCOK4sdCcKtpOlPKhDiv0BdCMImPxwr5CZ3d0NvKvNFKbylEYXGyw6diXHrADpP1Bpo7IsDo6OECekYHLzamw7fo5GRjTg4wyZ585sRHNOY5UQ14urjp6qTgyJaK+bJQKQXSG\/jPsJRoA3bT9RYwhd92VXr\/SRpMsMI1dgiAabVuN6aapjwqQ05GcX1xWXUOswELHBWeda+RZSG0ealfCxTmgk\/LmTIARNNTXtxke0sf\/IlfnV3ikcr9NqDIrI6of1G3cZfUQGBWE6gBVL5hH\/8pDG4T4ZpNiYz4Y0kEK9VRD1GZ0w6BCqlt\/kg2zd6ahgaI4n0T7BllqMO01YZ1t9pyXJShYy7a1\/GE3TCKsHNgIVU+OzGaBubO2O8foCsTRqluuqUPhG3n2E8MHmbHfrbqadkpRwbm5mHSUiRHvHPOMZ3uD3xF6j764aqPOQrl01dj1iQP+qGIcEY5l4ogPeALtV3hU5f7bpvLSDPKVoHsWvz++bxVzr7sgAnGREUzsxKt4SUYuRzz53icFmvd9rxNmgOaF+PEw\/dQIcNJqpxX8ulzLr4tUIjHsZy8Y3w0WHWlRvXX5BFt\/FNL6D1z9p+LMmNXuSPqVvh56LVqzeEf7uD4SQyYHHodFZUSZh4UJZfGLFC0eeFNy2qBWMNwCptrLdwN5PCZlQ07ewM1OmYFXib\/9zYOSk4B0N24Ml1I3V+BUt9Q\/f7In0Lo1bYVhzoFFJnm1wIhEDEaXvsKWXwZTHPIpl1Hz1I\/6Yq3hsX1N3dtM00S1An2mdoc9+06efV9TeSDkQwX8r+ZabNOKTRtHqXDe1Wl+aE\/ZahNHsuY3HnDuGINcHsBCTv1ovOmoDAi0RUdYM0lPaGHSMu61RpKW5cRQ0Cdy0+WZXfm0NBcMkEOs1K83zDl3Ni0ybs6vWiqa45kxw7H1vC362nLorQvhZdy7wTrE4RWiFGT0Xccp4Rl8QprALjpWqFcS7MPnifCUJZzLuwLuogz6ePAO7YscFlIza4b2sSjihSJrD9QLuOyhifjzSEn4amVk5ivqXVE+QZ1R7NVlYJU0wlh1SwakKVblsHRVpjkjVrp5to9V854cET1W0se7gIi2a7oXoLvW8CT8NdthxNrd\/AUaazo7KSGS96THBAG+HmraPSIMT5EEnSDc\/KXc1EWvMFe0xKOugeQC4v6tFGa5dLsgNI0TE"} 00182{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","datalink":12} 00465{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593498296,"pkt_ts_usec":833000,"pkt_caplen":106,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":106,"pkt_l4_len":0,"pkt":"RQAAapbBAABAEXBACuYoqF5h4ZLy9AG7AFbkKub6zrABCEACR1YBz3h7AD4ztLOg+8\/NWUDesKp0sDyq9wl\/qnK\/iaP4qknLwsMfEkvd24lrwL0JnOo2eK80vHLhCKIp2AiTqDI94jB8\/Q=="} @@ -704,3 +705,4 @@ 00184{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":352,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","datalink":12} 02054{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":353,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1593498297,"pkt_ts_usec":36000,"pkt_caplen":1280,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":1280,"pkt_l4_len":0,"pkt":"RQAFAAACQABZEalpXmHhkgrmKKgBu\/L0BOxzEVh\/\/F+FsvgskZSJEq72gHo10TdgNOHV3qtvLr34ysT4\/BQu08NXy68awukgm428CY+3uFIa\/SsYHOQWYv\/6hMCX46sHEfK3FsGd9B4aOMTDZmbct0Hi6B5hFbC0RysqpiuCGv72ybkRYMTkkmBSpKkaxMd628mXMhcYd517jH\/CS6rxLyjH721TKnNGFMFZJpKZW05u1pmo9F74UGjuzXEO89ZOXqanGwo8ZLmQTCj85x1E1RZX9aigKv5BEr63ws6yLhHIXtPDYscZDNmE2ULVjoz3kzJuZzMzTW64HxXlwsMaX6uzVAwAX\/DVkW2gqZT9R4oqnG1iUCq0cb0MR6letAQ\/fU12ToEri5STxN\/eLewgY07DxQqjTUjGstGtGCNM\/FfDTgRtPzwTJZih3hD1CfW1YEkB9tXv3wCFGUyLRPlE7MbrU8qTOcUAn41czqUHKXgJpSWqjRlqdsmuAgafgOGhqdjw1Dm38vteZONnaZ0QujAZ7ZN3UoLVU\/0h2yR1MEUH\/ATH25T5lgD9ffI\/fHDa86FcEH0enSe06V9t2jUIcvqLGVwSzjxtjTGJjrQ5mZ9ZuX\/RsW9eLUa5XcOl6q9p1sCAM956+nfVkS7tt1A7eldJbVXEI+ZcnDnBu\/HfhQghjRReyowO0uY88d1b6J5BW747Za2CrWV3An3xcrcgJ3r7Eegcow70EpRrR+5W8ayOPOR2SGTCLovooCpYeUYQ6T838f5KeN4CcXxx7FVrW0hCqLV+HJCGz2o\/AeBkwyRwIR35fIDm64HoUOpCMEB3l7n2WMd9lZS2DQtlFlThLuIymsnTAeZZCutQ7DJyF72B2wkJ9WAmyRaM7Nq+x0zpTQHmxR9xaamH9bBNq6ua2oCT5qfTkzoaG+IHmszzghAt5peXz7eqEaFqSW9OSi6Rt7nXeWpRnZS0xwrMxUtgUDclrW\/KBEJo0yZx1nkaOYHw9iwtzDJs2GBWmR94yQl7wvUuGIY6KjXTfn457StRyrcmSAcZVTUGxz7jG3KLfU2hiD2i+hGp67x8HUPue8RVimCp3M+CVhljP3AEXbJYiKYJq17hw\/NXXqU+vH3l4Ac+JioVTo5Q3+FwrWO7xRdRizXH89EUM4LwVRIVqhBY5DmxiNvI\/yxCgFw19mN2hP7yR4ixoyVHHevKc24iODyxhVIi2laJWFJ5DG5knu8grskOXH1flWjfxJBK\/\/3jC1BdMicLllb+efDa9SzMy\/3dPDg61ZXUXioRNvGC9lAdQLPrOxjvJhrN1U4tovGRi4vfa\/M+cLnYZdFxrakeiE5p5Ge8ewqhhgDnypGVxiKqOhWMtyl1pD7cCSKY+KDEUtztnzSKJJP5e5q2vmnfhsLtwxqp4YcMsGrDdwcy+whkFVB73zRViDcA8nfxNKx3ksom\/BzlnliiQ1AdXWXCf1pFpesZUDEc3UwYuqXdIonQnRDiCYrlhZ4tAO39+6nh8o7UbXxKCT7JVAC8TwzVqp8T9mo3m+mofsKgSIEYSKy38vRMDGMM9v4WJ+IK5iuL78dmEipzGMd1w89fuz3c5cxVfZRr1V7++wg3gzWDHZREzG0PMXkvJzh3OJ9rs93FmzU64537zWQLvOws8sCivE3d4H+qISlUIyJMOC5xzhRlbFKhIzWtB8ba5COlFqmJ\/NM="} 00184{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":353,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test","datalink":12} +00151{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":353,"source":"quic-mvfst-22_decryption_error.pcap","alias":"nDPId-test"} diff --git a/test/results/quic-mvfst-27.pcapng.out b/test/results/quic-mvfst-27.pcapng.out index bfa29e4cf..68f984333 100644 --- a/test/results/quic-mvfst-27.pcapng.out +++ b/test/results/quic-mvfst-27.pcapng.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":41432,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.171.250.15","src_port":35957,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02139{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":41,"pkt_ts_usec":432902,"pkt_caplen":1326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1326,"pkt_l4_len":1240,"pkt":"UlQAEjUCCAAnANMtCABFAATsAABAAEAR6jcKAAIPRav6D4x1AbsE2OWQzPrOsAIIrbuyBEpv1K8AAES+140kYx8r1I1jytRmSbOd1I6+euAu\/WCog0hZ7CK2vbiQaDsUNhduZ4TaOU+YwMwzr4tFRPY4WVcwFZYxf3JpeyRLGb56IxYnrJ+wVEN3bI7bVdKHF8LObpsuaNgGvwptfsH+rDACd3BONx\/QShlSNEGgtojOTAb3IBxaMPoBBrqk2vcqdCneK9x+zToW6kQDTdEd1IieGWgR+hdSwpMJLkz6epIDIJvr2+7hnKY8vsay1GJiKAlvxUurjQpspuMDfgvdh0iM6M1FrTv7rKzGyRXK46jvoMQof1iOAPHATgwqM4ZuYMuNvt\/y0p1tz148IXIa\/fLbIf\/jtx8RB3egC2zhGA2mbRbaurTTw48eZ\/8+UmFX\/pGgD39VTuQ0iy3fwQ4KqkHSAZwYDfMrqtGQuy3zdVoOJcB1EfGcQ\/j15ErCmDlRT7vkVVWnNzp5ac2qQ30IkEy79yMP2uQl+qcNCK7LBv3ES0ZAYMoMzeMHxcHojmxmY7m9pU8\/6TN1mmhBOL55YskIGgF5b9dubHYOHRFbIoVzLmlUMAC3n\/J8icXYhMzF+2LMmkFk5V6Ftpg6RFwazyDsV1VvAG0px\/ZReUsDZc2BpKOvPXUMcmmbi7J+4xk79GjDWU7qn9No\/9OgaUBSqlTMXjLKVw1AQS9DQbbP6Ljm2tjkBmxsNgiaX3ZHZdlEZ39g+pfa+C3d0\/Me91SnnyzofgyFHFf\/FZrz8kZlG+cPy3y6jToJU9oYVkDn4scTl9+EJRhVW2fiSh2BpNrkr1jxBS6nl0AbZVVuTjZo1emeItVe2pTwk9uLFdXZ\/CsWVBwjAwBQ8vxgzBGFWe9Cz3WpWkEzkAzQeOKzfLIFJb1PdMquNCwMajA4Jx\/Cl8vTf2306+VAoELddtYLnop0Ayp+TxS0Rn4I5pIhgtvtCnBaEOMmPLVrk2Tj6N4i6o4MT6NN2UsGMhl2jrLGVEchP8VeBBOrUPQTIvY+Xm1UQd6ud\/GSXz1lmW9JWN\/jvl2VrC\/dEdNNNDsuFT5DVQqiDS81yxHlMqpnUJtGOqdXBxl\/ipvbbIFVJMAxqaqhOIq9lLXVi0WRSrle2jY8C6byBzVmaXR9ob+Wj5JgOJ4dl6+zmTJfROyutrX06SLZW3iXBCGlGsJZa3VoAGsKr8R2PPaQW1IM5QBB1\/g3l2+\/8cMTpVbSj+AToLePRXNLpaht6\/i0lf5tmm5WeIZEw\/kp8XgE1IVG1OwCHdXi3LW8Ju6ZT6+NSDZYRl5iCIMOLeH+Uqa7zxr6BPSdijI5fZHwJ7CyzIIsLtNldUOOeWaUdszlpTm5UglrnEBk\/8+KIWEVomulKHSD78LbyMa2ZwRhHyUIoQUx3u628eG5WvmgiPmoWBpQq0SAcNJkibSZlfyukZBXk6ytoD7RL+6u7B+gDbgoIKW3EI2Vygx0786PDvzKNz\/jICcqh071958oOMWvZwK4wNNnPl+hmatacx8NLqlbU4\/qy23i+aLaPb\/wBxpmPXyakND4mOvFt3dmh\/yOVbINbAdZZ958R4K\/VXTGhgBSkxwXbKGKq+I\/xQwGAiri3PaDQBO6NYoKc0jqzc3rTGw44eUPJeiqQ8qEhbvrsfPi3A+VS5FRGlwZaAkkAdoB2gRkAwEAAAAAAAAAAAAAABYAAQACACEB2gAAAAAAAAAAAAAAAAAAAAANY6kd"} 00709{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":41432,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.171.250.15","src_port":35957,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Facebook","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"graph.facebook.com","version":"TLSv1.3","alpn":"h3-fb-05","ja3":"61d8a93ff379660087082a82411f19a2","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft)"}} @@ -15,3 +16,5 @@ 00800{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":41,"pkt_ts_usec":489979,"pkt_caplen":341,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":341,"pkt_l4_len":255,"pkt":"CAAnANMtUlQAEjUCCABFAAETAJEAAEARLYBFq\/oPCgACDwG7jHUA\/ze5TUhfRxauwQKQESXXOvvEIjR2c8gFVxEbYpp577YkVedjPbjQSiPNnc6HsQTkrUp8ZSlihItxMehqvAhublRP4zs7BJh\/g2kUttS5VL9h4Hb+AEJkIxmCidmdB2uCbNTjCjcdIX1vHMmtuzBKPsBXv26XyXN9RJL7GpiZdtfRYlT+Zw925d9XFS6vfjgVugKjGmFyhwBUQ\/jF9LrfgnMAAit6ItpALlCngKESJqrSw1xGqFsB1YVaBKcHjoITDK5fSUvpRzvQSsllaul2GEdUx\/3Wi67MB1O65clVL2SBHCW2QChDPVnTnoR+6n4CAsaT1QWNmSLGnBloCSQB2gHaBGQDAQAAAAAAAAAAAAAAFgABAAIAIQHaAAAAAAAAAAAAAAAAAAAAAMDh5wg="} 00511{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":41,"pkt_ts_usec":500982,"pkt_caplen":128,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":128,"pkt_l4_len":42,"pkt":"UlQAEjUCCAAnANMtCABFAAA+AABAAEAR7uUKAAIPRav6D4x1AbsAKuTESGUZSqSBwJ2mMk6Nt0Gm4aLYR2aPxthlM0NC0+1eF\/tZTRloCSQB2gHaBGQDAQAAAAAAAAAAAAAAFgABAAIAIQHaAAAAAAAAAAAAAAAAAAAAALvDf+M="} 01870{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":50,"pkt_ts_usec":309237,"pkt_caplen":1133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1133,"pkt_l4_len":1047,"pkt":"UlQAEjUCCAAnANMtCABFAAQrAABAAEAR6vgKAAIPRav6D4x1AbsEF2uFUWUZSqSBwJ2mMcfPOUKudx8IIdHFM+KYJWQvGFhfEc+0DxpgsTk44tZtXhYT2vNYWnzuIL1izcfXlPisguidPmO2DqtN7xgWikzAgQY8F03zNKDzWAGNqzF+LwWD+XTBieSsyeSBANPhvyxGVuE04HB+E00Q7ceTw8dR+xfDxfHvwU9UmfDZocpLYx377vu\/M6kJ\/X8XH5pcrTmMfFBo6MSZ7Bc7jrGDWNg3je6LONHE93LfSwNV1LIiMYJJybwFgfl4G8+uIwH4zKgX4UzCKwFaitESJ3\/P0woXSIe4VhcvPOZCqKbd5EXS7ylCxgNR0CAaLPbHtRyowOgRxiJeeoHGEq5zwK9u5Ee0sARBdMz4uFPT3KAMyOerg36WU1qYHYfP9k6jgIXTaEDFLgtpmuh3GDDch3UKt8xAuikoUDhknxmxc6aUubsklPpCltOmm9Woi9N7qceDtuzlf0WZpEYZC5QliXkSyp70lnKWjAuMPEDhtundmLlompnxrMRidleKKdTtuo1l5nX\/ECbozZoAv4MuQCX9YWYSMjv0u0uUT1c6uvEu0d51yOL+s9AV8pKlvk3MLKn0WgC2YLCcjG9WYhSMJ58b+84ZaBBUZ3Og5qPYcRKEdHAAa0N3rFC78EoJApuBItaIZj1OUUcwcBvGTJ752ruh2TWzG4VnIM1vofvYSAkxeeeIf+Ua5J6Ak2MKIA79HqfkvUrxlhcca7VEuSVvoTOWM5i\/I8cMfw6y2avOBJdbCtWDM7pY60Rwt5B5GdifarEN4OcqipbPZLDax0HccOkJJaC2pgFYW5brOiYImYlxggdctEaB1k0DPifMZQ+zGgB7Cb0H\/zZsPJkegDkB+kVN1iB1n6nJBAEUjI3qTLmAy68krMF61lsL0LwNoBtIJnEklxridi3Hae6kz2w0pbSJMDpPqGcAMCgz9XgWU\/lbULK1TU5ov+2bFyy+yI+Cf9B7yUUfDLkMOgEVwdra9DpaNhRAK8y7ctoft25rY7LGurcOG4hJgLAWwg0TenWVvjqlWP8G4JwMRLUK6GmeXsem6rYz8wAml+y77EXDfzohoNACzJoBo5k\/NxeSRif9VK9vJmx8uvrFfptb\/TY2HPHPvXYBhKLbdDnKaGfbOL6KeOo0pQhT3NUo5NasuPbGn9valN\/JkvdIRb1qZdXPZDXvNJNCgdwe+CjjA9ks9mo1Oq5oROlL4NzopfnJ6UzUYHRuFegfbmZnG81daq+iJEfAicFte2S4AB3XHpsAdypFr\/7g3vbSHXA1dE3\/ZmxinbKy9yb2dR2\/YwaQL2ZeNv4j3ghJeBU6mtAUufHJX\/pK3RTdcW\/lPWIACQf4z6pCDcEKG0ol83FYIOJxgk3y9h66neuY3f\/zIBloCSQB2gHaBGQDAQAAAAAAAAAAAAAAFgABAAIAIQHaAAAAAAAAAAAAAAAAAAAAADw7OGY="} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":41432,"flow_last_seen":50392,"flow_tot_l4_data_len":9679,"flow_min_l4_data_len":29,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":483,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"69.171.250.15","src_port":35957,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic-mvfst-27.pcapng","alias":"nDPId-test"} diff --git a/test/results/quic-mvfst-exp.pcap.out b/test/results/quic-mvfst-exp.pcap.out index deb7c77d9..18db60e3b 100644 --- a/test/results/quic-mvfst-exp.pcap.out +++ b/test/results/quic-mvfst-exp.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00535{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1600365863681,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2aac:cdf7:d506:7807:9092:75f:a963:f4ab","dst_ip":"3f65:ece9:fe71:6e2a:face:b00c::358e","src_port":57587,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02107{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1600365863,"pkt_ts_usec":681233,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"AAAAAAAAAAsAUu6Rht1gBpyIBNgRPyqszffVBngHkJIHX6lj9Ks\/Zezp\/nFuKvrOsAwAADWO4PMBuwTY\/EXK+s6wDgg1+NsuZhAnFwAARL4kVSVotvSiGmEI+vf+6CaV5hF7i\/CNKP0SXP7gxh\/sxeTenPB321XyE03WMCMX5b0eBa3DvRz2ddP3nWt6RdJ6WlZ9RTUGfAgTt+boE098trxFEsZIDO4\/DGShxxtoHXyvbFJFZJY0NVf+5UIwrXhHYlSki1K9uuFNSNm\/ALl0YIaUgr\/hopr4M+GsiGyiXAxXGDCmRgFFJroypQa7DZkA\/BSQvOBo1rqXUCQO+Y2WWIxccuRC5scGp+LAauwOKvDUuqswyG3OiHxvk+4qy\/tgRCHGZHD5raZzP7vxY5Zs6GXSOIKOFNW9+pK0jmGVAbreKgkrE9sNhCR5J7EDI\/UBo5nIVV7hZ+6dUskPxqT226TZBRzj0d\/LhQMJiWr\/Qtbyf20wKLkGnJvpCUZRODDUv\/HGzAiYKec9iLyl0xI4dsRlBPj3\/qk96+vHWCFBI5LJgkJSDIg2Oo0As+19Rmue72aosPjR8lHRyP7b2qSVRFvzkCL3hktDhhGNO2\/8vk6Dat1dxesYiMWkhhopkoH3vOXEevmQ1BrZpcIa7nhP0ob5JIk\/hYvfODfiXG2nnd65+lyb3xKLOkY1QOG2eHx4XtxJxV95ybltVj+AOro0Qb33f0uOBVhhxvPUxRnp1BveoGGqIq\/gfX6EzojL9Sr70hu0h97z51g5q\/G2yqDMTtMccVw+1tkM704jcVZPtS1KIRHzNry1Wih4L55uLybOgft8GHReUqVXO1rtmuTmjHvXxkkq+hW3ZO6Zpt9Zifkk1BLxuaoYoAdg22ALnpTN7VcYCixWlGY122eH2AkgeHYXtrQFh65CCR9dukVHEdRzSFLcF70tHYbZmR+Hm+VVpk48niHEmJvv4wz9TBdQco4TCXjTYLJ6WcVyXCnuHUIWmzQviL8DqcqYSvAxXtEwy\/ABThsNXM6AftQYLRXbcYkYcHWoidGESnafRJGVZwQz25kCkv7ZqgFWYx1xBNnbz9WMnFbBke3DlYRgpZd0ntBDhPehb1WGgxtlkSGO7bjYqCQFYUxhzr1MjEh8JkUM3KCwxgTJlwEoiFSZNBGWOnQnoaXqibsTGdkQ5xDUg\/xJIomN6D9X+YN7QfJRKDelG4gB\/R7MztnSA22E0XjX\/\/YRNN+qvPmrVWdwLFx5rwOTZ2Bwq1XJX0Y4X9FYc8xlkhOJreo9JcUXHssUuTUo6BWARFU9bhlwavKy3u7J0kMozdjG\/WbocG2iKuKdvYnwlwF4XA49pUvEDnV0LhAGSigDeY9WEVq5NPU8kaL0aKpcV9sZJjCTDkCQvVnASsCd3+zuMIFTH\/wm3IfeUdpSYh69FBYn0JPZJnE\/f2WC+G83QQZNTxoXLd9yFjxvmJQ7W1L4zZf2d490E4pdqLfAEFuTNKFuLGgQ+LZN4YH\/5qowNrJyvVezIyiysoAoiKoYlx0R5mslIlSfPbwSJbTB1uxs3rqeOf8ivbtSiOzeCzsWNJXJslzqZupoGqw7\/SmaFxzLXGXzdi02UgxbJUV3MNetwoWntiOQ\/Z\/49uutTCmO52WyUtp6uT2QPgpYOad0YVkiJmMQURNTDa6EXQiGewAMntXsHYGBjMrsKmJQ9FFiiK9Zn62NIBtpITbvAg=="} 00776{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1600365863681,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2aac:cdf7:d506:7807:9092:75f:a963:f4ab","dst_ip":"3f65:ece9:fe71:6e2a:face:b00c::358e","src_port":57587,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Facebook","breed":"Fun","category":"SocialNetwork"},"quic": {"client_requested_server_name":"video.fmct2-3.fna.fbcdn.net","version":"TLSv1.3","alpn":"h3-fb-05","ja3":"61d8a93ff379660087082a82411f19a2","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft)"}} @@ -15,3 +16,5 @@ 00799{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1600365863,"pkt_ts_usec":761598,"pkt_caplen":331,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":331,"pkt_l4_len":277,"pkt":"AAAAAAAAAAoAaIxPht1gAAAAARUROz9l7On+cW4q+s6wDAAANY4qrM331QZ4B5CSB1+pY\/SrAbvg8wEVuTVIscMlcwCs1m1BUJrKtWnOgHqeDT\/l0P5tRe3mjlswsJWk7ZHBihFcDAJ4WBNoI2+1WSXiaGMiJPk6HNHhBMYac7zhUP1ea20\/XBC14rICg3JIceCztDYghuz4mkH6hPCy74wirZ1q+hfFTFWvpnozzlb\/xWXtR3XR8AA1dsX7n\/IBTtRBREWCwQd9xUw+\/2Kq6q9SHXC5f2Q9LmSMloOP8OfRHPG1tM5ATfAMZ6as6sQAxJBHV6Sgw3VpDcZOvVbqLPjejZDyBIUmIYDXBfY4zr4VtffDWsY0pq4CUvECflTPEMh2+G\/GzrTBnEUu+nE2NB5b44N87WjMW2g2fVs6iTn6F\/zmTI4RgaZqOg=="} 00474{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1600365863,"pkt_ts_usec":761926,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"AAAAAAAAAAsAUu6Rht1gBpyIACgRPyqszffVBngHkJIHX6lj9Ks\/Zezp\/nFuKvrOsAwAADWO4PMBuwAo+r9RQAXJhFchLk8G3cLHlf2GuudTHhv6RGa4bNp9y2px9g=="} 00873{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1600365863,"pkt_ts_usec":769593,"pkt_caplen":387,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":387,"pkt_l4_len":333,"pkt":"AAAAAAAAAAoAaIxPht1gAAAAAU0ROz9l7On+cW4q+s6wDAAANY4qrM331QZ4B5CSB1+pY\/SrAbvg8wFNFVJOFV85r8TQp35z5Bmda\/4gy7xWTjcVk2PcyPeU7PEmDCCTibj8O5j2MvMx2t3Zehez\/Q3Fwkabqn9Gng6dHvuSrFzjTxmqbSrnm7HGyMZr14EARqqO3OBgQ9D7x6Cd8yQGx8hKBp36sWTXi3SZe5uNWzEWfSikvV6swcWlrw6nwXAvPX0Qqt\/w\/tDUQOWHkhJSWnzd7P74FlBdSqel46D1qWYZCbGLGiFV5T+xKzKbeFSteb8rShQFzCUYMT4dAAlP3Qu+J+6zcctNPFU0NHL9g29CiqeomGbPIDP1Gb28EN6h31bpk3Fll3IccI66k\/NpcqQv+o5E9MaEPy88n8cbnHVu0H4esytSKdg+tfpPJckbnlS\/DK\/erDDhRMsmLxBIKilQS\/lNJ2qyfsfNQviVS0sIFl\/F9Yyet8+l9Rf5Iah4Jd09"} +00548{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":30,"flow_first_seen":1600365863681,"flow_last_seen":1600365863839,"flow_tot_l4_data_len":24689,"flow_min_l4_data_len":39,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":822,"midstream":0,"l3_proto":"ip6","src_ip":"2aac:cdf7:d506:7807:9092:75f:a963:f4ab","dst_ip":"3f65:ece9:fe71:6e2a:face:b00c::358e","src_port":57587,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"quic-mvfst-exp.pcap","alias":"nDPId-test"} diff --git a/test/results/quic.pcap.out b/test/results/quic.pcap.out index 9379019a0..a030fdc66 100644 --- a/test/results/quic.pcap.out +++ b/test/results/quic.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431155536815,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.109","dst_ip":"216.58.212.101","src_port":57833,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02200{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431155536,"pkt_ts_usec":815947,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"ZHACjT05eJKcD6iOCABFAAViHYdAAEARqU7AqAFt2DrUZeHpAbsFTjSmDbLeXfFPVUXrUTAyNAE7bomG+Dzzt6arXQUBoAEABENITE8YAAAAUEFEAIcBAABTTkkAlgEAAFNUSwDQAQAAVkVSANQBAABDQ1MA5AEAAE5PTkMEAgAATVNQQwgCAABBRUFEDAIAAFVBSUQkAgAAU0NJRDQCAABUQ0lEOAIAAFBETUQ8AgAAU1JCRkACAABJQ1NMRAIAAFBVQlNkAgAAU0NMU2gCAABLRVhTbAIAAENPUFRsAgAAQ0NSVIQCAABDR1NUiAIAAElSVFSMAgAAQ0VUVjADAABDRkNXNAMAAFNGQ1c4AwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLW1haWwuZ29vZ2xlLmNvbT0+v6ewgcRvrlDFl4IgCKBtLSXVw73kkvbSDmvcmOf2TBMxulvrGz8yGTFdF5jLNEfrxdDYlT46wVhRMDI0OZ\/5U0D3\/sl7Junn5Fxx\/1VNs1C1kCtxr0CV9UPILNoJ6w2heNOu0THXmZnbqXjfZAAAAEFFU0diZXRhIENocm9tZS80My4wLjIzNTcuNDWSgFuKS9buSt4mHNzF5UW8AAAAAFg1MDkAAAQAHgAAALUiugwS5Xe6lV7+35SrDjhQNi2XDPMM\/SAa6745q60xAQAAAEMyNTWyymQS2aTzwxJH\/U1CkeUIQAt7kKmueetRQklDOGABACXmg4KWna0TB6ed5h20iLVA1zTe0FGDOptzFKaIlVwv9K6LN7uMdA4zwVZIB1iByXkmIDPeaAjR8KDHiEXiLMdlilnNIxXrsf36+nSmAywD99MMia5QSojDYPQnkx\/kpc2+WkgLuTD7x6JugKntVJ0OcgBRa3ZbeaVzbIzXT9DutsK0zdmFTlT7PzF\/1Y0KupYf9uk4kqnlGvQLoUuyyKbFovu6AACgAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00615{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431155536815,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.109","dst_ip":"216.58.212.101","src_port":57833,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.GMail","breed":"Acceptable","category":"Email"},"quic": {"client_requested_server_name":"mail.google.com","user_agent":"beta Chrome\/43.0.2357.45"}} @@ -93,3 +94,5 @@ 02226{"flow_id":10,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":462,"source":"quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463075953,"pkt_ts_usec":428061,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"ABlmWmaM6HTmLPTkCABFAAViG1QAADQR+RjYOtLOwKgBbQG7iaQFTg9DAAdNVYQf+iC\/\/853DRLv9axgfYBjztrhLSg1s8tnb+0mxaeHezcc8sEddrmKsZSRYWcrYF9VCqiHXDNKY7dY1PB7CJYNS5aD\/r21wISS9hMPwdB21G0Hcu+EwnECvwvM\/0xR9AM4oKNl\/3Fe9H0H4yUBO+KpL02GhxngHzlMTv97MiyJNHcU5XwZRgKsobi246ls5nyH3OCZxd\/WriGpW2D6YWBfhEru0wVQ+nFW5usrHs+808xWtp9abq2fIE8jKQM9AUn07ujtqFyYYp7H6GsqZ2djyBzhplSARzFL7u8xxm+xJ35T+W5\/3hR97w6FY+61zAgwk\/S\/3EuUyCgVQFfmkHLxa6ffAEzwOTYE6NluPvfUV0vaIfE520EylO59UTrD6SOhmFdEOPU0sTo3an5mnvGPF0OObkkn6zPg8lGg\/Xk9uTv6kXKi18HEk3FdChYdgWoLPdR8RpexHHhk\/KYCZeLsFkh8eQabTnrsLoxUB0M1cdHt3S0K4onDVqG4JaGdOeCx8ckepZs+FRor1WlvquFD\/IYEYz9n1WLSGD1C8PAGI1w9AtK8khS5UtdPZPtePvZ3UhiZviplzXovmyqN7iGfs+7OBMKQ+v+fJgg31saWnMURKaB3mzV7wylK2vPSxK7Iq7AUQ3FLWKc\/D34uZL3FdKdeQAxj+fmF2IXJNSY4TxrLZm1Pz8Ot9ccSpLzARv7TWoXwWYw+V9iO1HONycd4WPSVV6pvGAzZELYGSsJLiQJCMrMCGhXkFA6skX5RdZyRfJde+raE8ky162\/k+onPLGYaZSA5H+DU8coiAQ+7SS+pMoZbHIXREskFi3GgirDbcEc3S51yo7dGJwmt1DxJcpvtMIPYhsv+9iK5hN30QQhogta+eeJMk0oDeG\/zTwwAgZB0i04J\/LAbx9IqWhahgOgjWQTAVzkAZ4qFtnNgLQhQFsU\/EoOVwH\/CQOHRF9NWLW3zLjLAB2Q6cru\/cATFHBFbG7lpIxZaHXMRhMgRTPMPqUdk6ZSthg+ZtlB8VOTykzthfFzwa9eNEbOQF5LdqraJbWq9yQhYRvvt3Fqrys39jzAHeCuynF2lRcI1vJjQWoeaQN\/2e0KkJEunqTGdkXfw+mgJdEvWZYi8+p4iGujkl9OViO0hLMmbX1IiYinomNW6RcuMWUkHc\/N6Gkf9x47XwRy5bF7i3AysneHT0NXiKScMqzQVzAZMmJMfcGL5JbR\/H\/Wm1ZrLc1AAVot4upxeIGzzckokXpU9TRMFJWZIijs+urWA9aAgjBWTCh3THScrEgL6pJVhU3VYARS3mfGP5HLAc6C33xhvYf9m15dTcFn+nCmsQf+oYlReM4o+dZi16U1hDDlnYctSQnRdyuomM5Cv5lG+9ZIEGCbCpmUpC36bVLhK1dOOl1z43aDZL02uWMtOdwTlTXw8zTgKle1Qpq7MRETMxTvFWWO5UGb7dMrK0+6uK6z9GCWNsPBv1QI3UOSckN88QmdpxB5Zm0OgrNSBQ\/QfUKjp1aUPiJdx1CUOaMb4EvAQgUVnc+b6f0pS5eyfiwmzd\/fCfIEdPACHCrZVZR7MOe0wcQUTnsUk12JTBMut+jzUQ8PAsH56VvuhvVc+CzBC\/a7HaXhb153HKPnZGVYvtheUnb51Phx1AOdOTUy6mbYJTr8ztC8UUfebEUiRJf7mveK8IP2PLTb1k\/fi6C2QvpDL\/c602MwBIC8TEJ3tTJ763IFx3cn4NRzl2mbKI24Fubuvhc2UMlR9hQPX4rX0esWexvKpDui+X3OzHWrlV5pGYL5pD\/tM"} 02228{"flow_id":10,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":463,"source":"quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463075953,"pkt_ts_usec":428507,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"ABlmWmaM6HTmLPTkCABFAAViG1UAADQR+RfYOtLOwKgBbQG7iaQFTqXWAAj5CaSOKUnUAmbVYxJjCiYKf27SpOrRU\/gvItHJBLhsGyh4WeXfwYt5YzSMbZNmml899qQN3A4wKwdsahus5C1yoXENkWtilCnVV1NqJAqiaiZKq8NvECrLoLhms8NiYEYK58xEerw3FMM\/\/B5RUtrf7J6OWB6VVOjwTu6DRXQXubQdhEIZR1WSDoZq0CSvZP1\/\/qxYoOcwnpFW7FU1pA5jtaVZ11kUW3DKUikzmXrTX+WkOaunhYNZffb\/5FxdZ+fwjYac69cXVIn02n+v69YUgdUkH0j7MDzgPK23MjPCQOwZTU+OASdqebPcVZYNFhYzD0K7Hs8HmkfPBnbpYgcxebN9x2A34ItdlBOiluxkftOpWlGk8ReyA7ziEDZ\/YHMiVE9iCI0k\/Q+v5WOAznVQS6A\/JWDLqV+cbZInQSh90ZSLUCkbjoycP65jRWsJOUPceBG3urCE47BKEOhDxqDE3H\/b+W+vZIem18eZOSuhWCRqb5DINDkLKE0lndwbYQxviab\/Cj8DCDdnw9alf053R8C2gR13TUJkazv7E5d2KJBwGlyhLse2tugKyHrw6VnWSCLdmLqt0viDh+YB2F0HXj1CeO1nSSCwaJyrwevh+JMhr28U4GZuq\/8iOyCT32qzGATTob0blSixKNU0nrsG\/edv7ffcTSflocJCCoGDIPz5k\/SvGRZr2+wiLlOODRBoy+Hp\/ZoR0zRh3yZNqocZlkDIUTBKznO5qQE5ST89RU+D9ITBzSFrjm0vj762yqIYQn7atyujrlIguI69oV7Uc6Yk350ppgZezdDQW6ZtU0dlUnsQnioVaxPeehgPzqL73Erfq9hevik1cXRfPmRlZ5pO1Uw4ylyXLqBwN6FTuhy3MlBp6n\/uhx+oAHZ4OKTas4oRg+Hw0eqVSVAp7\/31bth7tMA\/d\/QvSAq+SGeu\/ZG8PJfRr\/JAqIBREhfI7VSdydJ\/Z8i5liX3t3RBpoNk4MnqDqqqN3fEq7DG2oT6\/HH2wCLRl+a6gq1ey+VHx4cA77wpcJJa18slC8C6\/YCKR3WSTuahSzjf0ZxyWpoeo7O6oRO+Cf57SxWUyMRunJe5haUE5DRgyRVgDq2A0is4tTVlm\/kJfuyqmGi5p1nqgG4qZEBGwfhr0y5gpp3Lx1VLOMafrWWWhBqBpNd8pBfh3SRrpJOttXDmB5hqTwMLYFH2ZLTlx3d8IpZ2D4ldgsY6R1koCzsXCTalO+Pzz4uWCC4Zgch2qTWN\/OFSWw0up88D1VEWTiWMRCVc2kK93LkjpiwYYtmTKan6lA2pfFrIbq54rA63o9eAcfmJNpm5SHUiiJ78V4tPR+3\/h7u1nPyawsC3CxXYhI80NKw0S1ifJ3ROu9Uht4TB0mSZIC37xbVJMRc5V7yHr7jMm7HC2uupUP1EvqAJK4hH0WsmillshZ+c+wEwn3C6AoDqkGE7zn+N+irKocjnIy+AKnwAzm5gaUvZQOAvBOpmTUIIS9nUO++9vi09y0u\/cjZnJdoUdZLnEnwVJbXzl4\/5Pb90Xl4nkZG4lnlw4iWwugzfcKv2gmQrcj7fgBoWmUFb7\/Al1Gqv8kDW4YFYljNOnSb2zx4pIFrtDsnSHDjAGCcpqBJfAF0pU1prbVA1xeAIziexP+bu2yxJQUbJ5c91WDE8sAsHyx0U6W0KaPB37KCcOeRdPh5DyE0TXWkBvFFdLL8bPo1DuyiGwAN58Tf6RNwW84tYPmvorpDe4A6SYnvb0FQMw9xhbrYe85U0F28h\/Xu9WAQdT9YFiGPEpyXb5ViEL1AiSGEH"} 01956{"flow_id":10,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":464,"source":"quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463075953,"pkt_ts_usec":428518,"pkt_caplen":1188,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1188,"pkt_l4_len":1154,"pkt":"ABlmWmaM6HTmLPTkCABFAASWG1YAADQR+eLYOtLOwKgBbQG7iaQEgrfkAAnf4DCMrsUbO\/ngChm3BUxvj6ihF711mBPSXPVFdDhpSOtcrbvY1KsY0f4vCqIi1MXzoSbEcl8CFyGdECH08WWlYgy6GmXJ+IpdKgMRIunQ0WNk82BxUlyvqQQzyafpjH4+5Y814Kb4YgqBF\/zJ7AWokLdMqZd2sh5fS4lv7RgAT+IwyMSp23pRzGxvNPTD\/VBqoMIIcR0xsXYQ7cIRDkEghEXLz\/miWktIBLJB+76uq2WcJL1iRBTB7BrhW3xzrub2U\/qksP\/rNCTPyoRaGvkcD6kS+cZjUHuSBrbBFfY\/kFvtiyzOt+1dUS2H5WvK\/e9cdd4hZTdVW8z0+NuWpQ650nDVcLNHwpcvT8Y7kFGRH1aJWlNwYnCjjhjFGL4WJ0nGves2K55q9L1NWMo60zkIPt2gSkDN7ic5vrsZJo2pbLNjLoHl26mIrU9iwWWlSyPBJw0zLkVPJRtg6rCHPZRO8DI39uhPGktSe6PgYTZq3cvhG3I+WHymsGbmr3SWPKy2nJ5Icb5lItEcNjwBHM8VuWWpEFkLmCY1DSf0YTyNPXH0ray\/Zb9BueH0uIEmJpW9lIgxkUn8Fne\/+5B8hXt+Fn3ULzd4BLoKH5WoQuZW4dB0BAizlUCv7XkBpKL1jJ\/Xa0ynkC0\/GM+6y6rPY\/N2RBKBls946wbH1MamdLsvuDy0J+CIMnAU1VbKQfcuzVTDU6PyCd5vjc6L39DK9LfYRwahFhdDInWWn6Z1liwAY0utnhWQfYKSQJW3tgH6I3sxruO6UxMDcvLVAywZuAtwP5usEfc9neWEWSGAS94nId1TSYp\/UnV2jfx6M+\/eMtUpc3UoXcMVDvYRCMagfHcjPYbOvaBXufrlERvzBra4C62\/8Z8sz6eWaljp7aAzDuKzSv31lgrX9j0JQF5yFUGWET+shJydWdq9Y9lg4eDmqzM1DwA7N9pEuyM\/BI9BypXeQmpVKTaerJ\/uedM64ldi40vJlWQi\/6fsYMZjeCnF7d2WXDVfBiu\/EtHx5p7cDiKTY6u3IcWJP+WvWIfbyrSDxy8ul9ZxbCK2KP2dJslbz5i10BRktzGiNojUoZji5U6mCs9XEQk6Veq09SpgVmPX1kSE+3SW8D\/uGNOm1fmyOP\/xKDgMBCTeFDgZZgVZV1oq\/p2X0qeAs+5fQFsMMtl6tY4Bt5P3ohcc0Oxg8FEqUHyM6zRnP15PIOpxxlN\/\/s4SZSt\/aMq\/IPg2lPmc9CpcJMS0L8LVIyaDXcScO1DvsyEALATmTDycfe2+tthjTeQnxlEsN5sjob5ccENZo1PjR6HhP2LlJJ2bD4T5tGRBb1rdnIqtT8v8ksY+Yc0uO63TLrkRWlws+y6ccPBHNJzsgcal11JK8nMhJeJlFRIt2rf3Hapg5hwia\/UuQUfF+4cWZc9DvUL3MSuO2Ox\/iCroKvXeyNPw3CVhgyihJPqrOqtB4BuzMAouyKKIjCC2KhyXI+JgP1S2E9CCp7Lj\/eDne2tDHDryZxZ1lwQJntiYx7Y32qZi\/GVd"} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":518,"source":"quic.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":69,"flow_first_seen":1463075953299,"flow_last_seen":1463075954300,"flow_tot_l4_data_len":56087,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":812,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.109","dst_ip":"216.58.210.206","src_port":35236,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":518,"source":"quic.pcap","alias":"nDPId-test"} diff --git a/test/results/quic046.pcap.out b/test/results/quic046.pcap.out index a26e272ef..a24c3e03e 100644 --- a/test/results/quic046.pcap.out +++ b/test/results/quic046.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic046.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic046.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584456191933,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.236","dst_ip":"216.58.206.86","src_port":50587,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02202{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic046.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584456191,"pkt_ts_usec":933380,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"ILABHGh4AJqdnpsZCABFAAViVw9AAIARNVbAqAHs2DrOVsWbAbsFTsB3w1EwNDZQtKT59fQu3TkAAAABmZPTs83+bYJOmUXloAEEAENITE8ZAAAAUEFEAPABAABTTkkA+wEAAFNUSwAxAgAAVkVSADUCAABDQ1MARQIAAE5PTkNlAgAAQUVBRGkCAABVQUlEmAIAAFNDSUSoAgAAVENJRKwCAABQRE1EsAIAAFNNSEy0AgAASUNTTLgCAABOT05Q2AIAAFBVQlP4AgAATUlEU\/wCAABTQ0xTAAMAAEtFWFMEAwAAWExDVAwDAABDU0NUDAMAAENPUFQUAwAAQ0NSVCQDAABJUlRUKAMAAENGQ1csAwAAU0ZDVzADAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0taS55dGltZy5jb23iUlTd91Wbyacedc4KWbvYAO9ezSoYOG3jhMeQafLfpHKvILz9Ye+me5P5nrw5Y\/leQsX7MclRMDQ2AeiBYJKSGuh+7YCGohWCkV5w4f4wMDAwMDAwML0xAKSRUT2iY62vYCLSlIfkuoKwQUVTR0Nocm9tZS84MC4wLjM5ODcuMTMyIFdpbmRvd3MgTlQgNi4zOyBXaW42NDsgeDY0mMqP9vF+kzJdLqfvNTDv5wAAAABYNTA5AQAAAB4AAABhJXvQ9+6Hu83ruEOa1Y6Y5fjbWd3ky8\/JdT+d+\/AZZsvZnn1BDAzSykK3Urbw\/IrLoBtlbcpqYoDEomljzhkwZAAAAAEAAABDMjU18ubMxD2HxlI1UlRPQUNLRPLmzMQ9h8ZSYDLLkqBBTd\/6RwAAAADwAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00631{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic046.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584456191933,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.236","dst_ip":"216.58.206.86","src_port":50587,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.YouTube","breed":"Fun","category":"Media"},"quic": {"client_requested_server_name":"i.ytimg.com","user_agent":"Chrome\/80.0.3987.132 Windows NT 6.3; Win64; x64"}} @@ -15,3 +16,5 @@ 00705{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic046.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584456191,"pkt_ts_usec":963272,"pkt_caplen":269,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":269,"pkt_l4_len":235,"pkt":"AJqdnpsZILABHGh4CABFAAD\/AABAADgR2MjYOs5WwKgB7AG7xZsA6x+iQAIyyA8Hh0m4bZdW42gZxuJGjnC1NVNo019gw246djPBq+O1rkBSBlV47fUDNFoD1rcyW3VA2Jwm277ag1xX1aphBr+2VmvzfrZi9Yd+oW\/hpNmzYiTyxMPLBgyrS\/yUtwO0olISYQ3Sx83\/a9UJNp3n\/w7f0omy2ENTYMfvjgjmxj1FxS7UFmbk4Jkp0afE47UqGDLnxprAweKcbd+cUyhHjjW6AZzubY3H+Q7MaCWDLYH+udDVK8w\/6Qe7I354uH4J9P2N5gzVfj9wWBS3t03Jdj222Z4OFIbKRyC2I0UMcnA="} 02220{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic046.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584456191,"pkt_ts_usec":963488,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AJqdnpsZILABHGh4CABFAAViAABAADgR1GXYOs5WwKgB7AG7xZsFThSKQAOAvpIujfPXuO6ftDZHkO5ObWeGwv0kTM6g8c7RkS2uYesm\/OjqEbEv0CKOemYtHR1IMbYP2KjBycm+ijMHOjJJ7TD4puUehBYTakXtyQfn6UtdEifZii6b8ZPJbDW61mdPkdZxiEwcMLckycECj8cXpMGXlvn823MkBsBSoSaCM0Ub5HMUt2Im6rRfnaCagG0MWgQMpnukekS1sbgAEfQR1yxXsi0u+crvlOolnskNB3\/TxhAHwKlsZwToSAqYaF+OKaYa+iepBKRbwLpWWtx5fqAhAsHaCqh6zdPj7IwomXiHEfan35QBcv\/Cp6qOy\/frv44XLFlj+VQ5VDOswJynuQJSdcdPB8VuHwHZO9E3CNR8aA1QAezHKPUjK66Qy5vNg0fXB1EKqkTOK1zpkqxoGkBRQsCTwJOzQ5N+p2yN\/C8jifIEGCnaw5NP6VGYJiVqVpkvs1egcYLmRBQALOa1yuq1SgxLiiWlGQlHjlCSigWqLVjWV\/7XKgRQSsgCri5iC+n5U+3EcoDGPljd+KhvQwbCOpgQXFU0cuIDfWihxZdtZzE2itJbtTYhElGbcm8MBXm0VNpLDIV2ZFQ+i0ivj9npkURS7n4S2bjuFcLwGSASB9hMBKTp9cbH8cZ4l5jC4rPi1\/GklCyoDxvRdcQsykCQ4lzXNKcfDZ6vfe2vtGkXKt79HCLwHLVPZFr0HxPHiegqwPrcdVfLmgYPxdVf4icMjQFbGc43APhS7CxD62LW872xeAmh4zZ4I4CsDVg5do+uFVVX4lYdYyPp2GPPqNoXv5zhbGhPLB4OABvAklJPRjn1X723w8Z+d6YRPhqrJ0Rxo3\/4+bwddphm2UzjUzPFdXTPEoh3B2vt8oIZA8ga5OX\/a9ALkmVN1Q+FNqR2hIZvmwXuW8BK01cmyJ\/FXcN4xui4yoEBQSDyt\/duV00mg1PPI\/\/CA65KtMk93NhM6HXrHPYJmMwWNcI\/r8vBiuGfwnQG0onTTaaaafq6Q16uBUyGCQYKtnNdtRoj8xRuTPaZC4W7T2FVI9KL2qwxwApiwa8NKXRTDDjwX0G4IV3BNRcDyEigfUjsNUWQpDJO5O0pJoAoLMGCCPM3W5rxl6MIGvt66c741Of+Gwqxjs7U\/mtmlC4k0F1rmXIwJbXtf4GLek3NlgnaQUZPb7x18Nly3StzkT6NSBXaeZzoUpkFE5vWQlOZAAjdaheNdB72CvU\/AloN+YABH5O+s2Uy9tl+nnK1JwZPGy96s96aqNWly8IaZwTKNPNAVtL4cr28yWXuMXB1WxOVBmBXCmJ4MDl7FWT5u6di+yhZ33CMrT36wCB26ugS4pXk7Ugc8kqsco2nQMEBQrRwdE37Dh+tBRvywey5maPGm+784Z31dQx6NUaZh2sB5p4LSXaCco2LpcrstisVNCHDPjzE2T9cEv4Yu8tm5CsImP63gI9Fdt43N7jRhkiCJkHsyqSzbB\/VKBmz5RsQGD1aqbjFuYGr7iqG0peKGN42a\/n9fh8tZkiahlTVcrusp\/NEteOoK6v8JWd+65Pc4FWyZGsvBCo4aMppCCivRQi7EVAle7OM1K12HXsRmHZuJ9aG6PGKf3+gpf3KjvPEH86Yp\/K8AcTYwkg7bYxM74DpUiHhoqhUgvymOHKLZs8BLGV8hKr5slu2v9Ih4kJWN+cN17lmkB7PzGtQHW9DlBflV1o0ra1bvJotgm+86KmnDnmJfKQ1xVWR3T+pthoW1CvcpRYFOWLRizFaheTvvvtT1H26jL7F705S\/BWr3\/HP74Iiwy2oBSc+HfHp"} 02223{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic046.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584456191,"pkt_ts_usec":963728,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AJqdnpsZILABHGh4CABFAAViAABAADgR1GXYOs5WwKgB7AG7xZsFThrOQARe3aLxBgB4IuP2cKS3ZFA39NpBP+15OEWf22Jpc8sHpTbJTKat717iP6h1RXfrq6jSurGYM6rZ7io\/\/Yx2k8FZDOmxqv7n60K76Dlk8Eovb+EHUwR9ornDEzEqFnI5ERPefTYFAQRy61YzgS9eu9G4a0tk92z7y\/MSWyIknfp9RdJRXDbNgwwQyJ+PVjEIfn5Sxcb8ukhNxzmsR9eMMNt+vjjnOVfCxTa9miq+KyK5+uhPp6KAdBkh97rk2dLJmMR3wpsn+vOgshKNwAIWHyCAKyhutl22MDVNmz52XXCtpv2TwpdlNmQQqptuzyivHEMGjKdxBszewCZStU0cNSKw5gv3NSuZxbbEa+SpY9pqRoeBiNCDYfftTxLUbCwKaT\/dV1ISgXzwjt\/tZua13Bad1q6A1AczQpDK8bNBAEzb0rCZq1LASrcH7KSx0lCxDahh4yLD\/WkK0Oo3N5bHbrF6wsHgOazbPhqijCCTmoFublIfQ2sy1cnuDvlrLageTlV0DOxX4VpqwLLO0Mwn\/4ZfONp1aFjEU\/aZv2E\/XsWQLitO+unHUuEN2QBoytB1VGJ+7JkqB0qwL0Znh4ui98Fvi7zhY7LhxwQVK39IqHRiymIc8RqRtVyZqiQ9tSnRuwfXndZXNjZLI7N7oFk742er0XT+cPAuYyoutcRCI9d6gUi97RbLn9JfOM5qseC9SL83ojZ3+Z3O+E8Jd9AXS8VTVpqbfjKISIeR5H24B4JrPuJpFW2y5KJJZn+EIfA1ciNjQ4FD3HFQjqUgNrRptJaCZBlZdUNffjcIkFMYY2NTp1pO1RsiTdHr+WjIo8yDB6KSysbGRZtWGamQ7\/lb80Jq64+GG\/EXMfLm40xLfwBppU0dy0FTMTLIBFxQm7kTz2CgeyH+C2LwbwDauaEOMZ5Zyu2a4b9jJGqhg+5OfoLYodmJLf46Iw8nVdUEjQdNCacNVTg4ViIt6\/MFiTaTSlmKig4\/jei21qGXUUBhjDQZuD8JD9OcR7IDdWQDKYK\/0Af71hhRw6IF8+NrtA3svD0x3G9NsOG\/Dpx3cmC0m0b0iXGJl9GssoxP6ytRRRl9yoXeGPc6CPZJW9fxHx1mA8KsC9QKIeyd8ggumO\/HvblXMnx6lyKsqeqSVZeDqKHLmvu\/fkJlPzoFp1oFmMydJb6g1jJ2zxHdfVHHf5hID1KxAGIVduds40luxpRtvL5vBNhCbmmtCIApNhUocMLbjSFl1mdAphYRVCzJPvkCcrPecC1RAludqvAINCoBoTq4piorsrSBbEQR10GJv2H4VKLIwhgK82gaQKjlIfT4r69kPHuVL639lG27WhOadqrqk0ZDQSSEWiqAGpb260jFS2ddY0oAkQKVU9na+RBb4cvBYNFJIjISsLi3YpF8r5c8gGC\/X5cZ8eAW4+fg\/VR2DrgiJorieJ5X3ZQnuXkxL2r+bImsG+gTbsIXHiH4tbrfRJTsbWsVW9Pt9YPWn+GDgEBxXoWaIUnbS1dCXqn3+Ibok7QqZwO4oBBCJZCTJzf4OeWN6hoFkAY7b8udICS2h2QPr81wCHodt\/ohnh0NOmSEpqdb5Uh8bZaGl3xpuj1fGVuLNhyyw7\/iU+N1mVtOflAgeXbMcsb39K9w2HTcPnp2U06Zvoxg187JQmElF1R5aqPhoQ8e\/xxFcfzvbF3llslbMPtHWAF+Ngakk\/3G9RQIfSkMHEmoGt6V\/OozmvD+un1fo3v6SPA8UQHGfBQkLKzCkvAs\/+fRosNUPK8AgFvNblLO6rBqsYglJXM56rKEcBdOXYXx"} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"quic046.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":100,"flow_first_seen":1584456191933,"flow_last_seen":1584456191986,"flow_tot_l4_data_len":87897,"flow_min_l4_data_len":28,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":878,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.236","dst_ip":"216.58.206.86","src_port":50587,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":100,"source":"quic046.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_0RTT.pcap.out b/test/results/quic_0RTT.pcap.out index f05f2dd18..293903db3 100644 --- a/test/results/quic_0RTT.pcap.out +++ b/test/results/quic_0RTT.pcap.out @@ -1,4 +1,7 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_0RTT.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00464{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_0RTT.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1603888789791,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":60459,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02093{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_0RTT.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603888789,"pkt_ts_usec":791229,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"AAAAAAAAAAAAAAAAht1gINJtBNgRQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAB7CsRWwTYBOvD\/wAAHAhCNdWrrb4+VQiw7LD1RGMN+zL7OkPMAtXpNlW5O0b2\/q+3KdcOtoYFqBIwOi4AbeOZTA9r8spxR89EzuGsSMH\/bUH9ekHEQ922xeaUjW2FgbWmXjMqS+663UY67NIITXpkFxwR22N+eMGvlLVxq1DPyvGiZiTcqCSaCZ0JYqKt+vdrIBp0w3K49QUaWm1DuJd+cQIJzCcz93gKXA+aQn8qJuO+lEHGyiCLVgeWI9\/dk7q4fiSnyVYB8Z\/88\/1PGsSPr7zMnahidPl8sGnTG9MT+px4myWEEHOjoSU0yW9DlNQElkOgitzZjllGvGhUhiBIICMF4QAUv3\/uP2UIoOlO5XivEkb+TEkDY+TeRlQOAIIUbsGZNooxIOe9TQJ82TvA7CrEVTKBa\/0UwEVbDA+egVUviZQiH5ib3Eft7yjRSwrLosJr+JYLE\/b1gPCQqV3\/X9AjXGrd184V\/I069AxL1W3hrfjhc9kTxr61FQb3iBePpHQNPrmWPpWzg65lBvr27yyzoj6wYSTbO781l0YatfDl\/dDvdQIfKr2P6uLMGzJJZkB+Ef6aEehROc00Tde4mLvS3KtN0T7iH4IEsYc3Db9k0scho9GMCBSBIiEPvgGR0Y67dvPV5slktWIWuArg\/VlYjYX5wnaRfV563WjXbTYNGUsYH6yJ12K39PLd+9sxGuDsDv7wuOHQ\/wAAHAhCNdWrrb4+VQiw7LD1RGMN+0KnwyOIE1IPFP+gl6zZC2dnhr2vJbjX4p4gjfOHidbDFdeXHDeCB6AR+v8jJSYiWVKpOKT1tYDZ2eaYAb8EM4juskAwg8WJRDDALjE67avfbFy2bAKFGVwliLbq9g9yfe2DG7zudaoq7VcKjW8DJUYzFu0kG3f0I+eg9KERSSE9tNgraaUChfDY0CfeGXPHIGfNOqV2eildt3CypMlgx434dmv5i8bOFyWursPeR9FPxLAp0E17z39ZowCy9mzMTuEiKSfVFZVEb8A56B9ppGExgQC8QO0Af3vfqS2ttKNvFYUOgdWvnxDVxIQ3xlWS6ELnr9IEyJP7QN13nNZW2yyDnRClGdlAqhKZndvswyZgxdwswpMFr+Hp46L60HP3+Etr\/g+ZQ+dSKaPL8j+qjU4\/5GbDlG+Y8GGpP5yetDzWW4wN5wTi1RfvXLkUi4VB3m4LwQbvS4nockw+p2t9FIJYuLtV0dMHU6Hv7HaVbrS2rEeooj88IkO1U14qUJPxLmg2Uy36iXq2YaI6VfIvwaNOpQxMq6KJ4BIC327gV6F7pkRGqQyr\/fLXQ9\/QAgpjmMNkP95RpEi6vYM4P3hLk7YGQVBnB+IU0NE43CFBWiQCbD6GGRc88ZdV8uxhElyGuoq\/YHF3odV6QEFs9PDd2W40mlJEPTrU\/YbNrDK9EX6uJSY7GfN5JJTDeEvWfQOsQ0uy8IYjlyJ5TxtnQXnq04wVfUtffinNWMR7cNrjwWmw0LkdigoLMel\/dN7JQkDILpNPwSYQ07T0bRnC52xgOJ5umHTPriox2zwHfRI6lLvfBx7j5PR\/iXTtkoj6weekfmGYFZhQNsP1hkCk+6CJfCIo1m1SFLNWhogGJZIJgLWrvdtqIciw9ptTqsx5dUUsMd3KoDy70p2VEA=="} 00699{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_0RTT.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1603888789791,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":60459,"dst_port":4443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"abcd","version":"TLSv1.3","alpn":"h3-32","ja3":"a7b629a5bd67bfc25e2c78b3daa4c12f","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft),TLSv1.3 (draft),TLSv1.3 (draft)"}} 02093{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"quic_0RTT.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603888789,"pkt_ts_usec":792113,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"AAAAAAAAAAAAAAAAht1gIEmLBNgRQAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABEVvsKwTYBOuB\/wAAHAiw7LD1RGMN+wgWsFEjN2HZaQBAoeulPe6gJ\/sr\/GIbyJYc14UNgXtYbxk5qiSqETQY4WZpoAlQETVvk0wWYFOpUIdBARl1suh9iNp9EVeqqDCK8cOmjC1x9D6Kfk9hGxfOeT71tvhKd4oN+bdYPjbqVP0GFxeHN3IMs7Zr+fKeQyuFIUWnb5Z155Se3XdA\/gkvhnMx1ULX5WEKCC9gZx60DO5zH6utYTXgxvBd7Ru+OqadPKlFof8AABwIsOyw9URjDfsIFrBRIzdh2WlAxDmD+hjo+e1bU72YwbmAGOLxO5htQDsPNuVs6LSSsGz3SFw0RPm4E415JCnhx8Ge0QKEWADh5iBKGwMueF2ztpwDH7jsWxr3wB6t01oBA1kA7ZvkbHO543VSXW8URQBDqZoClPbnrQAcBZ+H69\/w3iitABvrJy3KVNkC9+NdHjbogcNpY\/5rLpRLS5HK\/H6JgUnP0BdrxIIF6HWRic\/Wf7gn1j0WoelZtuUrK3RpR66wFjn8EMNQiKG+ggDuldLKh\/U6tL0BsOyw9URjDfuFTTkGJh6F+XUUpTe3M82jojmegspYUKam1MxQec2Qkg\/alipH7KpbN4YAt16GjKA0vziYX61TA5r\/+c+B2T\/sfMV9v\/HKdLDeTVTmLVtM6L+LQWLFNxbF4yrEngXf\/VZT2XaqBGXuy2LCG0Ll9PjYDBtAtstKFFXX1\/Aq9PC+CdywR1PopMQdX5Z9pMSyZiyB5Lzg3cVGVQshXQFro5Kf54d6amO7D2XxOTcZnQiaAf\/TGRrLMf2QELrrUW5vGD6IdIKDtOHH0dTjyWhDTPJEfsacf7m9B9Xhce36eKCRqwlUUYp9cEORg9tAs+LNJkhiCPhfdI2kmtp2bekrtpez6Fafq\/eSu5bTHdTjUlYAqlsCVns0h2QvzRkddQkOUP7gAh5QNKxagIYkVNaIjoRzRpVUuqTaY5AYQbzrX47APe8VY1hIf5XFE6TPMKmMe2Q\/0CtWSycEDeCk28gGteNWfkas+cB+UI1rrRtWgkmad7zXpxmJvEVKx1EjCgwWfU89z+KDl6jD4P4IeVlDy+ynTr4HbYfYMZyTtc1RDHu8b7675WQKM\/HIrQq6E8CeXlwrV\/kN4X7y3aDTZ8UUUEk3f6P1Q8uLPJ2Yruxo4hJaXf2cw6q7EdHqcpvwl9wyP0SydRM5I5Xs9cDxcS9AAJl75598Onx7hfnsjzw2+Lk4PiuB9x8RRtBxDIfr1GIv04yL1ivxWfjBmvn9aCE1EDAtVLxBhg2AhlMxK5+fcZuD8gajCU3jBim0JQ1mEhqnrWZNbjfhTXGYll4oRXXUgYKlIV5s1CchSlcMgg5uu0+4Aj3J0p8FsizlxDbb6CHs\/xgqFSxARbNxD3LVLxEd+HIIdIWwvT1MTqPrwh0uOKGI3kFXzTPm+StyKn3RLAeyIgL4EkpQslwgXWxlUtDWXyicGhGk5giCxEYaSUkCR2ecvlHkQpbq28IGeTXJEr9czuuYuc6xx6JNXW8HuS7eYhN\/9rkNRrkW+Ih9+rtXr1O+2Dy7ZXSKTG4Wnmba1vr6ZEKbxvCvQURsWLQQxX5DHxb0xG+It92fZknkVToOutQ6p1RiqEpFpKmIm03EPunCuw=="} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"quic_0RTT.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1603888789791,"flow_last_seen":1603888789792,"flow_tot_l4_data_len":2480,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"::1","dst_ip":"::1","src_port":60459,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"quic_0RTT.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_interop_V.pcapng.out b/test/results/quic_interop_V.pcapng.out index dfb1c2576..8bdacb128 100644 --- a/test/results/quic_interop_V.pcapng.out +++ b/test/results/quic_interop_V.pcapng.out @@ -1,3 +1,4 @@ +00393{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_interop_V.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00531{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1603816434507,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2400:8902::f03c:91ff:fe69:a454","src_port":38077,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02115{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816434,"pkt_ts_usec":507204,"pkt_caplen":1294,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":1294,"pkt_l4_len":1240,"pkt":"pJGxgjQ5PKn0qB\/sht1gCq04BNgRQCABCwcKydWupNP+R2kegH0kAIkCAAAAAPA8kf\/+aaRUlL0BuwTYjlPGCgoKCgjBjvWe+MPFRAAARL4AnyCwAgoQjL1g+KDURvDYeEyLw\/xCRk6Dll3vQteHoVQFBQKAtW3\/PUJKxA75UMcNXhZUvkOXlYopsWey\/u66wX35Pj6pU3CXAqQ3fDp5zyCvr8Pm5AyoNAx0veCSUQeDBYfIgnerrrO2MEGoBqYPiiUt8xe5+r79P3P4ZzDRVupqGycbUWtQ6Wo6aZSD05slEqoyPBAaLp3YhydnPgb7vRWFjq0SdM0H\/zxBdY7aJ5VQRGeFUx984uZ\/K6yeMGPT3JYsoR6JIONmbNNldMQuEP+a7GBJ3iEWFJ1Nkel3g0iBwZRA7TTHinpesR5BAPJGKsJg\/VS2BeEVhnsQklM+ccg8cEJ\/WZ8KGZKu2b5eb3vaAvV55IOI0J2iO5UmLyQCl7SbwQC4xeRqoU1X\/r4ksMW+JxOVqFoTOp0p9K8G2C+kXU7PkGNUF6LWJgz0gBnPUfLEiLYep+IB3ydQMSXFv2q4ljMWpImZsfM1M1hyBHVdutiac3ctGpn70sK96\/GuFpnGs5SaPUZPVAd6cowQNyios9VD7LJHBycvPPV\/FVVqGKmtlmE1jhqYU8WM3TP2hIDFKj\/VkbTWINB6wKhdoTjaE++G5UWOW3DyJNvkrdNQDmb57TWpCvvDwZ0zyc9+kjM1P8gJU7fxklAOWt77tLOKjqKz2yyGTywbYI8fpyDxuwcOqHHM1p9Qo2bUMzUDDc5AgR5XXK8f98\/2k\/szEHoOj+xZ0LAk\/ktl3\/tNcCYf5NwDCkoJ2SA+A3liVp\/z86DQ\/o9ZPBbnT\/MRpriiusVj\/+7dyNzTUlosBxg\/ZTGIAFG9kkbqpmlXa9h8whQ+M5AjGTQXahgxhUg+T+XkcD3\/AwAskzg7QFF8QOQvTkgKR27pnPB9TcW0ov3zRKBSq2IRQasfzD4018QjLIoL6M1i7zKWOriPXhrbpQCBMed+qy0CCutCqcHfM5C6tdP5yjdd03xLltagPaoEJdMAzkTI4GTxawZxV\/nJEB2CpfHpXBAiLmSF3pSqQkOlK3gecF6Z5kJRZxdfHFiYQc+ZeBxM3ZsG9j3S6poeVhWhKtKijv579ezhO7g3QE97akiUNAtC\/9u96VNcgwwZo3pYzoh+bmR12ZZk\/flZDnZgzTtqeO5zikP6EaDg3xt4ZqzYpvmcwxx5bFkZ6tYCa\/WSn2OsS\/V89R9JkA+p04smS\/E7zSLxIHIjg7ziPRYLmF24dGHz34FZmheQHZ\/4gm1aFmIaG6\/7f5wmQDqHrB8QpqkJoLkDgUUHwTgyqeLrCOeAdu2eQCQJ4129kNDhXnJ7gWkCKO71EQxgH1wOzb5+V8dr\/jGNAAVFaptYOiLQes+Et0OXv\/4vGauirP+hYZEEAR3InBIIg\/L5KPxSdMCpSCm\/3UnE1zUNlTk7El74hPsNYUcmUS+usyw22jx+xLs4q3Kod9YDt4DrToci+qgaxSPs+xB3bX18DBMDyb8wNM5xFrlJXeWv7YCCDubwS+dnWseGEwnfJTp8dJgKhqy8jDuI7wNl1iTi5TWAuubz7G08V4L8udRmpqYJpILlauSw+hHEcI8MkM2s5oZz8Vly\/UrbvRIh+SQjHV9IgfXMkwlUO3sEi\/jyMwMDaEUvpg=="} 00767{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1603816434507,"flow_last_seen":0,"flow_tot_l4_data_len":1240,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2400:8902::f03c:91ff:fe69:a454","src_port":38077,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"nghttp2.org","version":"TLSv1.3","alpn":"hq-30,h3-30,hq-29,h3-29,hq-28,h3-28,hq-27,h3-27","ja3":"7d9e7f6dec1cb1dd8b79d72b1366b6cf","tls_supported_versions":"TLSv1.3"}} @@ -416,3 +417,63 @@ 02109{"flow_id":57,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":244,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816444,"pkt_ts_usec":586338,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUADnFAAEARHmXAqAGAilu8k8YREVIE7GMazgoKCgoI6izyia7+eS8AAETSgFW7e0\/uMPvhR6zCP3CS8CPFEFg4ppw18x6ueoWG5FrKoHw90GfbCxCGD7Gkk8i6CtlRzTxjZK0M7PlaiodqseOggSafsO+vBV2+Q5\/q4YbLN7RQmGP\/Ip9BgoTDiUZouJlw7ldJ5VamwuyjpoWClsxMH+9An+Ex9TSSb1xTsag5Hg9TfMZ2fXq02UYd81f2HH2EI\/4rYsqXq1o1Z7FAPFLJKhh8zdyLbIGhTUsQrzQ1\/Lqg8c4JBW4zZmiQpgI7PYKkB9cD4KtHgQh674GV8IQ\/6ctUjI0aM2hw2yBBCaTxBy663rWHmTCZujMdrTEjzBlA4wyjXZtZf3VUoXmvApYNOh45AfCMztB5OcUkhHcPZ0MyW0uI9coN5OVZnp7q4awnk0Hl0f9vaeOjTTTB1Ku\/iYy8W9tkqYVZWKnK2QjxaM+6uPUF2H9acpiUjlkbIe0LUf5\/cWiEY9thVo4mPhfL1QsBIHQD8CMD7CYdhVI\/P9gm94Bj6tCcXBUzZZI1aAUAPh19N\/mvpm\/s8MAfg2mKHPufXsVsWGVryWkYjFTPalnNui3Yz5TbgpEsggMonKTx+tSk92n18t8AW0\/tE67Lz+odes2fOQS4K3qWCNSE+spPrS9US3VPjUd3CpPQl9Y3qtVCUFHa9vjVGDmB1Id0U6qkPvXxTnz+eLppBLn\/nAs1\/OcphS7o1upRRhF1KT+4VUjtXqBye14E+w2REJqC5HeuvgD6\/vX8mk3VdiXx5B70SzpQ0kt4qCzEuEvjY9h2n66zTGO6SoZdRVD9Aw8anuA7yKBEQ90cZV5ogORV9x+5fX9lKCx0RLLX44eV6p+ksiKRw5ViZxq0F2I5zTakXeVoCQsn93fuv\/Pdqdd9bITebo\/y8sLs54an6L8\/qBKDVfye1C1tYBVea0W7i7r3lfV82SoDP2YKNcwmABBtBctQ9\/QyO8Nl8dDohITUAFqtaYv1N9P2LGXY0OuMMB52bXF5q0DbZv8aQJouaEDUoqY5fDQytmpLCq\/7q+7o7d7McemVz3OsV6f86q1AWJuhqi0mPGmjN4y1fegmFDkxFODpvqCmINA2rL4Hy0fFXm8ZxSAZEoYvuz+9mNNACVAIYLN8dsNjRuG0+RQtfgaz0agVZf\/xYIhmJkR6GTI9vTQD7d1cxQkJ4Y5dnvinPqvZJo+CtQqkAuc2eZiJcX0xrWWdwkkGJoW5sjaTKQL3L3G0IliUyR0UIB2YpKj3RX\/TQ0INLaxh\/hEKHeR7UfORqa5+C7wOFXUwHVx3TK\/kZxJuStJhs78Jce6wmRX\/eEHKZjusraUFLp6VLNjEfm9L+x7lkoa98OwzH9ubuSTGwRCDByp2JFD\/HbfhDq3rq5FHtaWm27PdXxSyFDTd6KKqjbv4IVDNXRgb2DoRgk66QmrwTp4UwkIwUPopqzDtkwhwfF0B8zvuUoYVxUW0Inw2xbbDZHndq7V2hhWZNduPSuXd3Rr2W\/pnHOqrWtU9CQvCqqWtv7tU3JSn9QbikwIFSWMfOrkjM16FcQkMs+qSeyPxcn7hm10ZK9nRBk266FmDmUbt9NpvG9Re4fp95jKRIb3DZA1vLEwKhjaIFK0HixTq9kNNR53TZbpCLJCvkQ2oQcl2bxJeYqkJ\/xWeYWOoDw=="} 02106{"flow_id":62,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":245,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816444,"pkt_ts_usec":721505,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUAdDxAAEARuJnAqAGAilu8k6XkEVEE7HMqwAoKCgoIR0aH1pvahxkAAETSTdXFi7jlgLLQECxgwj9\/VK8STUUoPwMJiUtYWXzEtPxhWr8uWN83Y2bc8CbExnoiko71x2PTP7m5G3AxSsK4uEBL\/W6crUT7xL4JZPryuks1TLp72G2yZf9TXL8PM+4xc\/WoJ3E7p5g6340BPV+eApbWwdTwwNffMeRf4mYkYKtEqbJYRfULvUhLYCVy4iEZ5IYOhAQ8BkD2IydZ443kD8zkPbMKb60wfFXW3pvwxjLPceraKJQhNl8wPs8BtX1x3JLB93FPFZko0CGyj6WHkxiMvIfpcVY7uA3SwlqdV2RLgAQOp905aRfe5dxgz8b4M0V97O8QR820RrHyAIuSW8XhhyrgN2DhviJECMNjqY1+8rts2TkUkGk6V3cHl3QSTQwnewD8G1zxLFP4RfYqZIu8xU1ihG2ICGBWM3sB6v5ZLT3jv9i9qyoNuDsUz6JCIfnV58Afrs0eBBe7alyBVvC55XSLBTPIJVU0hKk\/bKu7Hb+sP\/GSko6seKMYyWlQm8zXA9ee67zE79Wtzq4S9EOshHD0OAzEDbq7EWYPuOHS29A9nW+LQcrxRJtYy9uEXWtZoVkM6bYxMbrl27Y0ZaLLptjfFes4ZjcqRXMATLP0YDrydzzP9USZMN95xGIguMfhcnSowpkIQMgJrnErHJVRU5wWUvXxa3r6t8jCqWZCQbXBQrAjDt81j\/JkFSIJRjdLrwB5kc9bHB3KKFePJi6dkxllWi1NFmQF0qVF3IaNSI\/3nUm8AQbTXQq38SDrJB\/6AM\/\/vRknYJ+tEtW0yd35Xz1bLoxrz43hpvbryKFYpkdZSEaqsmNvBRi81uWBSgYxwrXxzJlxiRN3bhzVoHiacQqcYbR8+iPnRsYt5F\/co1zRSFL84V8z0u9Axr92anRVMGJLM\/u5YRE+K0\/2qJ1+uVKq\/00jsUbl10BqLJlr\/mrtBiiG+PhyJ\/CQwOJFrMtkYeWq060UkzxaxNShyTJdr5ruTq0+LX76uhQYgHiE4RJ0suwY2JY0ZP1IOoRZo32I7DaXOTU418wRb8iMa+NgdlJvp3aisg5t8OseXj3KikYJ3180ZP8hB5EtBplM4bMBwTyLdqzJH\/ygP1iaeUeKTYUVyhF5Gmoo1JfFZ\/ofGFGKabgLLL2OlmDQd\/lXLW6CJ6kJ8ZgjGVUkdi+N\/IyKoeBw5qM3\/KDZ5srV2KUIU8u8oGnDCWOMC2hzevbQIB5pIjNrVmUt\/kAaQWN35jpaD0bWg5qzsoG+ZrBRwDeLL5kEf3OT8C8lRObAoBt6foWw7KJqMLxKvZb0UG3exPqZzrNROhL6GIiYUZDHKOK\/53YOYXvG0aMNb8CyudWQLwqOw1zp7cStmASFRSg0UWtQWnJXhXBuahHaMNmwersiYxnGICIOzITqz8lfI31cYXmhKdAStpeFyxZ6m1NqeEi0aIuncr8cqjiF6xdUZFTkxejDJm1\/OdvZbr4qYkE1F7QPf38ZDfWCvHzqBdzor367IBpLih1KzlRFTXgpku8F4Nhls+lBdB6+F7PwEK+wcTcsCMWq6zIslvtDAp0f0DCHTPbbPT9Nfv3KjtFBrLqUA2eIQ0up\/AkE+sqVcgJ3CT0ZlMdQVc4ZhRIq1DMMY7kPvxsb7MOk9awKGJKvtgyarw=="} 02094{"flow_id":64,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1603816444,"pkt_ts_usec":721572,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"pkt":"pJGxgjQ5PKn0qB\/sCABFAAUA3m5AAEARn6bAqAGAA3nyNtCaEVIE7GipzgoKCgoILW5Ke\/Z2fngAAETS+sjByQZxBLRcTBIu0zyt2RPWCPyioLbBO+qx7sftFDPVcyiwX8EqdOI3V1u4kR0HbAUHwybUqImHoArTCxJf4RocGwZ8iFczOjAL1\/fFYdO9+ag1U6wul77ev7KOInklY5Cx82FvQhbS7RW1QMKJbJM30Jrt71DlY+2NBP13aYv3u8zl32Rvpd6AGEHroniVHX1hFcEDDI0JZEogd3WW5HUQ6mw8UsbnnIoGAPBi9ka9CGRB9uZbDLVLe5Enms4pCFraImrjGfkGI514ddiKxmFbxvywkrH2mXyAWgLxRUNW7edPwImfqO0u9YrwYJgcbmicckQi8Uul6oeQblaSq9m0Y6dnqvdLtiYEVpfcfrMTqS2KAHOve+ZTykaFCUuR9b9SZ2KtHRFVlEHaG4+AgvTamdtbEq\/sceEOqhAi5PtVM6MEidZDkKsAa1mP4fhcVGq7oCxb8+NISkxnIuFF2pEiEoHwQYCmnolznNq83lP1F3Su0ENCcS+rQToT6ssNegcaTAfM2P8VOiEcB1R0CVqMluEW77pIN3EBzU7x+Tx6HRwSbxBzCGrb17WcaAsuaDYoHEA\/hzbsaTzP4CSzhYA3qsZRdvEf3ZztBCRHNASvr+dvVDJEWhioQ9bBbw44LGAkTSA4yy6MsmdLixewO6aYFRUF6U8xmPgB8\/DRqWZ9NMFhsxP+rjONJUdyCdLcb1FIOTmcncKqV+njREAfssVmrq23A4Et5slfuDAiLDhw9VZrpED5bDNupU4tK4KuRngMqrU0ZRlkhPu67vUtFwSfij2Mmlm5mbwwhGb0QzXbSK\/HlU51wMnHbbctfLeefucOCsudTcmQL6grTL1sYukU0hJ0yBfSllSe7SFVQ8eZsZatPbWaeLKYmU6J3yFLmpyhl8kkO4E9UzSr5kkxqRdQyf7\/V87QXF\/nJXvEJJH\/77siEfjtzMh+zRb0ucFaz3Zmt27dH2UcovobWSQmDYyhLgWImB3KqVZijf5oFG4mad6PNGbRRK7DdZTd1U4UdPPQDfQnyzi\/WZt+Oe4yZpt+PxKNHTqXUQ9VCGd7YP4wyCZpbVslKOmFN8K65DwUNlObKoviErZKxIlhrL3gMQiAJtej7zn4VDvK30rbDXBZYgLsyEd+HlgeExko+2n918oOuGjOMejVIqDTMHdCISl9clXq3RP9zfOtndiaMYdQgIhw0Ea35lyLqVcaeFChxvOoafkW90by7ckqYjNcURa80MPAMY9gCvSRKpC4h8RHk+4vEBwc6TVJ9N0aR2LkhSjRJfWrtGhZOxtqHVI6g564VUlR09hb4HN0Aj3uOSEa2TH34rXNHx1QcTkv3E+w3zTQZQ5U7\/kAaVUSBrBlYdzWPsu3fVdoqLFHuIWHNCTDMveKh1yNaqZLIQFnUkbP3uZIZBP8EkHRhLmXQOYYycw+vUowSqOu+aozuVZxh\/o9fdSp9WGVbQOgeUnOVJTuuvfEyvBJaqlw5cuiH9H3MxChS3IVk9t3BV+FQ39QKJKB15PGjLlV9f3HA9guLKogZMRwpxfYIVgsrrrkTkxXxYZ1Kchw\/j196SY87xLtMFv361N+eYuuuxjzs9BmPIDIPo2uieYOcuItqN6gzHH4TU6P2p91Dcyv+nL7u6ZwCvNSJA=="} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":21,"flow_packet_id":8,"flow_first_seen":1603816434587,"flow_last_seen":1603816444528,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"193.190.10.98","src_port":59171,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1603816434523,"flow_last_seen":1603816434855,"flow_tot_l4_data_len":2590,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.112.191.60","src_port":46576,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1603816434629,"flow_last_seen":1603816434766,"flow_tot_l4_data_len":1112,"flow_min_l4_data_len":556,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":556,"midstream":0,"l3_proto":"ip4","src_ip":"131.159.24.198","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1603816434507,"flow_last_seen":1603816434657,"flow_tot_l4_data_len":2480,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2400:8902::f03c:91ff:fe69:a454","src_port":38077,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00553{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1603816434670,"flow_last_seen":1603816434802,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:4800:7817:101:be76:4eff:fe04:631d","src_port":49788,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":13,"flow_packet_id":8,"flow_first_seen":1603816434542,"flow_last_seen":1603816444513,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"3.121.242.54","src_port":60784,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1603816434643,"flow_last_seen":1603816434794,"flow_tot_l4_data_len":2520,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"71.202.41.169","src_port":50289,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1603816434569,"flow_last_seen":1603816444507,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"131.159.24.198","src_port":34511,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00468{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":74,"flow_packet_id":2,"flow_first_seen":1603816434855,"flow_last_seen":1603816434997,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":63,"flow_max_l4_data_len":63,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.112.191.60","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1603816434584,"flow_last_seen":1603816434709,"flow_tot_l4_data_len":1299,"flow_min_l4_data_len":39,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":649,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.189.84.245","src_port":43475,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":45,"flow_packet_id":8,"flow_first_seen":1603816434664,"flow_last_seen":1603816444508,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"193.190.10.98","src_port":59515,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":31,"flow_packet_id":4,"flow_first_seen":1603816434628,"flow_last_seen":1603816435041,"flow_tot_l4_data_len":2590,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"202.238.220.92","src_port":38933,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1603816434628,"flow_last_seen":1603816434722,"flow_tot_l4_data_len":1295,"flow_min_l4_data_len":55,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2604:a880:800:a1::1279:3001","src_port":51040,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1603816434601,"flow_last_seen":1603816435020,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":643,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"140.227.52.92","src_port":37784,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1603816434659,"flow_last_seen":1603816434682,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2606:4700:10::6816:826","src_port":46353,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":67,"flow_packet_id":4,"flow_first_seen":1603816434766,"flow_last_seen":1603816435089,"flow_tot_l4_data_len":2662,"flow_min_l4_data_len":91,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":665,"midstream":0,"l3_proto":"ip6","src_ip":"2400:8902::f03c:91ff:fe69:a454","dst_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00553{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1603816434586,"flow_last_seen":1603816434622,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a05:d018:ce9:8100:cd2a:e2fd:b3be:c5ab","src_port":39945,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":56,"flow_packet_id":4,"flow_first_seen":1603816434721,"flow_last_seen":1603816435054,"flow_tot_l4_data_len":2622,"flow_min_l4_data_len":51,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":655,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"138.91.188.147","src_port":39975,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00551{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1603816434507,"flow_last_seen":1603816434548,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a05:d018:ce9:8100:cd2a:e2fd:b3be:c5ab","src_port":37876,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1603816434590,"flow_last_seen":1603816434688,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:19f0:4:34::1","src_port":35643,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00552{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1603816434628,"flow_last_seen":1603816434677,"flow_tot_l4_data_len":1283,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a00:ac00:4000:400:2e0:4cff:fe68:199d","src_port":52271,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1603816434684,"flow_last_seen":1603816435089,"flow_tot_l4_data_len":2590,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"202.238.220.92","src_port":35263,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1603816434652,"flow_last_seen":1603816434749,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:19f0:5:c21:5400:1ff:fe33:3b96","src_port":45852,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":55,"flow_packet_id":4,"flow_first_seen":1603816434707,"flow_last_seen":1603816435089,"flow_tot_l4_data_len":2566,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2400:8902::f03c:91ff:fe69:a454","src_port":44924,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":36,"flow_packet_id":4,"flow_first_seen":1603816434641,"flow_last_seen":1603816435089,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":643,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"133.242.206.244","src_port":42456,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":75,"flow_packet_id":4,"flow_first_seen":1603816434886,"flow_last_seen":1603816435111,"flow_tot_l4_data_len":1222,"flow_min_l4_data_len":55,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":305,"midstream":0,"l3_proto":"ip4","src_ip":"133.242.206.244","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":28,"flow_packet_id":8,"flow_first_seen":1603816434606,"flow_last_seen":1603816444569,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"193.190.10.98","src_port":49658,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1603816434519,"flow_last_seen":1603816434551,"flow_tot_l4_data_len":1271,"flow_min_l4_data_len":31,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":635,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:bc8:47a4:1c25::1","src_port":60346,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":62,"flow_packet_id":8,"flow_first_seen":1603816434743,"flow_last_seen":1603816444721,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"138.91.188.147","src_port":42468,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":57,"flow_packet_id":8,"flow_first_seen":1603816434721,"flow_last_seen":1603816444586,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"138.91.188.147","src_port":50705,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":64,"flow_packet_id":8,"flow_first_seen":1603816434756,"flow_last_seen":1603816444721,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"3.121.242.54","src_port":53402,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":48,"flow_packet_id":4,"flow_first_seen":1603816434670,"flow_last_seen":1603816435086,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":643,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"140.227.52.92","src_port":44619,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00468{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":76,"flow_packet_id":3,"flow_first_seen":1603816435020,"flow_last_seen":1603816435194,"flow_tot_l4_data_len":165,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"140.227.52.92","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1603816434685,"flow_last_seen":1603816434779,"flow_tot_l4_data_len":1295,"flow_min_l4_data_len":55,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2604:a880:800:a1::1279:3001","src_port":53760,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00553{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":70,"flow_packet_id":2,"flow_first_seen":1603816434784,"flow_last_seen":1603816434822,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a05:d018:ce9:8100:cd2a:e2fd:b3be:c5ab","src_port":44605,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":44,"flow_packet_id":4,"flow_first_seen":1603816434661,"flow_last_seen":1603816434997,"flow_tot_l4_data_len":2590,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":647,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.112.191.60","src_port":53791,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00552{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1603816434602,"flow_last_seen":1603816434650,"flow_tot_l4_data_len":1283,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a00:ac00:4000:400:2e0:4cff:fe68:199d","src_port":60983,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1603816434585,"flow_last_seen":1603816434765,"flow_tot_l4_data_len":2520,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"133.242.206.244","src_port":49151,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00550{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1603816434518,"flow_last_seen":1603816434566,"flow_tot_l4_data_len":1283,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2a00:ac00:4000:400:2e0:4cff:fe68:199d","src_port":48707,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":12,"flow_packet_id":8,"flow_first_seen":1603816434535,"flow_last_seen":1603816444528,"flow_tot_l4_data_len":9920,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2606:4700:10::6816:826","src_port":32957,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00554{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1603816434599,"flow_last_seen":1603816434725,"flow_tot_l4_data_len":1299,"flow_min_l4_data_len":59,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":649,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2600:1f18:2310:d230:5103:7d9e:7d75:374f","src_port":52080,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00553{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":1603816434764,"flow_last_seen":1603816434897,"flow_tot_l4_data_len":1275,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:4800:7817:101:be76:4eff:fe04:631d","src_port":53140,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":68,"flow_packet_id":2,"flow_first_seen":1603816434772,"flow_last_seen":1603816434831,"flow_tot_l4_data_len":2480,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:19f0:4:34::1","dst_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_first_seen":1603816434680,"flow_last_seen":1603816434845,"flow_tot_l4_data_len":2480,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:19f0:5:c21:5400:1ff:fe33:3b96","dst_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00556{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":47,"flow_packet_id":8,"flow_first_seen":1603816434670,"flow_last_seen":1603816444524,"flow_tot_l4_data_len":9920,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2600:1f18:2310:d230:5103:7d9e:7d75:374f","src_port":46242,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1603816434528,"flow_last_seen":1603816434679,"flow_tot_l4_data_len":2520,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"202.238.220.92","src_port":38366,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1603816434595,"flow_last_seen":1603816435011,"flow_tot_l4_data_len":2566,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2400:8902::f03c:91ff:fe69:a454","src_port":56213,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_first_seen":1603816434609,"flow_last_seen":1603816434806,"flow_tot_l4_data_len":1668,"flow_min_l4_data_len":556,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":556,"midstream":0,"l3_proto":"ip4","src_ip":"51.158.105.98","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1603816434569,"flow_last_seen":1603816434601,"flow_tot_l4_data_len":1271,"flow_min_l4_data_len":31,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":635,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:bc8:47a4:1c25::1","src_port":51185,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1603816434599,"flow_last_seen":1603816434750,"flow_tot_l4_data_len":2520,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"71.202.41.169","src_port":37661,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":71,"flow_packet_id":4,"flow_first_seen":1603816434806,"flow_last_seen":1603816435089,"flow_tot_l4_data_len":1238,"flow_min_l4_data_len":63,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":309,"midstream":0,"l3_proto":"ip4","src_ip":"202.238.220.92","dst_ip":"192.168.1.128","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00554{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":50,"flow_packet_id":2,"flow_first_seen":1603816434678,"flow_last_seen":1603816434822,"flow_tot_l4_data_len":1299,"flow_min_l4_data_len":59,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":649,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2600:1f18:2310:d230:5103:7d9e:7d75:374f","src_port":38394,"dst_port":4433,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1603816434524,"flow_last_seen":1603816444507,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"40.112.191.60","src_port":46334,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1603816434643,"flow_last_seen":1603816434680,"flow_tot_l4_data_len":1271,"flow_min_l4_data_len":31,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":635,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2001:bc8:47a4:1c25::1","src_port":49270,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":42,"flow_packet_id":4,"flow_first_seen":1603816434656,"flow_last_seen":1603816435111,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":643,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"133.242.206.244","src_port":45855,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":58,"flow_packet_id":8,"flow_first_seen":1603816434729,"flow_last_seen":1603816444586,"flow_tot_l4_data_len":9920,"flow_min_l4_data_len":1240,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":1240,"midstream":0,"l3_proto":"ip6","src_ip":"2001:b07:ac9:d5ae:a4d3:fe47:691e:807d","dst_ip":"2606:4700:10::6816:826","src_port":41857,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":8,"flow_first_seen":1603816434507,"flow_last_seen":1603816444490,"flow_tot_l4_data_len":10080,"flow_min_l4_data_len":1260,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":1260,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"71.202.41.169","src_port":37643,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":66,"flow_packet_id":4,"flow_first_seen":1603816434765,"flow_last_seen":1603816435194,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":27,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":643,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"140.227.52.92","src_port":57926,"dst_port":4434,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1603816434648,"flow_last_seen":1603816434782,"flow_tot_l4_data_len":1303,"flow_min_l4_data_len":43,"flow_max_l4_data_len":1260,"flow_avg_l4_data_len":651,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.128","dst_ip":"18.189.84.245","src_port":34903,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":246,"source":"quic_interop_V.pcapng","alias":"nDPId-test"} diff --git a/test/results/quic_q39.pcap.out b/test/results/quic_q39.pcap.out index c19d99dbe..6aaca90d7 100644 --- a/test/results/quic_q39.pcap.out +++ b/test/results/quic_q39.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_q39.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_q39.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1509098995610,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"170.216.16.209","dst_ip":"21.157.183.227","src_port":38620,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02201{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_q39.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1509098995,"pkt_ts_usec":610775,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAPJ7rSEb7OSWDCABFAAVipylAAD8RBjiq2BDRFZ2345bcAbsFTtxhDeca1dd1bE1NUTAzOQFpm58AnJnQaHUqfgGgAQQAQ0hMTxsAAABQQUQA1AEAAFNOSQDhAQAAU1RLABcCAABWRVIAGwIAAENDUwArAgAATk9OQ0sCAABNU1BDTwIAAEFFQURTAgAAVUFJRIACAABTQ0lEkAIAAFRDSUSUAgAAUERNRJgCAABTTUhMnAIAAElDU0ygAgAAQ1RJTagCAABOT05QyAIAAFBVQlPoAgAATUlEU+wCAABTQ0xT8AIAAEtFWFP0AgAAWExDVPwCAABDU0NU\/AIAAENPUFT8AgAAQ0NSVBQDAABJUlRUGAMAAENGQ1ccAwAAU0ZDVyADAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1zLnlvdXR1YmUuY29tHmY9ku1OY40wxAcfyyHFWACuKRu9GR6V2xdJs\/1DZWDRgILbvi6YPymdOys8LmRShvdEmFTSUTAzOQHogWCSkhrofu2AhqIVgpFZ8wXyMDAwMDAwMDBOGwyq+nKlq\/7gyjM9fK1HfmcRm2QAAABBRVNHY29tLmdvb2dsZS5hbmRyb2lkLnlvdXR1YmUgQ3JvbmV0LzYzLjAuMzIyMy43EbUkNcc61MtqjsJrlOUgFgAAAABYNTA5AQAAAB4AAADyBfNZAAAAAJSFXrmNCzW2XCwCM6DbC32c2YfxELPjjStDUbaq7wmHTyY4LQBCW\/iNJqUlz2Wd46tERlhzvdEC41udof7lNxBkAAAAAQAAAEMyNTVDwyMTjfiB70PDIxON+IHvmpHtbxwAgQ5AC3uQqa5564NqFQAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00634{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_q39.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1509098995610,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"170.216.16.209","dst_ip":"21.157.183.227","src_port":38620,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.YouTube","breed":"Fun","category":"Media"},"quic": {"client_requested_server_name":"s.youtube.com","user_agent":"com.google.android.youtube Cronet\/63.0.3223.7"}} @@ -15,3 +16,5 @@ 02225{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic_q39.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1509099002,"pkt_ts_usec":658145,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAPJ7rSEb7OSWDCABFAAVipy9AAD8RBjKq2BDRFZ2345bcAbsFTok4DOca1dd1bE1NB7n\/rpIFgHtUM96xZF0GVfYPWRwkZ4yP60AZq1GHb2QAF7rjwFpSfz1mj\/EjuaEhYizFTmGKt+91IIo4G5AVRNyMWWITa1+O6mILjEhpLETYoIoWTFfErxi2z6NsrSzzpd29SL7Cnquc0W3z8omOIMtlB0rvgX04jKKgT32hlpVFK0sazG\/3WEgWEKoZ57DQCO9WERU\/GNcYGxhFH3Un2mFD\/WyTLohtkpFjtTYf3a8s4X4qlPJFPuwcThJ\/BoazlhaMbmCj+8T4mSqhW5EDv1D\/gzwF9YBx+uyYmBx2XKJUO5wojo+1jz8ll9Y7agZ2dvomnEdhK\/glxh+M2DwHeo8bv6DM7gMG0SHAEwQ4ME2mQA0FvxGP6EZH9OJ+6ss6deSKDzsUoYgF0lQQBVV4Jc8zUjRcZ170PK7jkTgizBbHElUuDjecZU7FjrlIsNMeWAplvUulCYEawFc6k3ABAsIbzi2Qw6A884B3kzhbjGSJECuncxhjYuJnXzI7sDwP2ghXTkyA+kimHL5766qGwFqeaMTMqBUhvtN+aiIsYLfvcrKn1QslWdEgXuXUnDQzgd4PpHXGpcFnFgm2tBb9tIGrObkeSxVvqtHcE6xhLAhvXcVrNTJWwnXp80idCzE0nlrameiH9BxweegI7AleU29QRp2e+9ygPdL3\/IVTRuar+bVlU3MAPUmzp7EfXKncnxansGPswBE68l1kx0uQH+LzrJATDUZnodrnSBYjKHAQGs9Rfb6Wlz4VuBtSq6Rla0sx\/nIvVUQ6m0HRxvF46NDFVwajCWChs+dJMLKi3TetsbUwbtLawOTlEDenA5144T4lt64q3dtzd4VVnhFthY3qCpdCxEtQMoWRYA9gCSA7rCFLiPmQmy4HAQ7rsXkw3C9629mSxM9HCbIcf9jymgYoKbTwUNPyXh4FAB8p4lSxWSZIjrWNrnZ73Nhy7P2m3DYcpW6XJa152Hayr3pbOJW5Kj0j2ug1elYfi\/NLpbHbFyJlUNYGXsMMbmjfygwucIQ2ynpgpyNvxt8XAS\/sI4l1GIIG6MtxOucYEDtavEWjWGpgSiKedS1fvTxBvADquDHg\/ux20iYHbks\/\/p2WGriTQoeWEv1kSlSdT\/gEfbgS5IR8S4E2ncu9qlexOuGA1EpTRkQ9SgSVOMDxtOmDMI6Fex1Bi0vp08RpTSvDbzW1l1QiNivixatyGJl1FF46DjtY7q4OYHlGhwQXf2gA2HJeqUWZ3XFjxpJAwQ8xoKY9nelCdYBsBgAgbZM\/zMO09cj+Vzcn8Wg54UkmIc22VNoKzGB89lH1\/51gA4UN+wZrdYSvaLjPWWmrlheua2aQUk4xdVlxjE\/Yh74tM3BWCMDegflbfLLX4MdA\/nbOGKabWYCbniNuCsgmimf3+guIhzVspib6f+yR6\/6LleVb8gfNcwO4NS6CruaVil7mo0qoqrGaNXKBeP7dUnP11VGpvOBvS\/eu3BHQIqbkNr4T\/2rAM66eOELs0\/cvK3Ag4Luxy\/jMEXDVXr1Xuz0jl3CImg4gEBjlT1ur51Crko6QVANt0b7VSyiv3x2dk+pAwN8fdbvhXHHdUMj43SdWJqiTKaPqk1WAutn1S4DZ9oUMHTZVRVApAuwSTj6Ieo\/KdMnO9SoiZPva9AhsU2bDvsjxCOOdD+yYAmOJTqwkbQzSwVLbgL2uMGtTM458RyKe1i5GuOa6L+JyeOfebUifLHADasrdy6Nl2+Linzu7yIK0AyA67FdYEoOL4Uju2WRndCx8UAIvXrOeAAXyCZl1"} 00441{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic_q39.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1509099002,"pkt_ts_usec":669430,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAAAPJ7rSEb7OSWDCABFAABAAABAADgRuYMVnbfjqtgQ0QG7ltwALBnVAAdiKdDVFsewFUV9tQMV4S7VXC08w2rtkQj+4PK61Zm2gXhH"} 02233{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic_q39.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1509099002,"pkt_ts_usec":669496,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAPJ7rSEb7OSWDCABFAAVipzBAAD8RBjGq2BDRFZ2345bcAbsFTnGmDOca1dd1bE1NCEDGSCS6CpN1gn+hs3\/OBWtuqhvbB1BmM0CLGfGZXhrE1a0YMUWLncsB3JYlR0zQR58euNUaKo10\/scQGQnEFufSBkgnU2frk0WlzryDYm2sz+IorYl62WCRmKOufrjmnfRuxa+QmKZ5OSOn95peSYyEUegRkVwv5J8IRpZfBNlSpkW3GlKkUGpPzOvZQCQNU6ierzq8OyOsKYBXRYE8LTgbRzx5bvR0ElNCUGQHcerGgiqoibt8RR0OVvZ7XuQlXrh1LVMkCBleV3FI6CoRE3mvFkZD71LGK251GpID\/BzrZBprJLKWSkM4L\/MCUnhQ3dDueCThk8qkjpfnkm4t4oacIr1CcwiGfIVgFCWdiQpJYFqK5EtjXrCILEaJSYSlqirijr8Irw1pKxlb7KRyNi627qiQeMULDWWvkd7cNYL+RvcKDpuFItNgZ16cKJpOvy3B+w8YcNlTt3QbB4JaY4vtTD9ql0+oBKH5Cl2sQc1wtWaDwNo85WLijHkHfKn4kResl2rjWTzlPF9CsN6tMqaeeqKqbvEZAE0be4eblaB3RtHdiQ1IPhOnv71XkHArzB5ggHUzn4ZWQ5qKViJtNMgAvDcChWV5opIzw\/zFWMaaAHrrX80tyo0\/Cn1vwu9GKmBk1kOk0qxags\/Yby0BCWH3R6qxpjI2ePbaCAN\/CZ4mrcnjtd8\/8yEoOC1F\/NZQureeglyyr5WPZdl+I9+0icXcSSWIGbnMbCW2Gqnan\/PEF6yEFRbrIuK9rz+CKpCp3xWhcprXViDQXiPQTcVafXFF9iSjEaxr93GF3Tx77dmBjDyl+bkysejCHxgldhZJfVsQ9yXJZvHA\/vikr+dthXsOJISwApyvvOagJZNt4iwhFcTnr3sjxdBSc58qHCffPSg3CAqNi0\/FqcTa4IsqpRiRnoTkCfu1XF8SHBOu7AyT1c\/fubqE3LU7GukFqoj+SLNTW4cgl\/o1dy3bjrE8ZZNBfW\/2mhLblx4\/5gxbCsFWA+z4Ga9oLn33ws8j\/IOK\/9gRz5POJi17pLerOmQiJc\/rZN0mRVutFQUbBeBhU38zQ8++WcLY3uzB1tJli\/EQIwvmz1C5pTLqS79DJArMmvPMlmyRgjcAp\/qBAh94PXYN4Y3cbFc0kIWhDsG3MAoVKL6ptZyFg+OppJBQcRfYOFYvlhnRbWycb4pB8wzuKEGvNdKGe05WPkznr7nlJzkYSAhKlQ4JdYyvdT5aCd4p12shaypPbEKAyC+txXhm320YtM\/kAXnq3I6jNeWnWsWifcOCbYKKzlI\/lI9mAa34CHbC1wSujlIRBZBulJ5XFBpVcepctnc7fE1yTq3bKuOqNaZm\/j6\/RqnjSGf6hIiFirXwp\/K9IlWEsg98he6FmjSKQnZ2IU1LNlO6bsvarQQax\/krnwLzJbNKti8k2DS0AeKAQRaRXgW8eSm4qkRH9oHbEhAyQBSL7AeBg+U1oU9uMxPyIKGpSkkldySR3pkomSIF\/ixuiMmKDtUm+xzWoqga6ZTHMJMTFRrfGt5I7AXVA9Fq2\/OoDiaB49rmJu4CWOz7PjQrr8ww0Y\/2kF15xDM\/BZlFUfWXw9EAoNElGskiYB6oy+PBTj0dX1z7a+Vg5V4TuACnZrya0PKssqXYUMLtr9uO2YtKvqZk1T2hpa1h5XnLhRl255ZKEiFFAejFgu5WiQy8+db6bZMAtB84rYRAAbfvdvy2q+YpkjjAbhIQI1coBJ8yKsirsK2i2F49g\/nEOs7XxmMidu0K0orhrVjAa8mJjs3qw1aXW\/E1"} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":60,"source":"quic_q39.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":60,"flow_first_seen":1509098995610,"flow_last_seen":1509099044559,"flow_tot_l4_data_len":22131,"flow_min_l4_data_len":24,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"170.216.16.209","dst_ip":"21.157.183.227","src_port":38620,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":60,"source":"quic_q39.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_q43.pcap.out b/test/results/quic_q43.pcap.out index edd152513..d8e202f9d 100644 --- a/test/results/quic_q43.pcap.out +++ b/test/results/quic_q43.pcap.out @@ -1,4 +1,7 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_q43.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_q43.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388060203,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"51.120.20.202","dst_ip":"72.119.217.29","src_port":49241,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02201{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_q43.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388060,"pkt_ts_usec":203207,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAA0A1ZJ\/CABFAAVitYFAAD8RFzMzeBTKSHfZHcBZAbsFTg3gDeg8d72PiRX5UTA0MwHUpsx5z1djkhIB1MqgAQQAQ0hMTxgAAABQQUQAKAIAAFNOSQA2AgAAU1RLAGwCAABWRVIAcAIAAENDUwCAAgAATk9OQ6ACAABBRUFEpAIAAFNDSUS0AgAAVENJRLgCAABQRE1EvAIAAFNNSEzAAgAASUNTTMQCAABOT05Q5AIAAFBVQlMEAwAATUlEUwgDAABTQ0xTDAMAAEtFWFMQAwAAWExDVBgDAABDU0NUGAMAAENPUFQcAwAAQ0NSVCwDAABJUlRUMAMAAENGQ1c0AwAAU0ZDVzgDAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1kbnMuZ29vZ2xlLmNvbR8ykEILcj\/tFGrck4XfPyIJIy1Wp2EOyj96Sbv5OxbQ7GtzdqXVHstRevTu5j9sOKKoV3MEbVEwNDMB6IFgkpIa6H7tgIaiFYKRXuiYTDAwMDAwMDAwL8w4xnPBiaheNE18yX+i9poR99hBRVNHfnKffIxl9aDtAhVkrBteYAAAAABYNTA5AQAAAB4AAADs\/0Yi1mMvJ+MeFLVM06sFxTPtG7icgHbJd6FPguzZ5DspSAr1qmJOAogGqdfyO9QJ05Fvsk1n4Zg7QCWE0DkiZAAAAAEAAABDMjU1W+x30vZEmVNOU1RQW+x30vZEmVNgMsuSoEFN3\/mAAgAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00573{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_q43.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388060203,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"51.120.20.202","dst_ip":"72.119.217.29","src_port":49241,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.DoH_DoT","breed":"Fun","category":"Network"},"quic": {"client_requested_server_name":"dns.google.com"}} 00432{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"quic_q43.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388060,"pkt_ts_usec":251652,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"AAAAAAAAAAoAtmi7CABFAAA6AABAADsR1dxId9kdM3gUygG7wFkAJsU\/COg8d72PiRX5AdVtByTcf3A7ZqGOSkABJDYBAAYA"} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2,"source":"quic_q43.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1592388060203,"flow_last_seen":1592388060251,"flow_tot_l4_data_len":1396,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":698,"midstream":0,"l3_proto":"ip4","src_ip":"51.120.20.202","dst_ip":"72.119.217.29","src_port":49241,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2,"source":"quic_q43.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_q46.pcap.out b/test/results/quic_q46.pcap.out index fa1f6f606..734a5f6a0 100644 --- a/test/results/quic_q46.pcap.out +++ b/test/results/quic_q46.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_q46.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_q46.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1559632338055,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"172.29.42.236","dst_ip":"153.20.183.203","src_port":38292,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02205{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_q46.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559632338,"pkt_ts_usec":55044,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAAA4JDHCABFAAVic3hAAD8RmymsHSrsmRS3y5WUAbsFTk\/Qw1EwNDZQ6s\/m5wbfJy0AAAAEYNpYkp9oOdCGDvxYpAEEAAQAQ0hMTxoAAABQQUQAtgEAAFNOSQDFAQAAU1RLAP0BAABTTk8AMQIAAFZFUgA1AgAAQ0NTAEUCAABOT05DZQIAAEFFQURpAgAAVUFJRJQCAABTQ0lEpAIAAFRDSUSoAgAAUERNRKwCAABTTUhMsAIAAElDU0y0AgAATk9OUNQCAABQVUJT9AIAAE1JRFP4AgAAU0NMU\/wCAABLRVhTAAMAAFhMQ1QIAwAAQ1NDVAgDAABDT1BUDAMAAENDUlQcAwAASVJUVCADAABDRkNXJAMAAFNGQ1coAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tcGxheS5nb29nbGUuY29tTF5QaJRKaTNoSpJ2byVw\/n2jR\/SXiDAUaxRXCyDlaH13oYGRvmmLh5UfnwV+qkP8rBLql6P0cVhpCGDXJyou7qdg+dnByWJAkTSY+CUh8yfYOYMRdIFYIeO6ZKEQGzvhOWxsGdkkbQk0joNdUTA0NgHogWCSkhrofu2AhqIVgpFc9hnRMDAwMDAwMDAg1WpdFEihkws6cxoJh1cnEudv5EFFU0dDaHJvbWUvNzQuMC4zNzI5LjE1NyBBbmRyb2lkIDguMC4wOyBCTkQtTDIxqZ2LiTEPPlI5bOtRl2sWwwAAAABYNTA5AQAAAB4AAAA+5+ExAY9KZ43WAi5gboQGad\/XZY9NgsCyvAvlen24imYZuixux5QJ4+eD6hkpSGJfDn9+XBFyJ61rFG0t2MkrZAAAAAEAAABDMjU1M\/in8FpHdkpOU1RQM\/in8FpHdkpn+K3FgBXj\/3u4AAAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00634{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_q46.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1559632338055,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"172.29.42.236","dst_ip":"153.20.183.203","src_port":38292,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"client_requested_server_name":"play.google.com","user_agent":"Chrome\/74.0.3729.157 Android 8.0.0; BND-L21"}} @@ -15,3 +16,5 @@ 02229{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic_q46.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559632338,"pkt_ts_usec":335209,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAAA4JDHCABFgAViAABAADURGCKZFLfLrB0q7AG7lZQFTvNwQC77GGg\/G2KJWbGGOgUszpAlF3KPEXfOEsYhxF3SWYHIa9DXYq6sfNQ6RxYrT02zGOqoohi5Wm+dCKA9SM7roCOGggUqH7XqpFsLEKnlgEDt1h5hG4sBrBMxs9WAOI0cOKmOIYWDytPX0s0jKJZ19nxGdtsmtIrnUIFw3Tu4LaXg8rF0YbrY5\/dYn02VniGV7YUUV3NecAgKcpToXj6AsqssLIUfUX7K918mtk6VOfBPijWiySKk6P8caGBy5s3akpkaLPpn3otCOlyCA4i5wKKQezmUL9Ey04BxX4oFCX+AzwpYogYWgECiZIo8wliQbQIEsMuV7P0Ayt29tDtCySzGzv32dpM3v3G3vZ1St0QRDf\/EBdXuVnmOaZUcOWjAG9YtwYpBQJqgFcDhnoCBMpKZkxcdiXMs4MUK5P2Z1PLnJX2oDBpC0WNrmACZGcJ0jlQEdtmVvVO\/+rVOKoFNkQiKK3L6pFMpzgGVv77HAWNX\/SD70yXQpmxIOuVYhj9Z5uD12RV7HOY+4SIBkknyyf35TMs\/\/PSTsQwTnAEVuTX\/TjhPrvkp7993JtGFiZ+nHu8CeK19n19nKFzEdy126USIXNbSAvNdbvFTbcuNXNdBqdgfIcsFrYEFZHy0Hc7LZ\/UjNCWuSBLjbsEvmj+eiYJjH19IOnHVU3v3Ci2YWd2BwMGqWiJfWyi6kUe52kFkDVMzboOuRpAgZMFEBP4d247loXK2Zf+RUXFfm7g0NxbgzU1CLn9G7USd2BVCXbfVve3a0gcTlCdHLZv\/\/Qj2hVA5AzMV\/mQSebhKKFRf7o+ozWkmXMt2Vbl5\/FrIteryQiZOtzobzVLuqomZt4k\/ilGWjGkYirOC1CJ2O5vJ8w5UH1mjsBWWwVUJe4gm42\/eFDmbxjEEpQAvjHQvnljeNV5HZBy1fFmRRE6strIrNogXoH9wqQXGQUR59di1YOzemzEoPs0c6o1S38U+vY77Ynkg\/Ljo41J3zNrf0Tff6DXwftU1e4cGZzoyLQfvhNCC9IoeU\/JcuYbuSP3wSUGC8NtV5MpUxY2ZZhpwLHngNcrRCFxPA\/mGDAMe0WzFTcrLmhLDOnaKrTXf6Sn0ULe3O45yMJ4bQh8Vyb53iP9DwQ8bN\/HgqDhaoumPzxIDCgwI8wTIAIfqPOHEWdNHMNFtBtxf1kNgS\/ef+cM65gFeh5IPIJ7dwTJF8CcqWkkZBBtPsMUvlxx5dbPk+8lQNQKtI8LVvvq+O7tgjK\/LIroc\/D94JFBBwI1lgbr+AX7OJszqSE\/jFakJA04DkaFGZazrVJg4AvpvtAEqrqebVHn1Eqs8oJxtgPZo1YZbkASpne3a3cnlu+6YBAGFR3eMV9nftmsgm4cfbpfGusOBdJac95Dce2cz+CwuAt4xR5ZvUuTolNRbruMFdtV\/KVojXxQtHNsLEDShE6aVLX1EDQl2aIWHCzKiyiMWgW2WZLeurdZqMNnXC4OvY1iNFHhbfsb3AoNpll7MM13zG7AmbyeG57M0k3YPuv0lxU1kxEP7RJDQFZa9i15aTsLIOsqJ0s2\/NPB2OS\/UPdz2gmssi0\/5Oqk+i+nvgiIwCJ03LZZ8DGHDzpdcczbO9qHsoOe7xrnqFcPZ+XaoLnbS1addQIib80\/tjGr1PkGqKlmlw\/3FQ0xUPuoWY55dEwSjzBykcd7iG93IJWEynOgk4AzHuDStVPsnhgt6Rch4DszaA9GtdvUllxevuKkhUWBI1+UHGLkt2WVYaWkgoW\/Ui2j3mz9lX0v38mwEEDdD6FMrYgTYO27z4nFYEm6y"} 02229{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic_q46.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559632338,"pkt_ts_usec":336220,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAAA4JDHCABFgAViAABAADURGCKZFLfLrB0q7AG7lZQFTtgRQC0JTGzsSSfYHzP1PXWgALe4t807BCb1pJ8OtHMred3ifs8lCxeen+k1HTK67t89Xh4IyU23v3zzGs\/vt\/l1KGzBejYwn3+KPgeJHTRiT2p8R7eWw80f3J0Av2vF1D5oHm4UWxXptodklomg9qq\/8jr2USOiFYQzo3adzMeinycSNmf17oLVHN65ksNW2MCSAdWUzouy+6knG3Q3RlUFGalVRJPLzsCLgA5me1zDTsBrC6+9OydLmIH\/\/GcllqACjP0ynheBL8Qqki\/SpyYnhRUGx6qf5Q3B7Auv+M9BKaUnG0WGpOVrXyv6exClL5nir0aXgIBVub3hoMIjlojZ8nnY+k2\/yx8jMdxDZjMiMH2LTL7kWuzZu2AHucyXCk7O65Wa4qztLYwnvu+KPkyyj3KyFKj3MkFO8WXfPRMVPFnUv6GWyzXRs4o5x\/y9IGW71H4C0+dutoeFmkCjnj9\/+1zubdqJ1aM3zdNK\/zUGMjwv33OMsbtLJgB5moNpFFfo1iBNS+Ys04x7R7slgWGF\/Lq+ZRnacAXWIbECyAxZUZwGNGvH0wIsJGX+5asIO+fzKNkhZanHeZm+XstrNaq2cl7UEy21PZHfIZNocs5P0aTp\/ynxPP\/hEl\/REEYrlgYCNyMZUCkglxeKl4MSJnMZCjiOlF6ay\/h6\/KpUa\/57z+604bmmNGorxk6\/e\/7a4UKpIwoOiUm+5AioA8Wi27msHfzUBiFsYVZLGVHyCxDtVz2Bj7y4nYohP2nkLWPVzCyUExgBB3CaMxi2Lou\/oDZ\/JJIPtu4\/F3sD1+cDyd2urf9Q82E0bQVddlXFr0erQYI9LuNI99bh4xjcXor8gNYDtMtDGxTuerTXXAlkVBbuVr2Fu7Cq7tpn2Yhm2nBbWh0JHSWTU4oc\/3z3hLxYtx9dqNICPf5n2woKdabnPgwPZBWJmn8Hj8lCpMk1j9qvYZ9HwsY4OGVKBl6E4se8\/kZZfnf6hozqLYdTA6OCsOHGqct1Ygc4ZKHRcnp0fyqFGXnM5WV5Mq64qKX+2Sk5jqrcd62OqfvAItRDyqc0VngUWmbsZWNd1ukwCBOsZYK+ER2kZljep2IdkvDHh8EttBGiZWwjS2xskQwzPyQFUIcEylowaqHnbG1leuX6G2Bih907hkuthTe4r9cfFIL33856R7Q31tuy8ZCFERUUzpJ5jKauZVv2Rzr2N03rc6giYsQ8MZYu2pKmfDIi31jlEY7cNKwl0Lh\/kvlM\/RAeuknFCDVDW8SlliC0UMyXISImeCsetAFr1ASL\/iYy+Rh\/aF0R6yzmRAZuTBW1zsOo3vLeQ4Lawe8yOOqcQdL4L9313Afkgz6kLIQ0V2GgV\/MM2r7Gi2iyX8UIrCA+KfofYyCoR7qdwR7YRFsXSYqmZiNAKD4TAsryPdbxIO5z05OmZx8YHcBy2S7qTFo2tT4K2kmL8DH7G0w9uqUeidJgQQgzNp0b5sB9M6VcC6YsKj8id9OBnfNlPsNHJt4UynPZUlnwpAlNgEuPaJ0fhjBxw4w+ruaRVv0ZxvStphtTiuR67VSybpixYhkJW8wfWklb6vRz1faeZps6i7LigZspWX93Xxi1URT0T+9rPhnbWiBzF7SoiEZWbfPTGDnJCuQmg4Q\/sRDWfebexQmJTgCmkMx3YaILcGvdnfZGsPj9bjh8Wh+c1yqEwfHZOT4vcUs2+0KJV6gMNs7vmNVaTtilGUm+n45TEjckEJm6Tg56MEsR2FNkNsVfM5aIxY9uOZFdgU+Oq3efzGBTLFZXdmZMtsx+acYNQlQZkA3J"} 02232{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic_q46.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559632338,"pkt_ts_usec":349062,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAAA4JDHCABFgAViAABAADURGCKZFLfLrB0q7AG7lZQFTvUmQDg1EsYe0Hw4IIPzfn8wfNQhwOn0an7tljSwOZL4zdhRBNyMoFMRXJWnT+JKgN4pD7+fWIL9i6DEJpDVoGv2Uyc4T98H8kDMlfM0Sh396kz9TxS6vHpzFRW0yVGhF1G1nZtl1xaVLcWveCedsquOHu81jW0KUPC3OoDp\/vKHQNGwirYR\/c2IfZ1n+Wgk2\/O5aff6LwgdCVhHe2qATBRrzTPV5+H0Yu9lzgjnKSLkjHWnmjpmMeSIqGkcf2eregarfZEY2xwaO\/nw\/WOXa7BfkHVKowB+nXXN7PNH3M9daCFDBW\/+VkpKhrCPdYP1t\/7E0UUqE0Yz+okqAkQjHzDyin94wgqnC3Wc\/dk\/5Qz19ilZRNzwK3pUXuPnSXCxzVgq88OPEsQ8pd63tOVj9LTagAmzkowopTI3NSBPFvLyss1AF9ywgLX\/LD2qE6DW6d+RhJ9dVonXLT5F6jPPkIu53iASUeZdvvk6aEeYpRVa097cV1XhheEEVhY7zNvTZpuYwuXokrR9TywT7+bmctPhCDvCJeAmXforkEv7U6w\/FYMbeorFMhloXX90EBwcIydyfhujAE9J1cFvFPvqUSF60S9yJ4ZJ8Ww98mnC2a7L1ezLjZcu3ZEnx5pqj7euzmW58dKwHNoGgrNJfNkryBfwXnZ3j55DDi68cXNIYf5Q1U2m4DzXZ\/ZzI\/YMYS6ayMDBOHPk8GqPmZfz7Z2ZZCAzck0fSzAcTz\/7eO8exGoQmraKj6BojVn1DsiqqpXi42NW5lTsYZdKOt8R08ZmwJkNm4upspaZgf0Fo\/Vr0j08sUjClYml0PQJPcMO8zb+nI4vhMF8nKybaZS9ejfMtgIuZuwqIlsGDSkn1h17\/dyiHg\/+N7YyjJbCBpp+srcxF59j1g1K5ac3HQMTS5XK3YUlWqk\/MS761E04dEyULtNCsXFvhz3qLEUM7ewLwe7VP7RHMk48mPcwYDtDI7BmoJGAQoIeObu6QUxjhKJlcpK9eCi+n+gqZJ2BQlMclF2xlgk0PvfNEKlsLlpbBPPtGuWfgMx3QxcGI9AgwygYjc3duP5soQrqak0aLYc\/9rp4DN\/4SbYQXygarZ3OQ08Ye7+JcJ84ykWDaA2s+mqBSWrOKarhbGH9TLSNj9RmuJLQ6e1siFVefkspM\/p5wVxegy+Tz4xhyoni7lOcF1PalxKJ6fDQGpRtSuP5KutRpSlGMla2CU4uErznmUC1RtEnon+OJoF2uIYRc3XTL5fWaIEldzBOS1KoV\/cETBkh3I5NYO+7ByOK8p6xXsWfTu2xXHaVtqJAeR7hr2v72QgPzvMDDO0Fd1zRBBPpEpLyRmtUYhSqPyb6zsMJOq1tqZn0dqBFbieqdA4EWoDsib6EoL6uXnHJJU\/3RYe\/\/kfmvNVIjoB\/Jq+mwlevm8YR+cP55qBHlh\/TeE2podzm6KHrNTyhnB+A4PXc2M4DhCdxhzvI4lyf5qctN0bFMx1D+srUAYtiabuLguT0sEwQUOImlr8oJOTLk\/1xXcGSq7\/Z9sR5K1Ogqu6caz5SHyFBMquy39RGYIpkYmRnJx+nTPNjV42v+uaEoQb7EjEnRSjpQozX1m6w\/Pk1cMQPKCtgOoQCiNT6Fy\/LAbjrARSIzAjEftlwNihrRen1igci8e84GbTrVMzc4lV1k0SZRckwFQwYvgXSLrH6NHBlH1osX7rTIwtvEYUB+2TUjSV2KHNqlKQqkW3g2WfmWzfNiABYo3Epcb2MEA+Erelxn2pv3qxh7\/w6h\/ZwfQ66atOb235o5f3HEPG+QzBvLrsa"} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic_q46.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1559632338055,"flow_last_seen":1559632338367,"flow_tot_l4_data_len":20561,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1028,"midstream":0,"l3_proto":"ip4","src_ip":"172.29.42.236","dst_ip":"153.20.183.203","src_port":38292,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic_q46.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_q46_b.pcap.out b/test/results/quic_q46_b.pcap.out index 3abc39f6f..e8fe20afe 100644 --- a/test/results/quic_q46_b.pcap.out +++ b/test/results/quic_q46_b.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_q46_b.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_q46_b.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561708873328,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.69.216","dst_ip":"110.231.134.35","src_port":45530,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02272{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_q46_b.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561708873,"pkt_ts_usec":328442,"pkt_caplen":1440,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1440,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAIAGNwmCABFAAViWnxAAD0R9xCsG0XYbueGI7HaAbsFTnXjw1EwNDZQ0aOrrPYcbNEAAAABZ49NM0tlJ\/QWOEX0oAEEAENITE8ZAAAAUEFEAOsBAABTTkkA\/QEAAFNUSwAzAgAAVkVSADcCAABDQ1MARwIAAE5PTkNnAgAAQUVBRGsCAABVQUlEmAIAAFNDSUSoAgAAVENJRKwCAABQRE1EsAIAAFNNSEy0AgAASUNTTLgCAABOT05Q2AIAAFBVQlP4AgAATUlEU\/wCAABTQ0xTAAMAAEtFWFMEAwAAWExDVAwDAABDU0NUDAMAAENPUFQUAwAAQ0NSVCQDAABJUlRUKAMAAENGQ1csAwAAU0ZDVzADAAAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXVwbG9hZC55b3V0dWJlLmNvbXgDMRgyNKjZnbeNIexiej4o7qx+V929kxA9dDLsNr49+J4e7Bxt\/tr6btXxr2ajG15fa3Ruq1EwNDYB6IFgkpIa6H7tgIaiFYKRXRXJTjAwMDAwMDAw6FYYVlvjBaujP6e+o70a5ZenNg5BRVNHY29tLmdvb2dsZS5hbmRyb2lkLnlvdXR1YmUgQ3JvbmV0Lzc2LjAuMzgwOS4w1Y68K3sgywV7JQccxBohdQAAAABYNTA5AQAAAB4AAACrpFnJA5r+YO5RcQGpd1l4yFvK+8akrX8Ivr05rqkgauMBpMQ6cwQFDJS6sLs7Du5\/2eIOY7vG9b+CMCy0OZxEZAAAAAEAAABDMjU1jtxYjsj\/DkhJRldhQUtEM47cWI7I\/w5IZ\/itxYAV4\/+8OAwAAADwAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00646{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_q46_b.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561708873328,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.69.216","dst_ip":"110.231.134.35","src_port":45530,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.YouTubeUpload","breed":"Fun","category":"Media"},"quic": {"client_requested_server_name":"upload.youtube.com","user_agent":"com.google.android.youtube Cronet\/76.0.3809.0"}} @@ -15,3 +16,5 @@ 00489{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic_q46_b.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561708874,"pkt_ts_usec":215506,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":28,"pkt":"AAAAAAAAAAIAGNwmCABFAAAwAABAADkRWr9u54YjrBtF2AG7sdoAHNKWQAciM2TV1kQiE1qM1Kw6R5Tr1LcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="} 00902{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic_q46_b.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561708874,"pkt_ts_usec":385304,"pkt_caplen":412,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":412,"pkt_l4_len":330,"pkt":"AAAAAAAAAAIAGNwmCABFAAFeAABAADkRWZFu54YjrBtF2AG7sdoBSqgFQAiaRoBhm4qKJVTpkA3mDdIBfkdOkRvPi+OiQ2f6ebmI1YwBlsY02KFPc0pkrRO0ovTlT0Lcre6Tsq1rGTZntLXdoAc5wlMtHMQO9b0N47QPiGMudRCFZvQ7xo4\/Oqb3JkD75KqXjqoA\/dl+h9qdDqMp0Uq8fkl0Ttwpc8qUhpNe2xry9oglOOPazua4Wvo3lLHIvuzNtIlrBCh\/HJSZNYATUyofFp6qNulSMmakhMBq9G\/XApD\/AN5xqFUCGBrmAvJrztu9HLfavKHt3gexWo5NtTQrLCfNJez4pKYUotcM\/44wDEwwDyQZkIi2pkOyDhlqkIYgFnhZDvk4n+fQoH\/44Z3yc7giiqCxjERspi+JlpXHZUasYidNtuB5\/yIfpccbo0mgNeTKaktZ7VbQcDEhl1jOUJRTUX2eKXFmYosmPgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} 00485{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic_q46_b.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561708874,"pkt_ts_usec":385304,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":24,"pkt":"AAAAAAAAAAIAGNwmCABFAAAsAABAADkRWsNu54YjrBtF2AG7sdoAGCfVQAmmRyNJwJ7Eza+L+zYDjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic_q46_b.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1561708873328,"flow_last_seen":1561708876422,"flow_tot_l4_data_len":5380,"flow_min_l4_data_len":24,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.69.216","dst_ip":"110.231.134.35","src_port":45530,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic_q46_b.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_q50.pcap.out b/test/results/quic_q50.pcap.out index 06ef8bf53..3e24daed1 100644 --- a/test/results/quic_q50.pcap.out +++ b/test/results/quic_q50.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_q50.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_q50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388088469,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"248.144.129.147","dst_ip":"184.151.193.237","src_port":39203,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02220{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_q50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388088,"pkt_ts_usec":469619,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAUAeJuECABFAAVi6fZAAD8RV+v4kIGTuJfB7ZkjAbsFTkJ3y1EwNTAI30oInk7\/XnoAAEU0Sh+G6jJaQ+WVeKqfVhwekyVcdAg3VVt4yXAoIvukSElad3ZdF7cP3aK8QwnOEdppZZL4NlS1J14QMkJkSKLH7KTs\/J1g5Qy7Td2oJivMgU4heBjsrEKX+Kl+zumCGj7r3rx\/PiGGoerDCuUYVs8\/3DPxrp05vPpL4oM6Ym20RL14LkdkclpZEotPzAVfKrp+bORIrEsOakCOFcnmRLxpaPe+skuFxQ7e+No86i++ZXUpHINRIOrrAKO6MnqhHg136TH30JRy5V1vvrx9mRvozkvzR4RrmmOWFYy9MHcYvR9ozsenVMRZ7mYRkPWmCIPXpnhEE4otBm+PYFJSnVZnoQYn2HvDgKZX+IG0tDtVasnvuIWtUyehZMOA3Auz2JN+nSjxfDEV9Q5eGeh8ZL7tXInICXQpmTBohUGs0nyUi\/EfxDhlCRPETyBYxPytgznwCOTRnGV6yUDNYNW6V2twpvbbFw15F57Y24i98N43glYYJUVqHmVwrosseQvdWLtOLEXpAKvwYCJ3nJpSVOyBYXd8okAO08VeVbydpen0iUOESN83ACwm402annjMIqbJEkKbZr1E\/bWLUE9ayryc3t4SI0rfAV3P7Bzoh+ePS0lFG2mEbR3Stl4jejVA5bbBNdQAl2XVCvlfkMcgN6wNzkaUtoY\/V5wJqcqWfzxU\/7CxIyuqjs2t5GkAirbR6GD1vSMG8A49cBdJIe0YUwOEL94vJZZ6kgFxLSzbkqIb\/JGeunCp3ImPtw51lpSKmOzgu+aiRAw0072bcZedmowvyNmMZ6ZwF9G2\/T1BzTiaxUQiuwph0MpDNq0KE8ZLx7252+rHJYkpatjHePpFvOb3XaUfP7KqMGQXysXzDurgMN+iUJmRB27gfV7BceLcaKv4JsOEla7D\/ujhuQ0U6YFyo2O4mZUs06yMlW36Jh9WkejggHA6SE58C6aM0tZVAq4PzUVmlUFs52p22qgRq5vex74TEu58hdkCQjr1pQ94XFmXqgk+AVK0nXtqdM4JYhPeaV0edHucrnphtrDalQIUwHX7zoFqP\/AzYEoeCztqDi\/kawodxc4PmEb6NM25k\/CXUeCX4uUwv5+p46bN3O1M+xvlb2rRRFG9UZ157Oh+jebOu+0rTdiK67yyDJDMe2VTvGsXi+\/G2gN2zIWwGydc\/InHPRNNQKfHhC2jggd6wv4d71pPOaI+XNe1l7JNMzHwfbkZBDlCbcSj+rryXRGPQIhCscDZiFFGrGBnyyH57ea6sGM\/d37gVVa+ukJTnovNq\/9LafSrWBaF2RrNYGE+TcplNYI0Sq5eb9DrfHpoz4HPjO4w6uwZIeHQjlw00+daMYbUpNYvzBru4JYoG4+FnfLnaJ2RX6rVgfBQIqnPe+8ho+oVfDUJnsA6e5JTlC5uDUaaRcrC0+Ji\/wYvhpr9KixWcINr\/Q6IJf8RuaNMWGUoYQRmSfJSGr9d2O1TlO6mLpi0PyY9rao+oramJEZVMS9CvaFzYMM4ekODEtI9lvm8GVMwUuwhbqucZBCNIlAueuvDA9mFax9H3Da0FnXF80HbkF0G0pCqtWSLbDFAFtV9SICp3zwHTJ2IckUyzfK6paD68rLKFhUUBI7WeX4+s0d4Jr10hLHheThooXnr5xOHtBeSEaQFC9zlGwwIuoXzDqApq3BbVKodu6HoOITstmadm3\/MIc7\/KuaqI9NjMgaFSVmEVWOH4WbQci9HsoHbnpJWe8KeP3p1LSqGOSM6yXozbpkk0hMRvAJ\/Gnzq8KxN6H6U"} 00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_q50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1592388088469,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"248.144.129.147","dst_ip":"184.151.193.237","src_port":39203,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"www.googletagmanager.com","user_agent":"Chrome\/83.0.4103.101 Android 8.0.0; LDN-L21"}} @@ -15,3 +16,5 @@ 02234{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic_q50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388088,"pkt_ts_usec":913965,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAABAAH2tiCABFAAViAABAADkRR+K4l8Ht+JCBkwG7mSMFTq8FT9jSXX46bsp6\/CFoHX9sKJ4iXw4MmUZhc7\/\/7rnexr6NMKz4YF0arXlArXpSG4APmg\/yMELwPuNeLu07O4hbj7F5GCg4A6JT\/grCHnGll\/AhHzsLlwZayeu+RwNfUJVAaCcOM0EO70V4NLhIkkQ2i0VzTc5gvF7ySz3yhRh6mOzGryfARLNU9mlr5+0I5y3P4RTU7cwfBh811cBfeOQZfJCnTTykMpLApNw+kC1ppJb98F9HglJq6ZPqd69aXIZGT0Hxq+H5yIBAhbRjRt7Z1N55zbQ21Onn2R9Yvsm01hL1CSR7O67LjJPwPpN\/HoS6n1QYxjHUNDXK0K5gAuvW2x\/0Ey\/rQhZ0\/eQvdIHukwyN2BZ7zp3j\/qyHFzSCE3JgphS73cGQaRpMpq1zp89mUyOlQ7NEsu6b57pQnso34Z7KVw3hzW8a1Pth3Cg\/9wtyLVDezlhMiCBIPmuffGY8iG5uvhIskB7LONiOZbIFcZDTOi16v2QEZxF56qEesp4Qk3dXNc\/67XbXwuo8TPvZ34TLsWGiQXb2vd5wrQfb7JH01BpqHKillo5ZSCpq0Snm1NG2gq0TAu2NznEpMIUje2\/NVTh5mwVqa\/GOkmG\/ssfzKblXlJNoONYmHNCzbUMtuNlPAYSvSwmV33O\/Fk0gBYb2XXFxeyDn2wNCPJbCqYbh2bn5sF8BLcGxixC7cYct1+GNUvGvVK3ExOt35RRH\/zU2MX4BAvbYolaH+h16nHGL4Pk+vPTJhpq7fG\/Ay\/Uo7txX5V1dwR217\/GfcLS3lbgpPyqqnfOCVUE0gVUMCLEf+IbBGya1V62Wm608cpZbQvzlVn6waaWNCGCMnit7\/jxezBM5o5Omshk5vU+xdLniOycY3w9x1jfemXGqElpx\/a9NLMRaQH1DODgUNk+bkPDnMfq2p5\/CZIw3RgLu+wz5pIqc1DD9b9LMfKSfB9xGSdUAM+DBDLp\/Zfa8C6SKnCYFnT5cbPAxyfrVhl2kABZ1f0j85JrACJ59NouI6Om4mTQhCJfp1aSfvDzoSLW+GSQ7COKzgIeb78PeIx+qcToTKqYygEL9yHQB4dqqtAS8twAz\/kZKPpJ8Olvq3wBsqC+7Vagqd7+0KGEiwAybUBKxijpRmF6GW6\/8s6BlkXeXw5oezXeoPjXKcsWB7KHcpKKTu9rDnvNj4mnk47+MYGpCTIC9+E3K5MDC7CJtI8brsEFpLt69ywaKV5Ks153WIEbzKoMyiXF9QatxtUoOXlMfOtKa+qXgEHNjKUM+Ii5JbA00nk2Hc0chdeSFn9aA6D1KAStpWze1EoCKSlNzOF7SJSQBJ7kgCx1x67h6OwiXm3DZ4bFZiG24s5hFymda2oyeLFnC23LAijjidhwkxLJSSvYJl8oQThDVdqEH3qVl092ruq6Fz7cZFdsqeLUz4av2buWseTheaB1cDtkMH9ewK2LGW3UFaJ5JUWAFalu7TIk9dJsAehJeH0+bGhq2swXLZzaZtrtcsKBjQ4kc713YvhJEN9BjAWEtboJMuiaFd7\/CN\/agop04c55IZNd6l4vQUNuoJ1MMRGNnXtWKPjuzaK47DLzwa8GUervyqUfYrdoP2IBGydoTjv8CJIv4KMfL9IseQ4smLO8RceotDdZzhRV0kZZnL8VRb4jy6gw6UMKByvltd0c1F+SNbcGc1KhzZxYGTTtctbu+QHZi\/FaExo2rYcmeSCYiTSy7kBn7M\/3iRB\/l5d16faMPG6raOdf+21mY\/a+rUH3KutEK\/RHreWYdUUTyp69+kl5kev\/MylRiG5qz"} 02228{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic_q50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388088,"pkt_ts_usec":913972,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAABAAH2tiCABFAAViAABAADkRR+K4l8Ht+JCBkwG7mSMFTq6xWrGdPOm+c5gD6m5ItYvOmOVBv+3kPujTmHeRYj\/mdO7Mj4frKpdRKYuXfjoePbvETcXIbiNr+ASWV0jqRE\/S32QQ\/7f5xQOWSdiQNC83OWsvB84SDkD1T1\/IwY9kHh9AOxQZjQGEBhLUHY1PbhzBl7\/jxPpCAximq\/4Q9pExGC+RHdgEqLcylg8CHhWmjA4jogo6WbLMzi705WcsLAUSBeLbIlXkMU2Og8OQU\/DR0XmKlPeomt0lInUGN7aStDfuq5+cJ7JvPtg1WV4AdkHicU44hB2+VWLjsjFq2h7S58SegoxikLUtJJy9D0zmVdHgR7I8LDEKnv8szSUqyXsvuWDhjo8YBc3zzW+BjEAc02UxFwu5qKc\/KOQmUoRn\/dQdCXCNhpWH+XHE6Dci1M9b5rseiifk5l\/khH1BVF7xMTtCCpjx8c1fi3ixa3vk4mSkCaddj3sL+NLMknmJiZm41xQ87nbt+mRBu20VK1ahZlzicfmUzZGPkp0V4N0Vnd41S5O+YjtHVLtaNrx595mnJDee460MKCMmhg4RXc8o00FcsGZ0E2bezia8gGVfW9szUR8ZkWC\/0kWqXtGzQjXXfvAgH4tP1iBuBu0pM2W3tbcCXchVYsujAI4TFRSb1NcND\/21Lr2z4SVGQreTl\/bl+1yQHYPDLK6+Vua4dESvvK27QhJCydMxBxkbW+EIFUI+\/S+dg7vBNOVgrp8KkRq9LIBPDLX\/IDbkLMscAaT8nET2KwN5oYNwg38lyOqw3QYz81pb3Uf8jUvk+jQ7bhxXuBrmyEIHd8izAEERXa98nreHzU2Z6I8E1vaWU6NWFksGuxdWJ7t6Zepp4GBojg8RoI7TlaumEZfOsRIwVKIve1ciRYJdFM1BXPTUzEfC9Nw6aN1hfbLcQjEnmeEnE11aKeuRS1BEj2ANbqScJOTzmdtsARjwICvQ6ky+LN16CL0WceQQH8VbNlp90rRuCIKCobPPGtY7H9KIs4oMRbMv9Waq7OUfJBxSrQFn1g016tIANY5A2GaSFo9ysN9N9cQkCPnxekYiENTVSOYpZ2o8JTHIUf+c8Y7KLcqvCTAos+kgmZiXfgVZC21xQkjy\/dRPP5YcPhiSS8QfeohJG5PDYyoz7GMhgP4w1w2BamtTiy+1uehor8mujlevgrF0yb\/TPznl0ieXo6Y1ej+bdvnglDhwpjh6MiwpZKmKEAZgMbQGWfWo3mcplIRIS8z7i98aidzY\/6nSRbKzc3JnCllRQJcBa0rjGgUk7tvVVD1ffW3XEvJRpRc6WcUYbA1uqdZfDLAsNj4F3lP68UyDV3WKm4eoFhD4ss2CBzF5ibGwprrQgXl98B7fC0PALVlB5QKDAd0UZmAqX0JlK4F7GI34TbFYU\/0j5mRG9cdPVxXSM7NeWTO\/3FdQOQM4TYSfVn34vI\/6aMUgh8UIyWzaBjZ2CI93AvGieVK556sjnLcgDl9GnBA\/CHHDaBuKI4W+pj7gvZf\/REClD4kVXqidO7XTsOW7Qd2QAgcCUbFC\/gHPu+qkbo7RIjR4WMAY5r8kmQgy1cNq\/ganfWHUhAF8iKBcXCCTz\/j9cssyFB33yZxLqJAGwxcIvqrqK6AS6TLPq2zplY64jll8RoNejOJZLRzyItHA0iOdU\/\/ousA1co0ivA9m9+o\/NRCS8aCZtQTZ5T6qqdQhXb23qA9pJqlk0niTMf5SUhtik1Ts7PR93zNkMZLSzZ7InfIwKZEhKQqh4LjzcT9wWkl3a0YsMmnOO4BtK7YJ1gehYG5OuitwoQFyBSK22GzhuHIq"} 02214{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic_q50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1592388088,"pkt_ts_usec":914059,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAABAAH2tiCABFAAViAABAADkRR+K4l8Ht+JCBkwG7mSMFTr2UUxzWygZ9b3y06pi5ZYapHKY9BS8JU4g+mqRe2XZzTFm1pB5lfWD4XEQ7CJcjsxAxChd687DeKIyjyk8x3oKzISjX83CNRZ2vbT2MvVwtLGc0i1Pr2qw4lwUu3R+NukpnxEbkPw9S1L7aOa13Rma+gGROdnyg9svhMRF3QeBC7q0Jw4mZZs67C1I6Z26MbVM1LtlhVSp2M+rbXkNQye9P56NVO7HbEem2REGM5seHBGqn8VsW3GQjCsq2Lw6qQsGbiveQKXQ73zLxygzHcIokoYZTVRIj03xYRdzNKuo8hsweI8l4S7bqKbi+KCUAORr+9861zE2rjtIfrxPwyyYtMJS7aW285y5lzCY+y89px829pAI1NkK\/kdvLUSN0VEEb2xjpSd6k+wDeZtwhwvFMidXuywGxts9dBAdoYmNmsmOYDf2R6sEubPt5YdNg\/f9Qn+sKLmPdsT8MaT7jFhr0oikXVwDyx5RuSOhYKGYGa0TRPeI7TpWdjdu7Y1i9FNnfvDwM+pH1ppCnuxTiCegw2TMDM\/WGdxWlPzVQlKgef9bzDw1AbXurxxJUKTX9dfFDdbOVymxfUjb8AhWJq+D\/BUO9zpjJQ8gRlSFER4XBjT1z3Di5PZLqQYf2ba6ZPAZqvzDTbo5ZphRqWDBoaL6q+HhUlbOuS1zivy2kjcBzUFNCTj1EF1ZAHptW7qyiV4IIaRNjnpVyANDHxJ538a9SsEUZ71NyHEDff5qpuqEU51rmcZidjzJAL7AonqRT9T99WRSO+3+j4xG1ix9OhyMQsRCawrqs18KiMKpdXsy6SitTNJ5o\/FHZ53LmB4Qv10K2++vw7bLc4RwBgxI0vwJ3IW9xBymycm2RB4f5IeyvChCTttLoPF1dKGgHtVdqRfhrBT\/mOc4o8Emw0tFAz1ocvvx66xgq5VTKEdNsVQGssbLdigAipR22vNeHoB1Virf6gtstKFEQDAPcAzTJHa+LIczW3Y440fT45gCocVqjLQzpS5o8Hhfilo5Mlhx2MYXAkwzpwItCGR2I1DPHnfWGnRHUG4HE+JMuUmXOVRLvDb8WOGnyBzqFmSEWyFRtM2SFFmNVEs+QQe9MeJ7g5C4opxJAGvUgmPx9COj0xXRdhTJza9fGKdobpt3EpUOTPSd73VZg4po3aMwWxb5Jeo+FLm9eQwPX2FVxQf92EGQPA6MFlmCxJfGW8TAl5FCSgcjNNHVf2p9XXKvqWBffw6645FBEcnis0IRrnJ+vXQ32hg59+txLkKX+KSLOlt3PdoMYLBY+cXTFFFU8Va62mRPJ9v1gr5G09m1CPVyR8YugWtOCg78BBgwmV1RYYvJJ5msim0hzmV3RqlNUXjaJWOec4o6TY1EgFbPMV2qiC8J9n9yXV5YvI05g4IOlqR7S2iqZhqYULtEWR6ovIpNXnrZJpy2Yn\/zYXiZVZE023vTTnBDx95EA\/cI++FVV2wG2YR1sAc79D\/s1fSQWrDliG530wWJyVzvDWWaJdBia3evaJRW9JJCGGMr56q1SVQoUWgvS6eELCd9V8VJ8DagVQV+8H9sg54sHlzHBxIwDHfK7ROpezRnokDq\/bjW5ztu7Oy23WFbid9S0ThBecI\/8EO9dB1cBlHAkkL0IJ\/Zvli6tNzEeuTP2+1ak8ROcgatBAKEuuflz9JINeyMH7RyfTIP97\/S5ek7gGEfVidR2nCnTnx2F\/kKhg8Gktkb7QYhaPMw9DSXpeKWciUACqjiiTBlMTb1TtFFfwFRneqpdQT\/5mpXBhWm3GpWN2LqM+inieYBwNLFo39t6"} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":20,"source":"quic_q50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1592388088469,"flow_last_seen":1592388088935,"flow_tot_l4_data_len":19754,"flow_min_l4_data_len":33,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":987,"midstream":0,"l3_proto":"ip4","src_ip":"248.144.129.147","dst_ip":"184.151.193.237","src_port":39203,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"quic_q50.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_t50.pcap.out b/test/results/quic_t50.pcap.out index f5f7f7577..2f59e7fc0 100644 --- a/test/results/quic_t50.pcap.out +++ b/test/results/quic_t50.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_t50.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_t50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1598618820564,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"40.154.127.200","dst_ip":"166.240.188.209","src_port":49836,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02225{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_t50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598618820,"pkt_ts_usec":564956,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAQAMt+PCABFAAViUWNAAH8RmQMomn\/IpvC80cKsAbsFTtXAxVQwNTAIVV8y018p2GMAAEU0sFS4EDNRQxtqte6TPI+YvWd+9vuUhbcTQ2HBn9gQQ44SheCG4iJpKGLD8uMQU9W2hflEcgLE5fOUXsKA3b4MY34rhhWyrjNYzozZ6RzNmC3+PSlNh1B9BkCmgwrPckh0gBVa\/FiA4QpDKG9FfMxAAMJa6frV7fG1bb\/7HJhI3yISKMBJBm82DF0OyCTOye8nQRPUiVu4WsjVf6TJP0\/YCQn\/ynhi7Ht\/RBa3IPlCUHvLu303v9QUCibeTQUAguISRnIMNJe1C11ibh+BPlrVWXB5I4w7PGgaDw6mvx7JTybAMrs\/zdPmdFbLzWLaLw6FF+1T6Nf5pXJ9+kE9uEXZ6FzdZDD3MbdQ7S7fF3Xsf3z9uQukVNaW\/VEZbNqdIcOzSZA1HMEos1dDC\/4ViVIfMlO84vWzhZLxq5UvTT6qapu5oFarxgYku3nnVTzVM6SRRUR15vAoGmL3hQ542vEoyxzgRnslUtNtYNF9zlTPnOomXF1\/xSoJJI3VGlXy1gOwEOp28n6wdjsWOzKyE8z1XmBGehbXOUESC8A5oRtpkqOzQJ3g5+dnZdSYCvXi2BLHGA+OVhHokC0D92CqxGKl340PEFDaTPqzeKg+DdhCKEuu94iUqJwa\/EQr0++J\/bZoJuya3A6PiiCAsAWEfWiGB4RZfM+JuqUNIdd0StL9dWeEo7kVq9MAq9yKOBhBD0Nw0u3O6ttMqxfEm25kPEexKv+eLXlFhK9pi814az\/wL0\/CoLWlaMBTnRRk8oxhNZZKjX5cREBszdn5VN++4tz2T7E2jOZOFaOODo\/Wvb7BjuenE7CpgjdjsnLE4Tn\/b4Q53nG\/TvK7\/82EKBXRq\/c5PKnM+b1ENV06F0Dt6cGZ80l0g1EXbz82dUS02CP8vLgamNhFvRmwk0Fytrw6YCdOz2pD+8LecT3ig9EfNeixeZRd4tX0VxcyI5WVzzONGrmWIw1RUeauVQKVXpwzPZA8CukmFuSLsJh+\/5N5AhFjT6YZ08Cfg8mb95WTaUR4Gcz21+e\/jxcv3N2Ucmp36VwT1\/tIEgMyHmC7IWqDmGHm0zoua0BH1NJEIxpCFxOkgrdVfA\/bFJKqQIiWn39D6QQCV9IfFHR0w3Ji8IRmUv2cmzofCCCDXIb7a1RfNYDUaRs4NsKQeKcoYbyoDk1GAb6it6FoAhucYrDmI18nx\/aim5gBIWa2dZw8lcSNFxgWB30MqUt4DZOv8SxNPiLUt+4S7VsKdmL3e9VzPcuMiIPdcykCdDjJcCNMkqrWApVw+k3MVLOUeIU51nBJ5vetMjeccL3kies1jAjqR3odF77JuN1k7xA13AyJHglJBfA9SrQAab1XP78SnPFaTVPIBb4lI+7BBbWiXiUIWbr7QDQ2M+jaZ9aeFPMMv4QQg7YuadL5n0vNmHJxgYLgQVYZUg3g+jMQJiu4KLUJuhihq+lqjYmXeKGtNpGoS9t+klWnsjGnRn75HVlDegNERH7rMuzV5M2eSrUWRcByRHbj5kRkoY6s9x4THwi9YKFtPRSzpfXx6U8\/obpT4A56m9Dtlf0uhD38f9WkHLmiBpPtKg3V58sjjLsP3l91gyKwHDq9OPXkHBllrkj\/HjirESjdb1Tretiw6j18gO7a6gj9juTcUBG0eptAXXuJv2ZyrvtGzBo7DRc8B9KbYOIeUQf7UeOsamqbXhc1aNUt5qklsGe6OvEqu\/YEHpLYtQZ9LUddfbvcwZ\/RUIOT2ImtvT6yXQ32en9NmMy+OFHh52IUE4c2meqx38en"} 00768{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_t50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1598618820564,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"40.154.127.200","dst_ip":"166.240.188.209","src_port":49836,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.GoogleServices","breed":"Acceptable","category":"Web"},"quic": {"client_requested_server_name":"fonts.googleapis.com","user_agent":"Chrome\/85.0.4183.83 Windows NT 6.1; Win64; x64","version":"TLSv1.3","alpn":"h3-T050","ja3":"a2fc589336b7c13b674c1bab24655ce7","tls_supported_versions":"TLSv1.3"}} @@ -12,3 +13,5 @@ 00431{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"quic_t50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598618820,"pkt_ts_usec":814997,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AAAAAAAAAAEA4e3RCABFAAA2AABAADUROZOm8LzRKJp\/yAG7wqwAIp3EV0N37QF7+ve9GD8kIKkK\/eEyjXLMkZGC0Rg="} 01232{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"quic_t50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598618820,"pkt_ts_usec":815062,"pkt_caplen":658,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":658,"pkt_l4_len":624,"pkt":"AAAAAAAAAAEA4e3RCABFAAKEAABAADURN0Wm8LzRKJp\/yAG7wqwCcCVcUXB99WnSuoKachwEOfIRLcH5SoDBLWkZfevrUACnN7x5PTsGjNLlnz8FcsGwdsTw4sDFj8QOEUC+YYCdwI54IJoqGf912S1b1FdDgLvDRmL\/pSi0amJssVMPIjUAMel4Wt0WNkA8mDqDvNPfps3JcCGaeNj\/3yjSa4+t57I8cKV0WXPkpC+phqw2FaZ8OOku61ZS4JU0N\/\/JW4H98K3fnPlqACKrvvSryguBtj7+gm2ah3Q4CNa6JgLfFR86iCy4mtz5Qj71Sk1BsYNVaHXhKdiN9YQINgOeGR11izBn5mrjEbCUi4bTDsgdECcTfckpxC0clgOJq0b0OHxVz8Md9\/\/2fQGqic145ckjz5\/PsMRQ5eciEoF2gSsiCSf5hdimON45Hscfjv47O6FtFnsCpiZlLtgfMHBZU8BBZyxClfh+wTJHrokox5nYwQ9lCP\/smsZCZYV79Y1uselq3t4x0Gmh1ONAZyLenGn0N9uFGO3AniEbMTO\/KRV0HiIhlPcJYQ0I2vm28RBVfvT7Cd0TqRFOwxUCe2n2KBLd6f3jOoCsU6l6IoUDGvjPoKqpsjkOPYRsy\/x0VNRjsTSbbqkMwvzFUu5LTEz4YjqmUS4N8Axgpeq4HHhu8CAhQms\/ToHRf95qsuR8cJCOz8mG2ojiJ5vZ9+Ox1TLpjpyqIsxzVJ8GQAhsr0liZUeALg6A5HwDsClfNYDcTsH95Wt8224fow2h4tBP7Tn5fnepdjI21608U9ge+hMCZafezkCNTq89vMWqtX5wGsIOnGmc+uB0hScqDEMBTtNzsa2W2wrzlB8tsy+Tlvdydg=="} 00440{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"quic_t50.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598618820,"pkt_ts_usec":984161,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAAAAAAAAAQAMt+PCABFAAA9UXFAAH8Rnhoomn\/IpvC80cKsAbsAKbCuQFVfMtNfKdhjvCDG5lHY2Vep\/b8otkMpD\/Eek8ZQl9VQ"} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":12,"source":"quic_t50.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1598618820564,"flow_last_seen":1598618820984,"flow_tot_l4_data_len":8012,"flow_min_l4_data_len":34,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":667,"midstream":0,"l3_proto":"ip4","src_ip":"40.154.127.200","dst_ip":"166.240.188.209","src_port":49836,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":12,"source":"quic_t50.pcap","alias":"nDPId-test"} diff --git a/test/results/quic_t51.pcap.out b/test/results/quic_t51.pcap.out index b14679a55..9085449c7 100644 --- a/test/results/quic_t51.pcap.out +++ b/test/results/quic_t51.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic_t51.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic_t51.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1598620434413,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"187.227.136.152","dst_ip":"211.247.147.90","src_port":55356,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02219{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic_t51.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598620434,"pkt_ts_usec":413428,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"AAAAAAAAAAgAH83gCABFAAViXjpAAH8R7IK744iY0\/eTWtg8AbsFTvswwVQwNTEI\/5QVtbAFhg0AAEU0lc1seKsogM0xJ2my4Aiqph+R\/2N2Tlopv6L1CTJ74mgIopdeTMsbdYmmZHP80OXizzota6YFHVZ9VeAcEZo8pgEgiYZUg70bNed022uBY2n4AIBJaoTaZc4dlK\/B4TiUFC+WiYMdxcvH3S2VlmhK+Rc2gUQHqAYLkzqvz5M6NYLldilKxcCw\/ToJ+zu5fHTAbQipFFqbD95GLa7oBCU7jPE\/wj2QE1M9Wk52+SrgbNiKCHm0Oi8\/\/aC+8QR8oPQVWsQzjkcyagMWDaycHo+Z2gh2YqGCJoepFNsqgtO8uWWNDiaisHNHQDCPrCt5EDVvLMLkZZQTcE9bxIhJucB4CNr926kRAjaB4Y5CqDAEear5TtCJ3Iu0C2bzBjoi5J9LPiwVBQYhfxtqGdX9O3nANKjdbMVqvYl742MGo2YFm2J507oPMBXLqPJW2a2j\/XlrdIcqLJLXy1ruiet2Yfof5cTaMXQp6wyOq8s2kLEeb0RqG380zHAhUvwTfCiEYvwSN8+LPb7d1HKu3JRvbfM4A2u6D3\/ccc40B8jpt6t8mVTCa92M7s8hgVfDHCvoiaTxRF07ULZWTbuRFjLXA3G\/QLzl0b2QQA3PRqMO1r4YLM9IhL+9TjIm9kskk81nFsbcqeUPPCIl5SvakooZ1Ne4vlHJM7vcPwHkRJHa+PMjtknf1D9FmcaRoK2gywFTRk2j2RKXeNNGP3fOGBMRmVstntMO9HlCQR0pqWkIJ+jw+vDqFHMVZBwco3px5tJKsYik1W4I7vDVokn8tYkCXuWkDqmw9KvnktOeNU+eoLbnbQi\/AJnaCX22\/pOnvMBDUqcAEyxhhPUDxacTTuyCy01g9D7qNJmAhz3k5MC2zTm67IILY1heZ2AuYvQwYQOss3bJtjPNa+uV1pVbQiVw6S2nvxKgtq5Z9DSuXhvsbTOp5GSq1YV0eewMUT6nB6ejScFWGv+XM50Rf10iuSgO6pXznyY29qMMOcdfxFMWk8ZhEALkKLXeqjM+FjHgPqVYhtjd0Mxa3xCi4pEnff1YF4nj78KYHZrV2zxl6ihclVVh4iHXNFGI+s63vsFXEOTBejfPsr6+VmTDJ1+o1kNk93XUE\/bQ82a18NJPdXQ6kf26Qjcc4RqnTvAmrWh\/6fmG4zIriY7A9z8t4eO9Qfr9TLO3k0B5JOVnWVTqlbOvrJgEzV95Hv0ioO0xIj5BnxrbLnlwbNfPjVGTcRNAh71gU32J8rr6rCxxCaTv4RU7KdiQ+zigC0LKK7x4OPs9n2Ka2KUPy25mrLQ\/hk5IjtzsrqqQ2MzNcZhxb0kkNCxELzOQUMbpkFnw3XGvEDCJVplyR1UqjiDFOL8\/JfuephE1oyHWeOYVwVd2Cwv2PGGx05T5JJWiwFxWUNPRdBpTvDS0w\/p4Nd\/c2GPaorYCv1rEFAbYJpF4F6I30H8WeSXKzzhCDJKK0+cDwsUjqsSRJxU4ftS+uYB0XeJmKhKFuSfMEVI0q1YpMQZE\/G2MC4zAighNsEoUwNwWYS2545Iu3+Eegoe47B\/k8tCSheavZoHCQ6GLnzYKEdctMGvZqMVOXsPQnYlobmVfhCoHYAqTL++rI+V2XgKmzpdEDycwwsSLkVWoYU4lGAoPMP3kxasfCnUHU\/V6gkc7C3bskka9cplZd3pC0DtI8Ams8W1VIknYpHJDhbirGSRTc6oJbJQK8NbF0mBg+7QAzF7Cg20VSPH1oCq1EEodwhHlQBTHEkDIUOOWm8A2kePv2bx2BTxVuCDz2D78zh51"} 00754{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic_t51.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1598620434413,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"187.227.136.152","dst_ip":"211.247.147.90","src_port":55356,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"client_requested_server_name":"www.google.com","user_agent":"dev Chrome\/86.0.4240.9 Windows NT 6.1; Win64; x64","version":"TLSv1.3","alpn":"h3-T051","ja3":"92e76078d514999cd950474995dab2b5","tls_supported_versions":"TLSv1.3"}} @@ -15,3 +16,5 @@ 01703{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"quic_t51.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598620444,"pkt_ts_usec":741690,"pkt_caplen":1003,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1003,"pkt_l4_len":969,"pkt":"AAAAAAAAAAgAH83gCABFAAPdcT9AAH8R2wK744iY0\/eTWtg8AbsDyTLtSv+UFbWwBYYN6efgT9I73SyBwONu481j8\/zASvL+fjCvoR+DcLF\/rAd5QmwWVSD2eyQAFcX6IS6cbXnvHs6nn6J4E9sg0Y7bqGGiAKCBjgoPJPLr8Hf9Z2kD+LsCIMnY7\/gdbSrq4PXzclVr\/jfxzdV3CGE1qoMAMUTfCfjUfHcGb9BZe+dDzKedokSqOQS\/\/z1J6XdaEvwBX0HOgZq5iv6UkaKR6Ry5KuLe2v1krmKzrU72UMF4tHKx6fmHV7RpdezqWVOx4NNJ9XhYGfrYbrCyC\/oNFWzdN5shFLzqXyeFHpUA2nQUNeUi84qFqf+xzDZSDC1RugmjtDtUtiCoQt+bhH0vtnxLtL2k6LwLEKWe2SeS7fsch9ehFKg+Bx7FCf8JFIJg5htDaWJdutmg\/+6kInLorffPRXNQmoIs\/BSaKmr2Gp8v6\/8MxG5KCcwstmJvrjT2xQkIt2Ft3s0S2VSESvrCtFBBOlQZqN7nSBYIAaQ6gvmaLFLcAq+c+QSCCaLs9Cb9lBWmjV\/6VgEiCFbScR+KbCeoBpmpAs1MYEcF1Poo7zFGkZPa7k+cY7ju7YJORt7zMN6EgTsCUtgQQ42FEwOPUzlWWfw4q00kfsDmSUz2ub4AwPGiz6AzDzq\/8IKlnog6yjUpB0LipQiYTMDxyVFSV1KbOJYBC6LqIv5qEycbIlgwCGhyyW+pXXGfxcRnZxVNHK6rHjFfpkzYD0Gz5lEa52Tgplz04DrSHqAcfvpAlA6cCTGCK4VIVA7LHhL7cUu1UqKdNKPwGxtNzHaOErnVjLQB1AkPPjEWW2aJ5tN0TksLyBc+x1QoBKnFlaRHOx98oDiQFdjeh9Quj9OaOQ35DHcWp0EeroeqFtJhYR6fsc5vFKCPge5CQS1VHBOjSnH0Upji1SoligWI\/P\/q919hiaOTgdtmIGoKWkxgucd\/\/6msRaSHQXE5WFr+DESsmittJ3gC\/6M1aRWs5cVag4wnNinz+MEhs\/y90V38kKN8iCPltwiAIV9lmTvkWc3jmY43MHawefBUS2zDcUNDnA32lXUntW\/JSiQSxqwCUzhY59CDs16HJJ2zhWaye42HAcIu\/go2UuXWDDrQSVzP40+kRKKLQZt9HTNCbdiy5CLIFl9QkcvzGRUF2eo4ylCABg6iLJ7SJ537DedAeBDNDGPFftSQWNhjQ7tYaPB9GmJYsST29YvJiYz7S7GmW21+OVn9EirdOPOoNFHZl6yKBlfYD3sUcGnhd1uncf+8eU9ExbIBjXwe5Et6egrdJQ=="} 00430{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"quic_t51.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598620444,"pkt_ts_usec":772415,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"AAAAAAAAAAIA\/tPQCABFAAA1AABAADkRlerT95Nau+OImAG72DwAIUhtTWVlkzIZ1l5MiO32g9qa7cckVPUetSXxvA=="} 01265{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"quic_t51.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1598620445,"pkt_ts_usec":18622,"pkt_caplen":682,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":682,"pkt_l4_len":648,"pkt":"AAAAAAAAAAIA\/tPQCABFAAKcAABAADkRk4PT95Nau+OImAG72DwCiLkRRUQ\/6vkZVV\/ROzhbKeoRReCXAsU2A9sjDcWKUpUKE20+JfmKTS5epz37+ogCTB3O0gMCMzVDnFdaJcS6+BN05F\/4JuxKu4G1tpzczS9sm8YNK\/yKXdRv4mVvdoxmRlg3UOh2\/HXmM4zkHZRGDq5gvf1YtAZn9UT7LsL3ba43Q8SnB+rUVySuu7l1RHkrEWg8uyOET5mlnXLlWR9Grc3kARdxeBr1\/WcmPSnvrZSLx1Yubftvk4neBnd4+d5h0uJVaP+xEQf1a8mwYApxdilAfGbuHGI1b3p\/3kL4nnq3IJOuSSNOnomgt9UYIYG6JkTs88ZO0WDXcKQgHSWiD3S5b55ck0VFoMVGi6XvxaS5dDL7irZqR+xUbIGJU+5KmsKgfA7I8vhbhlBInT22prpicg+aHmV2Mfe\/D32ni\/2JKthXhSWWTVnEZBANDcgGYP\/4NUgVhBiqDrAFYNnh4TpROEqCcVxLVLryNrzUeH7QkEbcjWfjgc1iq2O3xKKvNnDVO7PiKnn323eZoAEB9oWFA9G1nVAQC23JJC+CnKPFPChKEXym9Dh4Orny9OuAnT2rnxyfNcQUzTUgHDT2V7VEjBNfPreDUCXxeu5gdY1osBS40zZnHQbiRnLlaoi5GCT3tnzL3T1LFfAUmB7xQ9GiiYxgRwyuSbp3f6GcUujaHRbjguLy26pc3INccugl0f1At7jIrf9EqyuaS7XaakX31gYDzEUt04O8Omx3QUnvBZgydp7VVVYOZXv\/1GYhCscRuXdM5GQHqnPBMCwk9Y4VH2nkD7iDBE4uvSjbXU9u9lIbiPNzYqPtOVbqx\/o\/Bmq+eYkSeas+WHpkMkc3YMCicg=="} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":642,"source":"quic_t51.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":642,"flow_first_seen":1598620434413,"flow_last_seen":1598620524479,"flow_tot_l4_data_len":551890,"flow_min_l4_data_len":33,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":859,"midstream":0,"l3_proto":"ip4","src_ip":"187.227.136.152","dst_ip":"211.247.147.90","src_port":55356,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":642,"source":"quic_t51.pcap","alias":"nDPId-test"} diff --git a/test/results/quickplay.pcap.out b/test/results/quickplay.pcap.out index dd8136fe1..58692dcab 100644 --- a/test/results/quickplay.pcap.out +++ b/test/results/quickplay.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quickplay.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00788{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"quickplay.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1429000030,"pkt_ts_usec":398627,"pkt_caplen":368,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":368,"pkt_l4_len":0,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAWBDAUAAPwaoIQo2qfp4HCMpxewAUEHDiNf6xwiBUBgAc22rAABHRVQgL3NvbHIvUmVzdEFwaVNpbmdUZWxfUEgvcmVzdGFwaS9jYXRlZ29yaWVzL0hVRD9hcGlLZXk9cXdlcnR5JmRldmljZT1hbmRyb2lkbW9iaWxlJmxvY2FsZT1lbmcmbmV0d29yaz1XSUZJJnBhZ2VOdW1iZXI9MSZwYWdlU2l6ZT01MCBIVFRQLzEuMQ0KVXNlci1BZ2VudDogRGFsdmlrLzEuNi4wIChMaW51eDsgVTsgQW5kcm9pZCA0LjQuNDsgTUkgM1cgTUlVSS9WNi40LjIuMC5LWERNSUNCKQ0KSG9zdDogYXBpLXNpbmd0ZWxoYXdrLnF1aWNrcGxheS5jb20NCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUNCkFjY2VwdC1FbmNvZGluZzogZ3ppcA0KDQo="} 00162{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"quickplay.pcap","alias":"nDPId-test","datalink":113} 02151{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"quickplay.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1429000030,"pkt_ts_usec":498602,"pkt_caplen":1380,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":1380,"pkt_l4_len":0,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcBVSmuUAArQbSWHgcIykKNqn6AFDF7PrHCIFBw4oPUBgIIgJuAABIVFRQLzEuMSAyMDAgT0sNClNlcnZlcjogQXBhY2hlLUNveW90ZS8xLjENCkxhc3QtTW9kaWZpZWQ6IFR1ZSwgMTQgQXByIDIwMTUgMDc6MTg6NTQgR01UDQpFVGFnOiAiWW1JNE1EQXdNREF3TURBd01EQXdNRk52YkhJPSINCkNvbnRlbnQtRW5jb2Rpbmc6IGd6aXANClZhcnk6IEFjY2VwdC1FbmNvZGluZw0KQWNjZXNzLUNvbnRyb2wtQWxsb3ctT3JpZ2luOiAqDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1IZWFkZXJzOiB4LXJlcXVlc3RlZC13aXRoDQpBY2Nlc3MtQ29udHJvbC1BbGxvdy1NZXRob2RzOiBQT1NULCBHRVQsIE9QVElPTlMsIERFTEVURQ0KWC1DbmVjdGlvbjogY2xvc2UNCkNhY2hlLUNvbnRyb2w6IHB1YmxpYywgbWF4LWFnZT0xMzg2DQpFeHBpcmVzOiBUdWUsIDE0IEFwciAyMDE1IDA4OjUwOjE2IEdNVA0KRGF0ZTogVHVlLCAxNCBBcHIgMjAxNSAwODoyNzoxMCBHTVQNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vanNvbjtjaGFyc2V0PVVURi04DQpDb250ZW50LUxlbmd0aDogNzg1DQoNCh+LCAAAAAAAAADkV89v0zAYve+vsHrgNFDbgUDcyrpuYoyhtfSCOHxNvqZmjh35x0ap+r9jp2mXNIlbzRwQXCr1+17ynv3s+Hl1QgjpLBBilJ33ZOX+uorSoI2ylY4yUYRKdU63rQwS\/GzSWf5Ar1Ie019oi2+6u6oWGtgFwxS5dq87q3a+2Idcueeq67zXSYHyO1TCyAjLkmS95so0diqvvg53CsvgyTJzD3Qi0JgIuayAmIiA5W3kSaUDWssJJK4VowbKVKXNIcUm1hhVJGmmqeB528TkvIn4HpePQsZu5N+eyq7j3vhU+V5+CDnMGA6lyIbikd8gz\/3R0mBVwhwM07dyY2j3Vbf+jkvkEkeU6RwyB6awDvoEPDHWHg\/up0YeYzywk0VnRudOrtYFYr1zeg4R5uaXbUuchtr4V5V\/xVS5qRxEblIH8YNdR8Y+eFoDbj3ZIMkL4gNHwnBt0f1KZ316pBhOU8hN9sjwYMLYz0WK8dJD3QoI4x2KyLhtDNJH7kcFKpCQgo+7pR\/GemnfPl6IR+VhdhjSBgqjvxJSCunhbgWE8V7TWI0gpczntgPZrdaKC5NwA1JTYAOp1TgT9tejpMASB7aKWvFhiu4QGNXLydSjpMCQRlAgvUiBR76vXzsijHkc0REdgd3XyrceLOzliJJ2YJiKyUJSxtC3GzyQMO4pSIp6ecHtaWgTAXcfOY+OAk4O4beielVRLRmAFYfy8QfnXrLZU3nBE0bVwqOr+6zJSmTPw\/pBMGYDkIj\/OO+PzHcmf4QMOCrf7ngerU6Yb0lCAkw02RDGeu89Fq6FRPClj27rijsplYpQbtM95TbKxttkXs6u9Th+Ix4oVjNzYCLPQBZXiEML\/xiiithq5ibtu690K7C7RtM9ibujqD7447J7UzpvxtTC+T6Mm\/R2Pjazsl391\/3tp2+3xOrWTaa1HPMfeTeZkjHKv9K+3tuzw+65QOa1TmUY2Zz07zlXG3mzaS233eddiY+yrf+u\/D3dDK0zF2LzCntfXv8GAAD\/\/wIMAEf8Fz+FEQAA"} @@ -308,3 +309,4 @@ 00164{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":154,"source":"quickplay.pcap","alias":"nDPId-test","datalink":113} 00970{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":155,"source":"quickplay.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1429000385,"pkt_ts_usec":363074,"pkt_caplen":502,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":502,"pkt_l4_len":0,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAeYFAUAAPwblnAo2qfp4HCMoyzYAUPnxVjDwlCGiUBhgH1I+AABHRVQgL3NlZy92b2wxL3MvV2FybmVyL3FwbWV6emhhd2tkaWdpdGFsY29udGFnaW9uMjA1NDAzM2ZlYXR1cmVlbmdsaXNoMjBsdHJ0MjM5NzZmcHM3ODM0MTkyLzIwMTUtMDItMDIvU1RWNTEwUjM2MC9xcG1lenotSGF3a19EaWdpdGFsX0NPTlRBR0lPTl8yMDU0MDMzX0ZFQVRVUkVfRU5HTElTSF8yXzBfTFRSVF8yMzk3NmZwc183ODM0MTkyLm0ydF9TVFY1MTBSMzYwLTAwNzEudHMgSFRUUC8xLjENCkhvc3Q6IHZvZC1zaW5ndGVsaGF3ay5xdWlja3BsYXkuY29tDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoTGludXg7IEFuZHJvaWQgNC40LjQ7IE1JIDNXIEJ1aWxkL0tUVTg0UCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgVmVyc2lvbi80LjAgQ2hyb21lLzMzLjAuMC4wIE1vYmlsZSBTYWZhcmkvNTM3LjM2DQoNCg=="} 00164{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":155,"source":"quickplay.pcap","alias":"nDPId-test","datalink":113} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":155,"source":"quickplay.pcap","alias":"nDPId-test"} diff --git a/test/results/rdp.pcap.out b/test/results/rdp.pcap.out index 7da811186..cb4a721d1 100644 --- a/test/results/rdp.pcap.out +++ b/test/results/rdp.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"rdp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00382{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"rdp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559207465,"pkt_ts_usec":138576,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AgAAAEUAAEAAAEAAQAbIuKwQArnAqAKOzQ4NPfm84lgAAAAAsML\/\/7iqAAACBAT5AQMDBQEBCAoLUEqcAAAAAAQCAAA="} 00172{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"rdp.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00364{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"rdp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559207465,"pkt_ts_usec":180991,"pkt_caplen":56,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":56,"pkt_l4_len":0,"pkt":"AgAAAEUAADRflEAAfwYqMMCoAo6sEAK5DT3NDkeav7z5vOJZgBL6AEVOAAACBAW0AQMDAAEBBAI="} @@ -4018,3 +4019,4 @@ 00175{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":2009,"source":"rdp.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00351{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2010,"source":"rdp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1559207472,"pkt_ts_usec":692980,"pkt_caplen":44,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":44,"pkt_l4_len":0,"pkt":"AgAAAEUAAChjxUAAfwYmC8CoAo6sEAK5DT3NDkeioY5HoqGOUAQAAJEzAAA="} 00175{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":2010,"source":"rdp.pcap","alias":"nDPId-test","datalink":0,"header":33554432} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2010,"source":"rdp.pcap","alias":"nDPId-test"} diff --git a/test/results/reasm_crash_anon.pcapng.out b/test/results/reasm_crash_anon.pcapng.out index 57a3bee20..89d742623 100644 --- a/test/results/reasm_crash_anon.pcapng.out +++ b/test/results/reasm_crash_anon.pcapng.out @@ -1,3 +1,4 @@ +00395{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00413{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1410865705,"pkt_ts_usec":717955,"pkt_caplen":81,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":81,"pkt_l4_len":0,"pkt":"AAQAAQAGplhD8kgGAAAIAEUAAEEBjUAAQAbTicCokZMK0QiUyBJV7zv7Y\/\/dkdtagBghO+7bAAABAQgKPplWKzpg4vE8ZGV0YWlscyAvPg0K"} 00171{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","datalink":113} 00413{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1410865705,"pkt_ts_usec":717964,"pkt_caplen":81,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":81,"pkt_l4_len":0,"pkt":"AAQAAQAGplhD8kgGAAAIAEUAAEEBjUAAQAbTicCokZMK0QiUyBJV7zv7Y\/\/dkdtagBghO+7bAAABAQgKPplWKzpg4vE8ZGV0YWlscyAvPg0K"} @@ -416,3 +417,4 @@ 00173{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":208,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","datalink":113} 00398{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":209,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1410867180,"pkt_ts_usec":785359,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AAQAAQAGplhD8kgGAAAIAEUAADQCIkAAQAbTAcCokZMK0QiUyBJV7zv7ZondknOAgBAhO7JwAAABAQgKPq\/YJjp32ok="} 00173{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":209,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test","datalink":113} +00139{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":209,"source":"reasm_crash_anon.pcapng","alias":"nDPId-test"} diff --git a/test/results/reasm_segv_anon.pcapng.out b/test/results/reasm_segv_anon.pcapng.out index cfbb89131..8f25fd757 100644 --- a/test/results/reasm_segv_anon.pcapng.out +++ b/test/results/reasm_segv_anon.pcapng.out @@ -1,3 +1,4 @@ +00394{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00453{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1550422828,"pkt_ts_usec":553466,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":110,"pkt_l4_len":0,"pkt":"AAAAcxs8EFFy5LtdCABFeABcpb4AAEARUG2RTALsu2A0VQhoCGgASAAAMv8AOAn8kEPKcwAARQAANFkiQAB\/BgGSrBEkFT++kSvhEwBQ8LOPBjqqVCGAEAEBeCMAAAEBBQo6qnTxOqqFWQ=="} 00198{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":1,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","caplen":106,"len":110} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1550422828553,"flow_last_seen":0,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":72,"flow_max_l4_data_len":72,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"145.76.2.236","dst_ip":"187.96.52.85","src_port":2152,"dst_port":2152,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -71,3 +72,5 @@ 00199{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":79,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","caplen":122,"len":126} 00474{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":81,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1550422844,"pkt_ts_usec":222036,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":126,"pkt_l4_len":0,"pkt":"AAAAcxs8EFFy5LtdCABFeABsUeoAAEARpDGRTALsu2A0VQhoCGgAWAAAMv8ASAn8kEM8dAAARQAARFmLQAB\/BgEZrBEkFT++kSvhEwBQ8LOPBjqqu6HAEAEB0NEAAAEBBRo6qudhOqryUTqqwRk6qswJOqrRgTqq1vk="} 00199{"basic_event_id":14,"basic_event_name":"Captured packet size is smaller than packet size","thread_id":0,"packet_id":81,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","caplen":122,"len":126} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":82,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":82,"flow_first_seen":1550422828553,"flow_last_seen":1550422844224,"flow_tot_l4_data_len":75152,"flow_min_l4_data_len":56,"flow_max_l4_data_len":1456,"flow_avg_l4_data_len":916,"midstream":0,"l3_proto":"ip4","src_ip":"145.76.2.236","dst_ip":"187.96.52.85","src_port":2152,"dst_port":2152,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":82,"source":"reasm_segv_anon.pcapng","alias":"nDPId-test"} diff --git a/test/results/reddit.pcap.out b/test/results/reddit.pcap.out index d62d5eae5..a0b1676c1 100644 --- a/test/results/reddit.pcap.out +++ b/test/results/reddit.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"reddit.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00509{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"reddit.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1605291684451,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40028,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00462{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291684,"pkt_ts_usec":451133,"pkt_caplen":94,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":94,"pkt_l4_len":40,"pkt":"qtsDr8lk5EKm5WPyht1gBBqZACgGQCoBywEgSYsHmR3shSjf9ikqABRQQAcICgAAAAAAACAKnFwBu4Sgd8UAAAAAoAL9IJAlAAACBAWgBAIICtTdYAcAAAAAAQMDBw=="} 00509{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"reddit.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1605291684451,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40030,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -1089,3 +1090,65 @@ 00556{"flow_id":60,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11240,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291697,"pkt_ts_usec":34464,"pkt_caplen":158,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":158,"pkt_l4_len":104,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAAGgGPQBk\/5sAAAAAAAAAADTTrOwqAcsBIEmLB5kd7IUo3\/YpAbu3nh9OQIJ4xyoagBgLMG3YAAABAQgKwtdje1IhubSBt0obLL+WIiPG6AQ56SzS1GkUMIPNBkq1N9IMlEKIOpEbi45nD5zJkYriLO4a7hmSKY4Uz5bfrMdnA+ZKZmoWAwMABA4AAAA="} 00455{"flow_id":60,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11241,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291697,"pkt_ts_usec":34480,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDNdJACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAAA006zst54Bu3jHKhofTkCCgBAB3F+oAAABAQgKUiG5+cLXY3s="} 00455{"flow_id":60,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11242,"source":"reddit.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605291697,"pkt_ts_usec":34499,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDNdJACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAAA006zst54Bu3jHKhofTkDKgBAB3F9gAAABAQgKUiG5+cLXY3s="} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":39,"flow_first_seen":1605291688749,"flow_last_seen":1605291688963,"flow_tot_l4_data_len":12230,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":313,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2004","src_port":57282,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":33,"flow_first_seen":1605291690384,"flow_last_seen":1605291690520,"flow_tot_l4_data_len":7714,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":233,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2002","src_port":59336,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":782,"flow_first_seen":1605291687514,"flow_last_seen":1605291688963,"flow_tot_l4_data_len":621328,"flow_min_l4_data_len":32,"flow_max_l4_data_len":6320,"flow_avg_l4_data_len":794,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":85,"flow_first_seen":1605291690926,"flow_last_seen":1605291691284,"flow_tot_l4_data_len":39821,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2502,"flow_avg_l4_data_len":468,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36964,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":20,"flow_first_seen":1605291690926,"flow_last_seen":1605291691053,"flow_tot_l4_data_len":4437,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36966,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":19,"flow_first_seen":1605291690926,"flow_last_seen":1605291691064,"flow_tot_l4_data_len":4415,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":232,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36968,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":20,"flow_first_seen":1605291690926,"flow_last_seen":1605291691062,"flow_tot_l4_data_len":4436,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36970,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00547{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":3,"flow_first_seen":1605291690992,"flow_last_seen":1605291691029,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36972,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":3,"flow_first_seen":1605291690992,"flow_last_seen":1605291691029,"flow_tot_l4_data_len":100,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80f::2001","src_port":36972,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":27,"flow_first_seen":1605291687934,"flow_last_seen":1605291688340,"flow_tot_l4_data_len":7503,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":277,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::1736:86f1","src_port":44264,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":847,"flow_first_seen":1605291684452,"flow_last_seen":1605291698703,"flow_tot_l4_data_len":509140,"flow_min_l4_data_len":32,"flow_max_l4_data_len":6277,"flow_avg_l4_data_len":601,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":114,"flow_first_seen":1605291688843,"flow_last_seen":1605291691232,"flow_tot_l4_data_len":72894,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2448,"flow_avg_l4_data_len":639,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::2003","src_port":47302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":17,"flow_first_seen":1605291684481,"flow_last_seen":1605291684654,"flow_tot_l4_data_len":5087,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":299,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":19,"flow_first_seen":1605291688843,"flow_last_seen":1605291689005,"flow_tot_l4_data_len":4446,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":234,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80c::2003","src_port":47304,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":15,"flow_first_seen":1605291686035,"flow_last_seen":1605291686148,"flow_tot_l4_data_len":4641,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":309,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56562,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1442,"flow_first_seen":1605291686035,"flow_last_seen":1605291696381,"flow_tot_l4_data_len":1968519,"flow_min_l4_data_len":32,"flow_max_l4_data_len":11560,"flow_avg_l4_data_len":1365,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56564,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":17,"flow_first_seen":1605291686035,"flow_last_seen":1605291686148,"flow_tot_l4_data_len":4681,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":275,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56566,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":18,"flow_first_seen":1605291686035,"flow_last_seen":1605291686148,"flow_tot_l4_data_len":4701,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":261,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56568,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":17,"flow_first_seen":1605291686035,"flow_last_seen":1605291686149,"flow_tot_l4_data_len":4681,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":275,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56570,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":18,"flow_first_seen":1605291686035,"flow_last_seen":1605291686156,"flow_tot_l4_data_len":4701,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":261,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56572,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":23,"flow_first_seen":1605291686060,"flow_last_seen":1605291686196,"flow_tot_l4_data_len":5289,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56574,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":23,"flow_first_seen":1605291686060,"flow_last_seen":1605291686196,"flow_tot_l4_data_len":5289,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56576,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":133,"flow_first_seen":1605291686060,"flow_last_seen":1605291697854,"flow_tot_l4_data_len":103287,"flow_min_l4_data_len":32,"flow_max_l4_data_len":10512,"flow_avg_l4_data_len":776,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56578,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":17,"flow_first_seen":1605291686060,"flow_last_seen":1605291686196,"flow_tot_l4_data_len":4703,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":276,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56580,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":5480,"flow_first_seen":1605291686064,"flow_last_seen":1605291695840,"flow_tot_l4_data_len":5898915,"flow_min_l4_data_len":32,"flow_max_l4_data_len":9464,"flow_avg_l4_data_len":1076,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":23,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_tot_l4_data_len":5263,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":228,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56584,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":15,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_tot_l4_data_len":4625,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56586,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":15,"flow_first_seen":1605291686064,"flow_last_seen":1605291686203,"flow_tot_l4_data_len":4625,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56588,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":23,"flow_first_seen":1605291686084,"flow_last_seen":1605291686232,"flow_tot_l4_data_len":5289,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56590,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":37,"flow_first_seen":1605291686084,"flow_last_seen":1605291686283,"flow_tot_l4_data_len":11120,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":300,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56592,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":35,"flow_first_seen":1605291690421,"flow_last_seen":1605291690571,"flow_tot_l4_data_len":9215,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::2001","src_port":59624,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":112,"flow_first_seen":1605291686301,"flow_last_seen":1605291696305,"flow_tot_l4_data_len":44526,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":397,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56594,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":45,"flow_first_seen":1605291689408,"flow_last_seen":1605291689979,"flow_tot_l4_data_len":9793,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":217,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56640,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00545{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":27,"flow_first_seen":1605291688344,"flow_last_seen":1605291688502,"flow_tot_l4_data_len":8092,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":299,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2600:9000:219c:ee00:6:44e3:f8c0:93a1","src_port":56186,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":118,"flow_first_seen":1605291686996,"flow_last_seen":1605291688354,"flow_tot_l4_data_len":97928,"flow_min_l4_data_len":32,"flow_max_l4_data_len":5584,"flow_avg_l4_data_len":829,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::6853:b3b6","src_port":38320,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":45,"flow_first_seen":1605291687800,"flow_last_seen":1605291692129,"flow_tot_l4_data_len":9892,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":219,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::68f4:2ac8","src_port":56782,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":27,"flow_first_seen":1605291690405,"flow_last_seen":1605291690626,"flow_tot_l4_data_len":10193,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1392,"flow_avg_l4_data_len":377,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::345f:7ca5","src_port":46646,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":36,"flow_first_seen":1605291688611,"flow_last_seen":1605291688858,"flow_tot_l4_data_len":8763,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2606:2800:134:1a0d:1429:742:782:b6","src_port":39736,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":69,"flow_first_seen":1605291687642,"flow_last_seen":1605291687853,"flow_tot_l4_data_len":38231,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2448,"flow_avg_l4_data_len":554,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:816::2008","src_port":39520,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":71,"flow_first_seen":1605291688830,"flow_last_seen":1605291698440,"flow_tot_l4_data_len":21093,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":297,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2001","src_port":58122,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":146,"flow_first_seen":1605291687485,"flow_last_seen":1605291690985,"flow_tot_l4_data_len":126179,"flow_min_l4_data_len":32,"flow_max_l4_data_len":5584,"flow_avg_l4_data_len":864,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::acd9:12c2","src_port":51026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":42,"flow_first_seen":1605291688324,"flow_last_seen":1605291688572,"flow_tot_l4_data_len":7396,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":176,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::d83a:d1e6","src_port":51100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":23,"flow_first_seen":1605291696948,"flow_last_seen":1605291697249,"flow_tot_l4_data_len":8369,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":363,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::34d3:acec","src_port":47006,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":19,"flow_first_seen":1605291688336,"flow_last_seen":1605291688453,"flow_tot_l4_data_len":4638,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":244,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::d83a:d1e6","src_port":51102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":174,"flow_first_seen":1605291688831,"flow_last_seen":1605291698470,"flow_tot_l4_data_len":129359,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3656,"flow_avg_l4_data_len":743,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2016","src_port":52296,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":53,"flow_first_seen":1605291684451,"flow_last_seen":1605291698602,"flow_tot_l4_data_len":10044,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":189,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40028,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":19,"flow_first_seen":1605291684451,"flow_last_seen":1605291684592,"flow_tot_l4_data_len":4678,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":246,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40030,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":21,"flow_first_seen":1605291687761,"flow_last_seen":1605291687902,"flow_tot_l4_data_len":5688,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":270,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::6853:b3d1","src_port":32970,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":44,"flow_first_seen":1605291687933,"flow_last_seen":1605291688585,"flow_tot_l4_data_len":16169,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":367,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2620:116:800d:21:f916:5049:f87f:108e","src_port":48648,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":35,"flow_first_seen":1605291690926,"flow_last_seen":1605291691119,"flow_tot_l4_data_len":7497,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":214,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:811::200a","src_port":38166,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":73,"flow_first_seen":1605291686985,"flow_last_seen":1605291690314,"flow_tot_l4_data_len":43592,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2808,"flow_avg_l4_data_len":597,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::df9:21c6","src_port":43492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":31,"flow_first_seen":1605291688712,"flow_last_seen":1605291688927,"flow_tot_l4_data_len":6013,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":193,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2006","src_port":54726,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00537{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":636,"flow_first_seen":1605291687931,"flow_last_seen":1605291698785,"flow_tot_l4_data_len":768921,"flow_min_l4_data_len":32,"flow_max_l4_data_len":7280,"flow_avg_l4_data_len":1208,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":54862,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":31,"flow_first_seen":1605291687896,"flow_last_seen":1605291688326,"flow_tot_l4_data_len":7711,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":248,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::2278:cf94","src_port":39626,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00538{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":104,"flow_first_seen":1605291690926,"flow_last_seen":1605291691154,"flow_tot_l4_data_len":114469,"flow_min_l4_data_len":32,"flow_max_l4_data_len":10904,"flow_avg_l4_data_len":1100,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2001","src_port":46806,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":28,"flow_first_seen":1605291690926,"flow_last_seen":1605291691043,"flow_tot_l4_data_len":9432,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":336,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2001","src_port":46808,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":28,"flow_first_seen":1605291690926,"flow_last_seen":1605291691043,"flow_tot_l4_data_len":9431,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":336,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2001","src_port":46810,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":27,"flow_first_seen":1605291690926,"flow_last_seen":1605291691043,"flow_tot_l4_data_len":9412,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2001","src_port":46812,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":27,"flow_first_seen":1605291690926,"flow_last_seen":1605291691044,"flow_tot_l4_data_len":9413,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::2001","src_port":46814,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":164,"flow_first_seen":1605291686985,"flow_last_seen":1605291698522,"flow_tot_l4_data_len":50634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2365,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2002","src_port":50960,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":31,"flow_first_seen":1605291690373,"flow_last_seen":1605291690520,"flow_tot_l4_data_len":6692,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":215,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2002","src_port":51006,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":11682,"source":"reddit.pcap","alias":"nDPId-test"} diff --git a/test/results/rx.pcap.out b/test/results/rx.pcap.out index bb41d43f1..d37557ca4 100644 --- a/test/results/rx.pcap.out +++ b/test/results/rx.pcap.out @@ -1,3 +1,4 @@ +00379{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"rx.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":0,"flow_tot_l4_data_len":300,"flow_min_l4_data_len":300,"flow_max_l4_data_len":300,"flow_avg_l4_data_len":300,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00781{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647264,"pkt_ts_usec":18403,"pkt_caplen":334,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":334,"pkt_l4_len":300,"pkt":"PIqwbTfwAAjK968mCABFAAFA5\/AAAEARo32DctuowKfOfKJXG1oBLBrkVw+1YFw\/yYgAAAABAAAAAQAAAAEBBQAAAAAASQAAAfgAAAABAAAAZwAAAGkAAABvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="} 00503{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1460647264018,"flow_last_seen":0,"flow_tot_l4_data_len":300,"flow_min_l4_data_len":300,"flow_max_l4_data_len":300,"flow_avg_l4_data_len":300,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","ndpi": {"proto":"RX","breed":"Acceptable","category":"RPC"}} @@ -59,3 +60,9 @@ 00448{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":305310,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"AAjK968mPIqwbTfwCABFAABIUYoAADoRQNzAp858g3LbqBtYG1kANGRrpznrEIIX+MQAAAAAAAAAAAAAAAEGAAACAAAAAQAAAAIPbFORAAAAAAAAAAA="} 00922{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":305347,"pkt_caplen":435,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":435,"pkt_l4_len":401,"pkt":"PIqwbTfwAAjK968mCABFAAGl9z4AAEARk8qDctuowKfOfBtZG1gBkZ0QpznrEIIX+MQAAAAAAAAAAAAAAAIHAQACAAAAAQAAAAIAAAAAbN8VeUBVvisWQ9S6x95dol\/TUOn9bl0f90I3hGv3uVWDizOZmldnlgAAAQAAAAE1YYIBMTCCAS2gAwIBBaELGwlVWi5TTlMuSVSiGzAZoAMCAQChEjAQGwNhZnMbCXV6LnNucy5pdKOB+zCB+KADAgEBoQMCAQKigesEgejNCW5m+7aBGuNoiVjkIJzx2tfXcLBv38bKqTxnfkKpelrtA2NteZ8teA2NY\/JcS7qvCbZJ5UfKfc0XKBLSX738gQiqTXl3VrPW6tJlGduoYTSlbLyRRjJPbpfA8K1\/szhWNGSiFLmMKWb9D3hNBBWPTEvqEyYAaHPUgal5Rc1F+EXgRSJeXlbJkNTV4kp3P8IMhfBmmyZrdnmNbYh2kOEX\/XLBBA7VWh1HbE3nAPhiu\/cR5WVZnVZ83fKFION8RnxUZiNj5tJwTg5Xm0rlK0JDrC0ZWhW0UJRkXyn0UNTnL\/w5O\/ofVSgO"} 00432{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"rx.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1460647300,"pkt_ts_usec":308261,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AAjK968mPIqwbTfwCABFAAA8UYsAADoRQOfAp858g3LbqBtYG1kAKDkyna9LKFupW+gAAAADAAAAAQAAAAUBBQAAAAAAAQABAAI="} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1460647264018,"flow_last_seen":1460647264026,"flow_tot_l4_data_len":417,"flow_min_l4_data_len":44,"flow_max_l4_data_len":300,"flow_avg_l4_data_len":139,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":41559,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":20,"flow_first_seen":1460647299986,"flow_last_seen":1460647320158,"flow_tot_l4_data_len":2462,"flow_min_l4_data_len":36,"flow_max_l4_data_len":476,"flow_avg_l4_data_len":123,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":79,"flow_first_seen":1460647299704,"flow_last_seen":1460647320158,"flow_tot_l4_data_len":9690,"flow_min_l4_data_len":36,"flow_max_l4_data_len":748,"flow_avg_l4_data_len":122,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.241","src_port":7001,"dst_port":7000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":27,"flow_first_seen":1460647299605,"flow_last_seen":1460647300326,"flow_tot_l4_data_len":9001,"flow_min_l4_data_len":48,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":333,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":7001,"dst_port":7003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1460647283326,"flow_last_seen":1460647283340,"flow_tot_l4_data_len":417,"flow_min_l4_data_len":44,"flow_max_l4_data_len":300,"flow_avg_l4_data_len":139,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.219.168","dst_ip":"192.167.206.124","src_port":38331,"dst_port":7002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00123{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":132,"source":"rx.pcap","alias":"nDPId-test"} diff --git a/test/results/s7comm.pcap.out b/test/results/s7comm.pcap.out index 8ee2c0d00..bb324e10d 100644 --- a/test/results/s7comm.pcap.out +++ b/test/results/s7comm.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"s7comm.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00469{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"s7comm.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1408528803880,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.10","dst_ip":"192.168.1.40","src_port":4185,"dst_port":102,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"s7comm.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1408528803,"pkt_ts_usec":880679,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"ABsbI+s7kOa6hF5BCABFAAA+LUtAAIAGAADAqAEKwKgBKBBZAGaQRN2iAAL7EFAY+vCDswAAAwAAFhHgAAAABwDBAgEAwgIBAsABCg=="} 00503{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"s7comm.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1408528803880,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.10","dst_ip":"192.168.1.40","src_port":4185,"dst_port":102,"l4_proto":"tcp","ndpi": {"proto":"s7comm","breed":"Acceptable","category":"Network"}} @@ -15,3 +16,5 @@ 00708{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"s7comm.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1408528803,"pkt_ts_usec":910535,"pkt_caplen":275,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":275,"pkt_l4_len":241,"pkt":"kOa6hF5BABsbI+s7CABFAAEFANIAAB4GF5\/AqAEowKgBCgBmEFkAAvvjkETeSVAYEADS7gAAAwAA3QLwgDIHAAAFAAAMAMAAARIIEoQBAQAAAAD\/CQC8ABMAAAAkAAUAAQABAAMAAAARAAAAAwAAAAABYAAAAAAAAAAAAAAAAAAAAAAAAgABAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwACAAIAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAATKgAAAAAABAACAIAAAAACAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAABQACAAAFAAACAAAAAAAAAAAAAAAAAAAAAAUAAAAAIAAAAAA="} 00419{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"s7comm.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1408528803,"pkt_ts_usec":910642,"pkt_caplen":61,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":61,"pkt_l4_len":27,"pkt":"ABsbI+s7kOa6hF5BCABFAAAvLVNAAIAGAADAqAEKwKgBKBBZAGaQRN5JAAL8wFAY+UCDpAAAAwAABwLwAA=="} 00451{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"s7comm.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1408528803,"pkt_ts_usec":910913,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"ABsbI+s7kOa6hF5BCABFAABJLVRAAIAGAADAqAEKwKgBKBBZAGaQRN5QAAL8wFAY+UCDvgAAAwAAIQLwgDIHAAAGAAAIAAgAARIEEUQBAP8JAAQBMQAE"} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":55,"source":"s7comm.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":55,"flow_first_seen":1408528803880,"flow_last_seen":1408528804016,"flow_tot_l4_data_len":3390,"flow_min_l4_data_len":27,"flow_max_l4_data_len":267,"flow_avg_l4_data_len":61,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.10","dst_ip":"192.168.1.40","src_port":4185,"dst_port":102,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":55,"source":"s7comm.pcap","alias":"nDPId-test"} diff --git a/test/results/selfsigned.pcap.out b/test/results/selfsigned.pcap.out index 7f51aa500..e4e685270 100644 --- a/test/results/selfsigned.pcap.out +++ b/test/results/selfsigned.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"selfsigned.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00392{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"selfsigned.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588921646,"pkt_ts_usec":472768,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AgAAAEUAAEAAAEAAQAYAAH8AAAF\/AAAByZcLuc3ubiYAAAAAsAL\/\/\/40AAACBD\/YAQMDBQEBCAoTf8z4AAAAAAQCAAA="} 00179{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":1,"source":"selfsigned.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00393{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"selfsigned.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588921646,"pkt_ts_usec":472882,"pkt_caplen":68,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":68,"pkt_l4_len":0,"pkt":"AgAAAEUAAEAAAEAAQAYAAH8AAAF\/AAABC7nJlxL1FVDN7m4nsBL\/\/\/40AAACBD\/YAQMDBQEBCAoTf8z4E3\/M+AQCAAA="} @@ -38,3 +39,4 @@ 00180{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":19,"source":"selfsigned.pcap","alias":"nDPId-test","datalink":0,"header":33554432} 00357{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":20,"source":"selfsigned.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588921646,"pkt_ts_usec":517337,"pkt_caplen":44,"pkt_type":0,"pkt_l3_offset":0,"pkt_l4_offset":0,"pkt_len":44,"pkt_l4_len":0,"pkt":"AgAAAEUAACgAAEAAQAYAAH8AAAF\/AAABC7nJlxL1HEsAAAAAUAQAAP4cAAA="} 00180{"basic_event_id":1,"basic_event_name":"Unknown datalink layer packet","thread_id":0,"packet_id":20,"source":"selfsigned.pcap","alias":"nDPId-test","datalink":0,"header":33554432} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":20,"source":"selfsigned.pcap","alias":"nDPId-test"} diff --git a/test/results/signal.pcap.out b/test/results/signal.pcap.out index 699c79a97..559e7036c 100644 --- a/test/results/signal.pcap.out +++ b/test/results/signal.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"signal.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569051245838,"flow_last_seen":0,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00806{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051245,"pkt_ts_usec":838268,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/2DBiVgAcCABFAAFIKS8AAP8RkXYAAAAA\/\/\/\/\/wBEAEMBNJxAAQEGACG6jqoAAQAAAAAAAAAAAAAAAAAAAAAAANgwYlYAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwoBeQMGD3f8XywuOQIF3D0HAdgwYlYAHDMEAHanAAwKTHVjYXMtaU1hY\/8AAAAAAAAAAAAAAAAA"} 00556{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569051245838,"flow_last_seen":0,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,121,3,6,15,119,252,95,44,46"}} @@ -276,3 +277,24 @@ 00427{"flow_id":19,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":386,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":243402,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGbb3AqAIRDSP9Kt7DAbsjR81wv8CY+4AQA\/8l0gAAAQEICihVno2vNN\/a"} 00500{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":387,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":250865,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGbYjAqAIRDSP9Kt7DAbsjR81wv8CY+4AYBADbrwAAAQEICihVnpSvNN\/aFwMDADAAAAAAAAAAAVWG6O8VCZhpL3ljuuQbyjQJH99xwYFcfRw3CnAmaC4jWGNvCJKk0L4="} 01137{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":627,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":255,"flow_first_seen":1569051267121,"flow_last_seen":1569051267505,"flow_tot_l4_data_len":206833,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":811,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.signal.org","server_names":"cdn.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"c4b2785a87896e19d37eee932070cb22","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=cdn.signal.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"81:3D:8A:2E:EE:B2:E1:F4:1C:2B:6D:20:16:54:B2:C1:87:D0:1E:12"}} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1569051245838,"flow_last_seen":1569051261595,"flow_tot_l4_data_len":1232,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1569051255515,"flow_last_seen":1569051255541,"flow_tot_l4_data_len":333,"flow_min_l4_data_len":32,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":41,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.146.144","src_port":56996,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1569051255515,"flow_last_seen":1569051255541,"flow_tot_l4_data_len":333,"flow_min_l4_data_len":32,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":41,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.146.144","src_port":56996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":12,"flow_first_seen":1569051266396,"flow_last_seen":1569051267048,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":39,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.24.16","dst_ip":"192.168.2.17","src_port":443,"dst_port":57016,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":12,"flow_first_seen":1569051266396,"flow_last_seen":1569051267048,"flow_tot_l4_data_len":471,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":39,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.24.16","dst_ip":"192.168.2.17","src_port":443,"dst_port":57016,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":45,"flow_first_seen":1569051247599,"flow_last_seen":1569051247843,"flow_tot_l4_data_len":13052,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":290,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":45,"flow_first_seen":1569051264078,"flow_last_seen":1569051264482,"flow_tot_l4_data_len":13683,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":304,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57022,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":27,"flow_first_seen":1569051247600,"flow_last_seen":1569051261087,"flow_tot_l4_data_len":4704,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":174,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":27,"flow_first_seen":1569051247601,"flow_last_seen":1569051261087,"flow_tot_l4_data_len":4747,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":175,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":26,"flow_first_seen":1569051247603,"flow_last_seen":1569051261087,"flow_tot_l4_data_len":4933,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":189,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":26,"flow_first_seen":1569051264090,"flow_last_seen":1569051264669,"flow_tot_l4_data_len":4727,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":26,"flow_first_seen":1569051264091,"flow_last_seen":1569051264679,"flow_tot_l4_data_len":4945,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":190,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":26,"flow_first_seen":1569051264093,"flow_last_seen":1569051264674,"flow_tot_l4_data_len":4684,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":38,"flow_first_seen":1569051264666,"flow_last_seen":1569051265237,"flow_tot_l4_data_len":18958,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":498,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1569051257169,"flow_last_seen":1569051257194,"flow_tot_l4_data_len":266,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"2.18.232.118","src_port":57017,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1569051257169,"flow_last_seen":1569051257194,"flow_tot_l4_data_len":266,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"2.18.232.118","src_port":57017,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":24,"flow_first_seen":1569051247594,"flow_last_seen":1569051257495,"flow_tot_l4_data_len":4441,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":185,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":25,"flow_first_seen":1569051264073,"flow_last_seen":1569051267100,"flow_tot_l4_data_len":5313,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":212,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1569051264088,"flow_last_seen":1569051264113,"flow_tot_l4_data_len":222,"flow_min_l4_data_len":63,"flow_max_l4_data_len":159,"flow_avg_l4_data_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":56263,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1569051247593,"flow_last_seen":1569051247630,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":60793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test"} diff --git a/test/results/simple-dnscrypt.pcap.out b/test/results/simple-dnscrypt.pcap.out index dbb6c4158..6f570ab63 100644 --- a/test/results/simple-dnscrypt.pcap.out +++ b/test/results/simple-dnscrypt.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1491813284555,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.167","dst_ip":"134.119.26.24","src_port":50233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491813284,"pkt_ts_usec":555591,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"uFpz9d6dpDTZFrEGCABFAAA0PRVAAIAGMNDAqCunhncaGMQ5Abvf\/XrjAAAAAIACIAChWwAAAgQFtAEDAwgBAQQC"} 00432{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491813284,"pkt_ts_usec":666208,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"pDTZFrEGuFpz9d6dCABFAAA0AABAADMGuuWGdxoYwKgrpwG7xDnBW87r3\/165IASchC\/iQAAAgQFHgEBBAIBAwMH"} @@ -74,3 +75,8 @@ 00833{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491813286,"pkt_ts_usec":612927,"pkt_caplen":360,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":360,"pkt_l4_len":326,"pkt":"pDTZFrEGuFpz9d6dCABFAAFaPCdAADMGfZiGdxoYwKgrpwG7xFKVdMKUXuwPVlAYAO24IwAAOniMGP4VfxmqNYQkfmYsWzbtFzPT8SzMmHLpB8VEC49Krcr1+mK5gWMneNpnV9dODfdehLZnP0A\/O2j3PCFXZww0C2p7j2lBW5KK\/nFKj0DgymGHVQn2sGgTGQbXWLq7kpacgXw8M39PxN7RT2S8WR98pWYHn6moqRPQIUN71ryQq2I3sVu3GSK+WnX6dN+gVflqI+wV93ySPTZNsauRM\/ypKN7HSpQlBFHVKNMAggEU3sXbo\/\/YnRHEE0y13nL0P5k6I9ow\/Isps7udr+o640FCadudaRKKLP7C888mtsiggJjlQ8I3kTpna8W+eEWAtsai9jHCC0AwVsAYwxrsXIn4elp8rDeNYgHNpBqZu2j1wa+9s3OgRLcQiqmrn4PiMSsVVK0GYu0nFgMDAAQOAAAA"} 00416{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491813286,"pkt_ts_usec":613108,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"uFpz9d6dpDTZFrEGCABFAAAoPUBAAIAGMLHAqCunhncaGMRSAbte7A9WlXTDxlAQAECVKgAA"} 00589{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1491813286,"pkt_ts_usec":617377,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"uFpz9d6dpDTZFrEGCABFAACmPUFAAIAGMDLAqCunhncaGMRSAbte7A9WlXTDxlAYAEBXewAAFgMDAEYQAABCQQS3Xp2AlfFC22Y2YogKVYDmOcIMxJboN\/X7MTLKc+s0a\/3KPHASyDk0CPcYXgtszMN5ekLUAAOsBJqGyUfM8brVFAMDAAEBFgMDACgAAAAAAAAAAGSqZuE6blT7eearrYamBpAP9Uxx8q45CrWFtb1OeTqe"} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":111,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":39,"flow_first_seen":1491813284555,"flow_last_seen":1491813285262,"flow_tot_l4_data_len":15042,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1330,"flow_avg_l4_data_len":385,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.167","dst_ip":"134.119.26.24","src_port":50233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":111,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1491813286275,"flow_last_seen":1491813286718,"flow_tot_l4_data_len":7903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1330,"flow_avg_l4_data_len":439,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.167","dst_ip":"134.119.26.24","src_port":50253,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":111,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":18,"flow_first_seen":1491813286392,"flow_last_seen":1491813286753,"flow_tot_l4_data_len":7903,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1330,"flow_avg_l4_data_len":439,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.167","dst_ip":"134.119.26.24","src_port":50258,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":111,"source":"simple-dnscrypt.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":36,"flow_first_seen":1491813286393,"flow_last_seen":1491813286913,"flow_tot_l4_data_len":10054,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1330,"flow_avg_l4_data_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.43.167","dst_ip":"134.119.26.24","src_port":50259,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00136{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":111,"source":"simple-dnscrypt.pcap","alias":"nDPId-test"} diff --git a/test/results/sip.pcap.out b/test/results/sip.pcap.out index 222e1a697..fde8ed981 100644 --- a/test/results/sip.pcap.out +++ b/test/results/sip.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"sip.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469572844,"flow_last_seen":0,"flow_tot_l4_data_len":475,"flow_min_l4_data_len":475,"flow_max_l4_data_len":475,"flow_avg_l4_data_len":475,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01013{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120469572,"pkt_ts_usec":844249,"pkt_caplen":509,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":509,"pkt_l4_len":475,"pkt":"ADBUADRWAODtAW69CABFAAHvaZgAAIARF6bAqAEC1PIhIxPEE8QB2272UkVHSVNURVIgc2lwOnNpcC5jeWJlcmNpdHkuZGsgU0lQLzIuMA0KVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4LjEuMjticmFuY2g9ejloRzRiS25wMTUxMjQ4NzM3LTQ2ZWE3MTVlMTkyLjE2OC4xLjI7cnBvcnQNCkZyb206IDxzaXA6dm9pMTgwNjNAc2lwLmN5YmVyY2l0eS5kaz47dGFnPTkwM2RmMGENClRvOiA8c2lwOnZvaTE4MDYzQHNpcC5jeWJlcmNpdHkuZGs+DQpDYWxsLUlEOiA1NzgyMjI3MjktNDY2NWQ3NzVANTc4MjIyNzMyLTQ2NjVkNzcyDQpDb250YWN0OiAgPHNpcDp2b2kxODA2M0AxOTIuMTY4LjEuMjo1MDYwO2xpbmU9OWM3ZDJkYmQ4ODIyMDEzYz47ZXhwaXJlcz0xMjAwO3E9MC41MDANCkV4cGlyZXM6IDEyMDANCkNTZXE6IDY4IFJFR0lTVEVSDQpDb250ZW50LUxlbmd0aDogMA0KTWF4LUZvcndhcmRzOiA3MA0KVXNlci1BZ2VudDogTmVybyBTSVBQUyBJUCBQaG9uZSBWZXJzaW9uIDIuMC41MS4xNg0KDQo="} 00499{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1120469572844,"flow_last_seen":0,"flow_tot_l4_data_len":475,"flow_min_l4_data_len":475,"flow_max_l4_data_len":475,"flow_avg_l4_data_len":475,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","ndpi": {"proto":"SIP","breed":"Acceptable","category":"VoIP"}} @@ -48,3 +49,6 @@ 00531{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1120470986,"pkt_ts_usec":363611,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"ADBUADRWAODtAW69CABFAACEbAUAAIARFqPAqAEC1PIhJHUxnckAcCyBgMgABjeWy3FCyQfKXvrGAwAAJMMAAAAJAAAGDIHKAAs3lstxAR0xMTg5NDI5Ny00NDMyYTlmOEAxOTIuMTY4LjEuMgYFU0lQUFMAAIHLAAY3lstxEHNlc3Npb24gc2h1dGRvd24AAAA="} 00504{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","ndpi": {"proto":"RTCP","breed":"Acceptable","category":"VoIP"}} 00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":105,"source":"sip.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1120470986363,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30001,"dst_port":40393,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":84,"flow_first_seen":1120469572844,"flow_last_seen":1120471094413,"flow_tot_l4_data_len":34719,"flow_min_l4_data_len":13,"flow_max_l4_data_len":1084,"flow_avg_l4_data_len":413,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.35","src_port":5060,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":9,"flow_first_seen":1120470985348,"flow_last_seen":1120470985511,"flow_tot_l4_data_len":1620,"flow_min_l4_data_len":180,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":180,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"212.242.33.36","src_port":30000,"dst_port":40392,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":112,"source":"sip.pcap","alias":"nDPId-test"} diff --git a/test/results/skype-conference-call.pcap.out b/test/results/skype-conference-call.pcap.out index 7c2d50c22..216b5a892 100644 --- a/test/results/skype-conference-call.pcap.out +++ b/test/results/skype-conference-call.pcap.out @@ -1,3 +1,4 @@ +00398{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"skype-conference-call.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"skype-conference-call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1501061916646,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.20","dst_ip":"104.46.40.49","src_port":49282,"dst_port":60642,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00551{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"skype-conference-call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1501061916,"pkt_ts_usec":646303,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"XEl5dU5qxCwDBkn+CABFAACEzEwAAEARWwHAqAIUaC4oMcCC7OIAcIaYAAEAVCESpELFWk\/f3gwyXjBMYMcABgAJZ3BwZTp6V3lrAAAAACQABG7\/\/v+AKgAIAAAAAAC\/QxeAVAABMQAAAIBwAAQAAAADAAgAFMOSZmY4XAmhNOQKDGwu8wYai2KrgCgABB+1m2s="} 00587{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"skype-conference-call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1501061916646,"flow_last_seen":0,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":112,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.20","dst_ip":"104.46.40.49","src_port":49282,"dst_port":60642,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.SkypeCall","breed":"Acceptable","category":"VoIP"}} @@ -15,3 +16,5 @@ 00583{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"skype-conference-call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1501061916,"pkt_ts_usec":808770,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"xCwDBkn+XEl5dU5qCABFAACbRTsAAG4Rs\/toLigxwKgCFOziwIIAh3g4gMkABgAAA+kozqPuZhFQtvXYhXLU9laq6VpMsxyF5TyhbvlCVt7zAQFZOlRbxtk69tkjpENIlvzMKACC+zjGaufaaX4NQvZmRVnu7CWMI45MVTTEiJyIi0Y0uEFenTy\/eoe7G29X6WGy1lhMaBQE7oAAAAsBKpMsVI2YWnKXTg=="} 00585{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"skype-conference-call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1501061916,"pkt_ts_usec":808981,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"xCwDBkn+XEl5dU5qCABFAACbRTwAAG4Rs\/poLigxwKgCFOziwIIAh7GygMkABgAABE31YJhxpeEStx\/Non2Hw9ODhjn1nPI6twAa6v4TPbXALXJS4WDhGnHiGs7M0q1LV5JIhmLN19a4UZ2oNcceD7gcC6\/hlfHMoWziriN+88lO8+6FVpNUywPwW580clvLUe3t1RqG\/Q2pUoAAAAwB9dds5qvBKmJN+A=="} 00585{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"skype-conference-call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1501061916,"pkt_ts_usec":809040,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"xCwDBkn+XEl5dU5qCABFAACbRT0AAG4Rs\/loLigxwKgCFOziwIIAh3lxgMkABgAABLEYhveI+TJqXoNflKzETGTrRbw2whOI8HHGZ9H1FnMJe5bOVFI65E6c22uJfv\/qd5toD\/qg2AhULgiZ0dL4yqWJoA7uey4F0+\/ntXNU1VN2Qkq5FFOEjp3tzTNRRgKcJLBlUIvR1ZSm7IAAAA0B0DttNZRbKmPtmw=="} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":200,"source":"skype-conference-call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":200,"flow_first_seen":1501061916646,"flow_last_seen":1501061918151,"flow_tot_l4_data_len":32887,"flow_min_l4_data_len":40,"flow_max_l4_data_len":923,"flow_avg_l4_data_len":164,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.20","dst_ip":"104.46.40.49","src_port":49282,"dst_port":60642,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00142{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":200,"source":"skype-conference-call.pcap","alias":"nDPId-test"} diff --git a/test/results/skype.pcap.out b/test/results/skype.pcap.out index 7287e1ff8..7541c53a4 100644 --- a/test/results/skype.pcap.out +++ b/test/results/skype.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"skype.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00467{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431969641947,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969641,"pkt_ts_usec":947863,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAt5UAAEARP6TAqAEiwKgBAcALADUALIa2zTYBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} 00635{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431969641947,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -2669,3 +2670,100 @@ 00426{"flow_id":310,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3265,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969807,"pkt_ts_usec":703292,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0gkhAAEAGxXPAqAEiTsric8PgcYPYQ6CkVPCO1YARECnJNgAAAQEICj4lDf8CUMnN"} 00426{"flow_id":310,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3273,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969808,"pkt_ts_usec":350555,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0OwJAAEAGDLrAqAEiTsric8PgcYPYQ6CkVPCO1YARECnGsgAAAQEICj4lEIMCUMnN"} 00439{"flow_id":305,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3282,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969808,"pkt_ts_usec":684170,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8us9AAEAGP5vAqAEiUA4uecPdET\/5wLpfrY8XW4AZECiq1wAAAQEICj4lEdAAA1guNacy1AseEXM="} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1431969642087,"flow_last_seen":1431969695591,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52850,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":7,"flow_first_seen":1431969675950,"flow_last_seen":1431969702405,"flow_tot_l4_data_len":413,"flow_min_l4_data_len":59,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63108,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":14,"flow_first_seen":1431969788719,"flow_last_seen":1431969803191,"flow_tot_l4_data_len":656,"flow_min_l4_data_len":32,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50143,"dst_port":29059,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":14,"flow_first_seen":1431969788719,"flow_last_seen":1431969803191,"flow_tot_l4_data_len":656,"flow_min_l4_data_len":32,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50143,"dst_port":29059,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":14,"flow_first_seen":1431969789832,"flow_last_seen":1431969808350,"flow_tot_l4_data_len":663,"flow_min_l4_data_len":32,"flow_max_l4_data_len":105,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50144,"dst_port":29059,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":310,"flow_packet_id":14,"flow_first_seen":1431969789832,"flow_last_seen":1431969808350,"flow_tot_l4_data_len":663,"flow_min_l4_data_len":32,"flow_max_l4_data_len":105,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50144,"dst_port":29059,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_first_seen":1431969698743,"flow_last_seen":1431969698797,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":7,"flow_first_seen":1431969675950,"flow_last_seen":1431969702405,"flow_tot_l4_data_len":413,"flow_min_l4_data_len":59,"flow_max_l4_data_len":59,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55159,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1431969642247,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65426,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":2,"flow_first_seen":1431969712913,"flow_last_seen":1431969712913,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":49485,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00456{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":8,"flow_first_seen":1431969712918,"flow_last_seen":1431969747557,"flow_tot_l4_data_len":384,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":7,"flow_first_seen":1431969723979,"flow_last_seen":1431969750316,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63421,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":316,"flow_packet_id":1,"flow_first_seen":1431969807022,"flow_last_seen":0,"flow_tot_l4_data_len":510,"flow_min_l4_data_len":510,"flow_max_l4_data_len":510,"flow_avg_l4_data_len":510,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":7,"flow_first_seen":1431969642398,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57288,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":4,"flow_first_seen":1431969712913,"flow_last_seen":1431969714738,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54067,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":4,"flow_first_seen":1431969712913,"flow_last_seen":1431969714738,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54067,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1431969641947,"flow_last_seen":1431969668369,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1431969641948,"flow_last_seen":1431969668369,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57406,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":317,"flow_packet_id":1,"flow_first_seen":1431969807022,"flow_last_seen":0,"flow_tot_l4_data_len":510,"flow_min_l4_data_len":510,"flow_max_l4_data_len":510,"flow_avg_l4_data_len":510,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":86,"flow_first_seen":1431969719110,"flow_last_seen":1431969765415,"flow_tot_l4_data_len":17270,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":200,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":50128,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":7,"flow_first_seen":1431969677975,"flow_last_seen":1431969704363,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49360,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":4,"flow_first_seen":1431969713815,"flow_last_seen":1431969726847,"flow_tot_l4_data_len":692,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969794907,"flow_tot_l4_data_len":632,"flow_min_l4_data_len":32,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50135,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969794907,"flow_tot_l4_data_len":632,"flow_min_l4_data_len":32,"flow_max_l4_data_len":96,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50135,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_first_seen":1431969774806,"flow_last_seen":1431969776480,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50140,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_first_seen":1431969774806,"flow_last_seen":1431969776480,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50140,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_tot_l4_data_len":4474,"flow_min_l4_data_len":20,"flow_max_l4_data_len":364,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_tot_l4_data_len":4474,"flow_min_l4_data_len":20,"flow_max_l4_data_len":364,"flow_avg_l4_data_len":223,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":7,"flow_first_seen":1431969643972,"flow_last_seen":1431969670410,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1431969642087,"flow_last_seen":1431969695591,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":4,"flow_first_seen":1431969713814,"flow_last_seen":1431969726846,"flow_tot_l4_data_len":692,"flow_min_l4_data_len":173,"flow_max_l4_data_len":173,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":14,"flow_first_seen":1431969728749,"flow_last_seen":1431969734854,"flow_tot_l4_data_len":6805,"flow_min_l4_data_len":441,"flow_max_l4_data_len":521,"flow_avg_l4_data_len":486,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"239.255.255.250","src_port":50084,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":16,"flow_first_seen":1431969649862,"flow_last_seen":1431969790906,"flow_tot_l4_data_len":5436,"flow_min_l4_data_len":32,"flow_max_l4_data_len":986,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"108.160.170.46","dst_ip":"192.168.1.34","src_port":443,"dst_port":49445,"l4_proto":"tcp","ndpi": {"proto":"TLS.Dropbox","breed":"Acceptable","category":"Cloud"}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":16,"flow_first_seen":1431969649862,"flow_last_seen":1431969790906,"flow_tot_l4_data_len":5436,"flow_min_l4_data_len":32,"flow_max_l4_data_len":986,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"108.160.170.46","dst_ip":"192.168.1.34","src_port":443,"dst_port":49445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":5,"flow_first_seen":1431969793871,"flow_last_seen":1431969802019,"flow_tot_l4_data_len":190,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55893,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1431969642318,"flow_last_seen":1431969642376,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":7,"flow_first_seen":1431969721954,"flow_last_seen":1431969748263,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51802,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":43,"flow_first_seen":1431969715510,"flow_last_seen":1431969755612,"flow_tot_l4_data_len":4286,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50117,"dst_port":18767,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":43,"flow_first_seen":1431969715510,"flow_last_seen":1431969755612,"flow_tot_l4_data_len":4286,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50117,"dst_port":18767,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":27,"flow_first_seen":1431969718289,"flow_last_seen":1431969752365,"flow_tot_l4_data_len":1180,"flow_min_l4_data_len":32,"flow_max_l4_data_len":99,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50127,"dst_port":4415,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":27,"flow_first_seen":1431969718289,"flow_last_seen":1431969752365,"flow_tot_l4_data_len":1180,"flow_min_l4_data_len":32,"flow_max_l4_data_len":99,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50127,"dst_port":4415,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":79,"flow_first_seen":1431969648258,"flow_last_seen":1431969808391,"flow_tot_l4_data_len":26793,"flow_min_l4_data_len":293,"flow_max_l4_data_len":371,"flow_avg_l4_data_len":339,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"239.255.255.250","src_port":1025,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":305,"flow_packet_id":15,"flow_first_seen":1431969783628,"flow_last_seen":1431969808684,"flow_tot_l4_data_len":727,"flow_min_l4_data_len":32,"flow_max_l4_data_len":131,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50141,"dst_port":4415,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":305,"flow_packet_id":15,"flow_first_seen":1431969783628,"flow_last_seen":1431969808684,"flow_tot_l4_data_len":727,"flow_min_l4_data_len":32,"flow_max_l4_data_len":131,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50141,"dst_port":4415,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":18,"flow_first_seen":1431969784741,"flow_last_seen":1431969808951,"flow_tot_l4_data_len":862,"flow_min_l4_data_len":32,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50142,"dst_port":4415,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":306,"flow_packet_id":18,"flow_first_seen":1431969784741,"flow_last_seen":1431969808951,"flow_tot_l4_data_len":862,"flow_min_l4_data_len":32,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.14.46.121","src_port":50142,"dst_port":4415,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969789490,"flow_tot_l4_data_len":625,"flow_min_l4_data_len":20,"flow_max_l4_data_len":101,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50136,"dst_port":18767,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":296,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969789490,"flow_tot_l4_data_len":625,"flow_min_l4_data_len":20,"flow_max_l4_data_len":101,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50136,"dst_port":18767,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":32,"flow_first_seen":1431969771806,"flow_last_seen":1431969808100,"flow_tot_l4_data_len":3884,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50138,"dst_port":18767,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":298,"flow_packet_id":32,"flow_first_seen":1431969771806,"flow_last_seen":1431969808100,"flow_tot_l4_data_len":3884,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":50138,"dst_port":18767,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":7,"flow_first_seen":1431969642337,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":294,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":2,"flow_first_seen":1431969745776,"flow_last_seen":1431969745776,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":64560,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431969643037,"flow_last_seen":1431969643092,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":20,"flow_first_seen":1431969714165,"flow_last_seen":1431969745160,"flow_tot_l4_data_len":804,"flow_min_l4_data_len":20,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":20,"flow_first_seen":1431969714165,"flow_last_seen":1431969745160,"flow_tot_l4_data_len":804,"flow_min_l4_data_len":20,"flow_max_l4_data_len":347,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":9,"flow_first_seen":1431969642969,"flow_last_seen":1431969723490,"flow_tot_l4_data_len":342,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49903,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":40,"flow_first_seen":1431969716015,"flow_last_seen":1431969752089,"flow_tot_l4_data_len":4249,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1156,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":50121,"dst_port":17639,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":40,"flow_first_seen":1431969716015,"flow_last_seen":1431969752089,"flow_tot_l4_data_len":4249,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1156,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":50121,"dst_port":17639,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":100,"flow_first_seen":1431969715511,"flow_last_seen":1431969808618,"flow_tot_l4_data_len":8866,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1215,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"86.31.35.30","src_port":50119,"dst_port":59621,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":100,"flow_first_seen":1431969715511,"flow_last_seen":1431969808618,"flow_tot_l4_data_len":8866,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1215,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"86.31.35.30","src_port":50119,"dst_port":59621,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":7,"flow_first_seen":1431969642398,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49990,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":7,"flow_first_seen":1431969643971,"flow_last_seen":1431969670410,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60288,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":12,"flow_first_seen":1431969717899,"flow_last_seen":1431969784849,"flow_tot_l4_data_len":1469,"flow_min_l4_data_len":32,"flow_max_l4_data_len":437,"flow_avg_l4_data_len":122,"midstream":1,"l3_proto":"ip4","src_ip":"17.143.160.22","dst_ip":"192.168.1.34","src_port":5223,"dst_port":49447,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":15,"flow_first_seen":1431969750597,"flow_last_seen":1431969791165,"flow_tot_l4_data_len":1404,"flow_min_l4_data_len":20,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.47","src_port":50134,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":291,"flow_packet_id":15,"flow_first_seen":1431969750597,"flow_last_seen":1431969791165,"flow_tot_l4_data_len":1404,"flow_min_l4_data_len":20,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.47","src_port":50134,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":7,"flow_first_seen":1431969792168,"flow_last_seen":1431969802183,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":28,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50145,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":7,"flow_first_seen":1431969792168,"flow_last_seen":1431969802183,"flow_tot_l4_data_len":292,"flow_min_l4_data_len":28,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50145,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":31,"flow_first_seen":1431969715511,"flow_last_seen":1431969755484,"flow_tot_l4_data_len":3634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50118,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":31,"flow_first_seen":1431969715511,"flow_last_seen":1431969755484,"flow_tot_l4_data_len":3634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50118,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":2,"flow_first_seen":1431969719055,"flow_last_seen":1431969719110,"flow_tot_l4_data_len":166,"flow_min_l4_data_len":67,"flow_max_l4_data_len":99,"flow_avg_l4_data_len":83,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62454,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":18,"flow_first_seen":1431969770694,"flow_last_seen":1431969788429,"flow_tot_l4_data_len":833,"flow_min_l4_data_len":20,"flow_max_l4_data_len":114,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50137,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":18,"flow_first_seen":1431969770694,"flow_last_seen":1431969788429,"flow_tot_l4_data_len":833,"flow_min_l4_data_len":20,"flow_max_l4_data_len":114,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50137,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":7,"flow_first_seen":1431969683445,"flow_last_seen":1431969709776,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58368,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":23,"flow_first_seen":1431969771806,"flow_last_seen":1431969808841,"flow_tot_l4_data_len":3337,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50139,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":23,"flow_first_seen":1431969771806,"flow_last_seen":1431969808841,"flow_tot_l4_data_len":3337,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50139,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":7,"flow_first_seen":1431969720556,"flow_last_seen":1431969746803,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":56387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":7,"flow_first_seen":1431969683445,"flow_last_seen":1431969709776,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54343,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":7,"flow_first_seen":1431969677975,"flow_last_seen":1431969704363,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58458,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":7,"flow_first_seen":1431969642244,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54396,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":2,"flow_first_seen":1431969745776,"flow_last_seen":1431969745776,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":56886,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":387,"flow_first_seen":1431969642444,"flow_last_seen":1431969808620,"flow_tot_l4_data_len":184932,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":477,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":50028,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":5,"flow_first_seen":1431969713813,"flow_last_seen":1431969733946,"flow_tot_l4_data_len":130,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.185.207.12","src_port":13021,"dst_port":45493,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":294,"flow_packet_id":2,"flow_first_seen":1431969759543,"flow_last_seen":1431969759588,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.253.48.245","src_port":123,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1431969642334,"flow_last_seen":1431969642400,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":67,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58681,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":314,"flow_packet_id":8,"flow_first_seen":1431969792778,"flow_last_seen":1431969803795,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":28,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50146,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":314,"flow_packet_id":8,"flow_first_seen":1431969792778,"flow_last_seen":1431969803795,"flow_tot_l4_data_len":336,"flow_min_l4_data_len":28,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50146,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":22,"flow_first_seen":1431969717295,"flow_last_seen":1431969788791,"flow_tot_l4_data_len":888,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.133.19.185","src_port":50124,"dst_port":44431,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":22,"flow_first_seen":1431969717295,"flow_last_seen":1431969788791,"flow_tot_l4_data_len":888,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.133.19.185","src_port":50124,"dst_port":44431,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":5,"flow_first_seen":1431969713813,"flow_last_seen":1431969733946,"flow_tot_l4_data_len":130,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.26.55.167","src_port":13021,"dst_port":63773,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":2,"flow_first_seen":1431969712913,"flow_last_seen":1431969712913,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":51066,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":7,"flow_first_seen":1431969721954,"flow_last_seen":1431969748262,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52714,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":7,"flow_first_seen":1431969720556,"flow_last_seen":1431969746803,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52742,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":7,"flow_first_seen":1431969723979,"flow_last_seen":1431969750316,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65037,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":7,"flow_first_seen":1431969642337,"flow_last_seen":1431969668794,"flow_tot_l4_data_len":294,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65045,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":4,"flow_first_seen":1431969745776,"flow_last_seen":1431969747554,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49511,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":286,"flow_packet_id":4,"flow_first_seen":1431969745776,"flow_last_seen":1431969747554,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49511,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test"} diff --git a/test/results/skype_no_unknown.pcap.out b/test/results/skype_no_unknown.pcap.out index 2156a0c9a..deaff0d4e 100644 --- a/test/results/skype_no_unknown.pcap.out +++ b/test/results/skype_no_unknown.pcap.out @@ -1,3 +1,4 @@ +00393{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"skype_no_unknown.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00443{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431970632290,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.219","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970632,"pkt_ts_usec":290618,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":60,"pkt_l4_len":16,"pkt":"AQBeAAAWJKQ8\/kzXCABGwAAoAABAAAECQXbAqAHb4AAAFpQEAAAiADajAAAAAQIAAADpWbwBAAAAAAAA"} 00475{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431970632290,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.219","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}} @@ -1992,3 +1993,188 @@ 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2145,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431970708715,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51319,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":272,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2145,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":715662,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAWHtAAEAGQ63AqAEi1KEIJMh3NFBvQ5mUAAAAALAC\/\/+uawAAAgQFtAEDAwUBAQgKPjKmLwAAAAAEAgAA"} 00450{"flow_id":268,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":726988,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8s5VAAEAGEEDAqAEilQ0gD8h0NFB7qA9PDQLVqIAZEChN9AAAAQEICj4ypjo\/gOaLNT3NT3k1sQY="} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":14,"flow_first_seen":1431970651380,"flow_last_seen":1431970679567,"flow_tot_l4_data_len":897,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51240,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":14,"flow_first_seen":1431970651380,"flow_last_seen":1431970679567,"flow_tot_l4_data_len":897,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":14,"flow_first_seen":1431970659480,"flow_last_seen":1431970693361,"flow_tot_l4_data_len":887,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":14,"flow_first_seen":1431970659480,"flow_last_seen":1431970693361,"flow_tot_l4_data_len":887,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":14,"flow_first_seen":1431970668514,"flow_last_seen":1431970696319,"flow_tot_l4_data_len":777,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51259,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":14,"flow_first_seen":1431970668514,"flow_last_seen":1431970696319,"flow_tot_l4_data_len":777,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51259,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":14,"flow_first_seen":1431970673563,"flow_last_seen":1431970703649,"flow_tot_l4_data_len":727,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51268,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":14,"flow_first_seen":1431970673563,"flow_last_seen":1431970703649,"flow_tot_l4_data_len":727,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51268,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_first_seen":1431970684583,"flow_last_seen":1431970684880,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51283,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_first_seen":1431970684583,"flow_last_seen":1431970684880,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51283,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431970707911,"flow_last_seen":0,"flow_tot_l4_data_len":26,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"133.236.67.25","src_port":13021,"dst_port":49195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":7,"flow_first_seen":1431970670304,"flow_last_seen":1431970696803,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61095,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":5,"flow_first_seen":1431970687262,"flow_last_seen":1431970707409,"flow_tot_l4_data_len":130,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"83.31.12.173","src_port":13021,"dst_port":23939,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":7,"flow_first_seen":1431970634729,"flow_last_seen":1431970661287,"flow_tot_l4_data_len":301,"flow_min_l4_data_len":43,"flow_max_l4_data_len":43,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59113,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":17,"flow_first_seen":1431970687670,"flow_last_seen":1431970706351,"flow_tot_l4_data_len":791,"flow_min_l4_data_len":20,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":51289,"dst_port":18767,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":17,"flow_first_seen":1431970687670,"flow_last_seen":1431970706351,"flow_tot_l4_data_len":791,"flow_min_l4_data_len":20,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":51289,"dst_port":18767,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":17,"flow_first_seen":1431970635489,"flow_last_seen":1431970690062,"flow_tot_l4_data_len":2957,"flow_min_l4_data_len":20,"flow_max_l4_data_len":217,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51231,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":30,"flow_first_seen":1431970688781,"flow_last_seen":1431970693454,"flow_tot_l4_data_len":3884,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":51292,"dst_port":18767,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":30,"flow_first_seen":1431970688781,"flow_last_seen":1431970693454,"flow_tot_l4_data_len":3884,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.238.7.203","src_port":51292,"dst_port":18767,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1431970634276,"flow_last_seen":1431970660781,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55028,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":12,"flow_first_seen":1431970690191,"flow_last_seen":1431970705014,"flow_tot_l4_data_len":1740,"flow_min_l4_data_len":32,"flow_max_l4_data_len":199,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51295,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":8,"flow_first_seen":1431970636044,"flow_last_seen":1431970646741,"flow_tot_l4_data_len":846,"flow_min_l4_data_len":32,"flow_max_l4_data_len":245,"flow_avg_l4_data_len":105,"midstream":1,"l3_proto":"ip4","src_ip":"17.143.160.149","dst_ip":"192.168.1.34","src_port":5223,"dst_port":50407,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":6,"flow_first_seen":1431970686843,"flow_last_seen":1431970687201,"flow_tot_l4_data_len":161,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51286,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":6,"flow_first_seen":1431970686843,"flow_last_seen":1431970687201,"flow_tot_l4_data_len":161,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51286,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":7,"flow_first_seen":1431970668278,"flow_last_seen":1431970694737,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63342,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":14,"flow_first_seen":1431970699896,"flow_last_seen":1431970708272,"flow_tot_l4_data_len":658,"flow_min_l4_data_len":32,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51311,"dst_port":14506,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":14,"flow_first_seen":1431970699896,"flow_last_seen":1431970708272,"flow_tot_l4_data_len":658,"flow_min_l4_data_len":32,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51311,"dst_port":14506,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00519{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431970701508,"flow_last_seen":1431970702603,"flow_tot_l4_data_len":1379,"flow_min_l4_data_len":32,"flow_max_l4_data_len":355,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51314,"dst_port":14506,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431970701508,"flow_last_seen":1431970702603,"flow_tot_l4_data_len":1379,"flow_min_l4_data_len":32,"flow_max_l4_data_len":355,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51314,"dst_port":14506,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":10,"flow_first_seen":1431970693196,"flow_last_seen":1431970706224,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51302,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":10,"flow_first_seen":1431970693196,"flow_last_seen":1431970706224,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":15,"flow_first_seen":1431970688560,"flow_last_seen":1431970700671,"flow_tot_l4_data_len":716,"flow_min_l4_data_len":20,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51291,"dst_port":17639,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":15,"flow_first_seen":1431970688560,"flow_last_seen":1431970700671,"flow_tot_l4_data_len":716,"flow_min_l4_data_len":20,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51291,"dst_port":17639,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":33,"flow_first_seen":1431970689672,"flow_last_seen":1431970694329,"flow_tot_l4_data_len":3975,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1156,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51294,"dst_port":17639,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":33,"flow_first_seen":1431970689672,"flow_last_seen":1431970694329,"flow_tot_l4_data_len":3975,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1156,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51294,"dst_port":17639,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00519{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":14,"flow_first_seen":1431970691351,"flow_last_seen":1431970701913,"flow_tot_l4_data_len":674,"flow_min_l4_data_len":32,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"82.224.110.241","src_port":51298,"dst_port":38895,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":14,"flow_first_seen":1431970691351,"flow_last_seen":1431970701913,"flow_tot_l4_data_len":674,"flow_min_l4_data_len":32,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"82.224.110.241","src_port":51298,"dst_port":38895,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":18,"flow_first_seen":1431970692464,"flow_last_seen":1431970694362,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":32,"flow_max_l4_data_len":93,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"82.224.110.241","src_port":51301,"dst_port":38895,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":255,"flow_packet_id":18,"flow_first_seen":1431970692464,"flow_last_seen":1431970694362,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":32,"flow_max_l4_data_len":93,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"82.224.110.241","src_port":51301,"dst_port":38895,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00467{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":231,"flow_packet_id":4,"flow_first_seen":1431970685839,"flow_last_seen":1431970687668,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":16,"flow_first_seen":1431970659834,"flow_last_seen":1431970689548,"flow_tot_l4_data_len":747,"flow_min_l4_data_len":20,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":51251,"dst_port":40029,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":16,"flow_first_seen":1431970659834,"flow_last_seen":1431970689548,"flow_tot_l4_data_len":747,"flow_min_l4_data_len":20,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":51251,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":15,"flow_first_seen":1431970682971,"flow_last_seen":1431970692227,"flow_tot_l4_data_len":709,"flow_min_l4_data_len":20,"flow_max_l4_data_len":139,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":51278,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":15,"flow_first_seen":1431970682971,"flow_last_seen":1431970692227,"flow_tot_l4_data_len":709,"flow_min_l4_data_len":20,"flow_max_l4_data_len":139,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":51278,"dst_port":40009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1431970635325,"flow_last_seen":1431970688837,"flow_tot_l4_data_len":304,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":15,"flow_first_seen":1431970651380,"flow_last_seen":1431970670192,"flow_tot_l4_data_len":1023,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51239,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":15,"flow_first_seen":1431970651380,"flow_last_seen":1431970670192,"flow_tot_l4_data_len":1023,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51239,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":7,"flow_first_seen":1431970634731,"flow_last_seen":1431970661287,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":53372,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":17,"flow_first_seen":1431970651380,"flow_last_seen":1431970679713,"flow_tot_l4_data_len":1128,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51238,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":17,"flow_first_seen":1431970651380,"flow_last_seen":1431970679713,"flow_tot_l4_data_len":1128,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51238,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":18,"flow_first_seen":1431970687670,"flow_last_seen":1431970703163,"flow_tot_l4_data_len":878,"flow_min_l4_data_len":20,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51290,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":18,"flow_first_seen":1431970687670,"flow_last_seen":1431970703163,"flow_tot_l4_data_len":878,"flow_min_l4_data_len":20,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51290,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":15,"flow_first_seen":1431970652388,"flow_last_seen":1431970670585,"flow_tot_l4_data_len":1074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51241,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":15,"flow_first_seen":1431970652388,"flow_last_seen":1431970670585,"flow_tot_l4_data_len":1074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51241,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":20,"flow_first_seen":1431970688782,"flow_last_seen":1431970692885,"flow_tot_l4_data_len":3225,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":161,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51293,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":20,"flow_first_seen":1431970688782,"flow_last_seen":1431970692885,"flow_tot_l4_data_len":3225,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1056,"flow_avg_l4_data_len":161,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51293,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":15,"flow_first_seen":1431970668514,"flow_last_seen":1431970686964,"flow_tot_l4_data_len":1004,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51260,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":15,"flow_first_seen":1431970668514,"flow_last_seen":1431970686964,"flow_tot_l4_data_len":1004,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51260,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":15,"flow_first_seen":1431970668515,"flow_last_seen":1431970686367,"flow_tot_l4_data_len":1059,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51261,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":15,"flow_first_seen":1431970668515,"flow_last_seen":1431970686367,"flow_tot_l4_data_len":1059,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51261,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":5,"flow_first_seen":1431970687261,"flow_last_seen":1431970707409,"flow_tot_l4_data_len":130,"flow_min_l4_data_len":26,"flow_max_l4_data_len":26,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"174.49.171.224","src_port":13021,"dst_port":32011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":15,"flow_first_seen":1431970677603,"flow_last_seen":1431970694432,"flow_tot_l4_data_len":1010,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51274,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":15,"flow_first_seen":1431970677603,"flow_last_seen":1431970694432,"flow_tot_l4_data_len":1010,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51274,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702158,"flow_tot_l4_data_len":905,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51280,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702158,"flow_tot_l4_data_len":905,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51280,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702162,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51281,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702162,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51281,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431970635433,"flow_last_seen":1431970635489,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":16,"flow_first_seen":1431970668515,"flow_last_seen":1431970693321,"flow_tot_l4_data_len":1087,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51262,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":16,"flow_first_seen":1431970668515,"flow_last_seen":1431970693321,"flow_tot_l4_data_len":1087,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":15,"flow_first_seen":1431970675578,"flow_last_seen":1431970692134,"flow_tot_l4_data_len":905,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51271,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":15,"flow_first_seen":1431970675578,"flow_last_seen":1431970692134,"flow_tot_l4_data_len":905,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51271,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":16,"flow_first_seen":1431970649777,"flow_last_seen":1431970678255,"flow_tot_l4_data_len":713,"flow_min_l4_data_len":20,"flow_max_l4_data_len":110,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51236,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":16,"flow_first_seen":1431970649777,"flow_last_seen":1431970678255,"flow_tot_l4_data_len":713,"flow_min_l4_data_len":20,"flow_max_l4_data_len":110,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51236,"dst_port":40008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":8,"flow_first_seen":1431970642412,"flow_last_seen":1431970643680,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":58,"flow_max_l4_data_len":237,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":7,"flow_first_seen":1431970642408,"flow_last_seen":1431970643670,"flow_tot_l4_data_len":442,"flow_min_l4_data_len":58,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1431970642417,"flow_last_seen":1431970643676,"flow_tot_l4_data_len":384,"flow_min_l4_data_len":192,"flow_max_l4_data_len":192,"flow_avg_l4_data_len":192,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1431970642414,"flow_last_seen":1431970643673,"flow_tot_l4_data_len":364,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1431970643964,"flow_last_seen":1431970644121,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":16,"flow_first_seen":1431970666902,"flow_last_seen":1431970694879,"flow_tot_l4_data_len":694,"flow_min_l4_data_len":20,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51256,"dst_port":40013,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":16,"flow_first_seen":1431970666902,"flow_last_seen":1431970694879,"flow_tot_l4_data_len":694,"flow_min_l4_data_len":20,"flow_max_l4_data_len":109,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51256,"dst_port":40013,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":7,"flow_first_seen":1431970634730,"flow_last_seen":1431970661287,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57592,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":16,"flow_first_seen":1431970657867,"flow_last_seen":1431970685617,"flow_tot_l4_data_len":740,"flow_min_l4_data_len":20,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51248,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":16,"flow_first_seen":1431970657867,"flow_last_seen":1431970685617,"flow_tot_l4_data_len":740,"flow_min_l4_data_len":20,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51248,"dst_port":40030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":199,"flow_first_seen":1431970682971,"flow_last_seen":1431970705724,"flow_tot_l4_data_len":83849,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51279,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":199,"flow_first_seen":1431970682971,"flow_last_seen":1431970705724,"flow_tot_l4_data_len":83849,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51279,"dst_port":40008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":13,"flow_first_seen":1431970672330,"flow_last_seen":1431970689889,"flow_tot_l4_data_len":643,"flow_min_l4_data_len":20,"flow_max_l4_data_len":130,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"111.221.74.18","dst_ip":"192.168.1.34","src_port":40025,"dst_port":51267,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":13,"flow_first_seen":1431970672330,"flow_last_seen":1431970689889,"flow_tot_l4_data_len":643,"flow_min_l4_data_len":20,"flow_max_l4_data_len":130,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"111.221.74.18","dst_ip":"192.168.1.34","src_port":40025,"dst_port":51267,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":2,"flow_first_seen":1431970685835,"flow_last_seen":1431970685835,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":58061,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":8,"flow_first_seen":1431970660159,"flow_last_seen":1431970690798,"flow_tot_l4_data_len":2718,"flow_min_l4_data_len":32,"flow_max_l4_data_len":986,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"108.160.163.108","dst_ip":"192.168.1.34","src_port":443,"dst_port":51222,"l4_proto":"tcp","ndpi": {"proto":"TLS.Dropbox","breed":"Acceptable","category":"Cloud"}} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":8,"flow_first_seen":1431970660159,"flow_last_seen":1431970690798,"flow_tot_l4_data_len":2718,"flow_min_l4_data_len":32,"flow_max_l4_data_len":986,"flow_avg_l4_data_len":339,"midstream":1,"l3_proto":"ip4","src_ip":"108.160.163.108","dst_ip":"192.168.1.34","src_port":443,"dst_port":51222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":18,"flow_first_seen":1431970695865,"flow_last_seen":1431970707876,"flow_tot_l4_data_len":814,"flow_min_l4_data_len":32,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51305,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":258,"flow_packet_id":18,"flow_first_seen":1431970695865,"flow_last_seen":1431970707876,"flow_tot_l4_data_len":814,"flow_min_l4_data_len":32,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51305,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":26,"flow_first_seen":1431970697478,"flow_last_seen":1431970707879,"flow_tot_l4_data_len":16609,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":638,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51307,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":260,"flow_packet_id":26,"flow_first_seen":1431970697478,"flow_last_seen":1431970707879,"flow_tot_l4_data_len":16609,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":638,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51307,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":15,"flow_first_seen":1431970698661,"flow_last_seen":1431970706984,"flow_tot_l4_data_len":687,"flow_min_l4_data_len":32,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51309,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":262,"flow_packet_id":15,"flow_first_seen":1431970698661,"flow_last_seen":1431970706984,"flow_tot_l4_data_len":687,"flow_min_l4_data_len":32,"flow_max_l4_data_len":107,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51309,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":25,"flow_first_seen":1431970700273,"flow_last_seen":1431970706319,"flow_tot_l4_data_len":14786,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":591,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51312,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":264,"flow_packet_id":25,"flow_first_seen":1431970700273,"flow_last_seen":1431970706319,"flow_tot_l4_data_len":14786,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":591,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51312,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":14,"flow_first_seen":1431970704329,"flow_last_seen":1431970708726,"flow_tot_l4_data_len":700,"flow_min_l4_data_len":32,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51316,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":14,"flow_first_seen":1431970704329,"flow_last_seen":1431970708726,"flow_tot_l4_data_len":700,"flow_min_l4_data_len":32,"flow_max_l4_data_len":140,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51316,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":20,"flow_first_seen":1431970705942,"flow_last_seen":1431970706101,"flow_tot_l4_data_len":5516,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":275,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51317,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":20,"flow_first_seen":1431970705942,"flow_last_seen":1431970706101,"flow_tot_l4_data_len":5516,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":275,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51317,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1431970634669,"flow_last_seen":1431970634723,"flow_tot_l4_data_len":199,"flow_min_l4_data_len":67,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57694,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":348,"flow_first_seen":1431970634729,"flow_last_seen":1431970685945,"flow_tot_l4_data_len":169855,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":488,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":51230,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":13,"flow_first_seen":1431970636340,"flow_last_seen":1431970655127,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":13,"flow_first_seen":1431970636340,"flow_last_seen":1431970655127,"flow_tot_l4_data_len":715,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":14,"flow_first_seen":1431970657448,"flow_last_seen":1431970689704,"flow_tot_l4_data_len":952,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51247,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":14,"flow_first_seen":1431970657448,"flow_last_seen":1431970689704,"flow_tot_l4_data_len":952,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51247,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":1431970690133,"flow_last_seen":1431970690190,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":48,"flow_max_l4_data_len":64,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":7,"flow_first_seen":1431970636301,"flow_last_seen":1431970662705,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51753,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":7,"flow_first_seen":1431970670304,"flow_last_seen":1431970696803,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55866,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":36,"flow_first_seen":1431970648367,"flow_last_seen":1431970708411,"flow_tot_l4_data_len":12178,"flow_min_l4_data_len":293,"flow_max_l4_data_len":371,"flow_avg_l4_data_len":338,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"239.255.255.250","src_port":1025,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":6,"flow_first_seen":1431970697522,"flow_last_seen":1431970702574,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51308,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":261,"flow_packet_id":6,"flow_first_seen":1431970697522,"flow_last_seen":1431970702574,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51308,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":17,"flow_first_seen":1431970649777,"flow_last_seen":1431970674421,"flow_tot_l4_data_len":763,"flow_min_l4_data_len":20,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51235,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":17,"flow_first_seen":1431970649777,"flow_last_seen":1431970674421,"flow_tot_l4_data_len":763,"flow_min_l4_data_len":20,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51235,"dst_port":40009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":7,"flow_first_seen":1431970634591,"flow_last_seen":1431970661089,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49864,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1431970634589,"flow_last_seen":1431970661089,"flow_tot_l4_data_len":273,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64240,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":18,"flow_first_seen":1431970649777,"flow_last_seen":1431970680320,"flow_tot_l4_data_len":836,"flow_min_l4_data_len":20,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51234,"dst_port":40001,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":18,"flow_first_seen":1431970649777,"flow_last_seen":1431970680320,"flow_tot_l4_data_len":836,"flow_min_l4_data_len":20,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51234,"dst_port":40001,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":7,"flow_first_seen":1431970668278,"flow_last_seen":1431970694738,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64258,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":17,"flow_first_seen":1431970650785,"flow_last_seen":1431970683130,"flow_tot_l4_data_len":746,"flow_min_l4_data_len":20,"flow_max_l4_data_len":110,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51237,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":17,"flow_first_seen":1431970650785,"flow_last_seen":1431970683130,"flow_tot_l4_data_len":746,"flow_min_l4_data_len":20,"flow_max_l4_data_len":110,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51237,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":17,"flow_first_seen":1431970666902,"flow_last_seen":1431970699651,"flow_tot_l4_data_len":738,"flow_min_l4_data_len":20,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51255,"dst_port":40005,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":17,"flow_first_seen":1431970666902,"flow_last_seen":1431970699651,"flow_tot_l4_data_len":738,"flow_min_l4_data_len":20,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51255,"dst_port":40005,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":18,"flow_first_seen":1431970666903,"flow_last_seen":1431970694442,"flow_tot_l4_data_len":808,"flow_min_l4_data_len":20,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51257,"dst_port":40032,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":18,"flow_first_seen":1431970666903,"flow_last_seen":1431970694442,"flow_tot_l4_data_len":808,"flow_min_l4_data_len":20,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51257,"dst_port":40032,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970700372,"flow_tot_l4_data_len":751,"flow_min_l4_data_len":20,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51276,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970700372,"flow_tot_l4_data_len":751,"flow_min_l4_data_len":20,"flow_max_l4_data_len":100,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51276,"dst_port":40021,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":17,"flow_first_seen":1431970675992,"flow_last_seen":1431970693146,"flow_tot_l4_data_len":789,"flow_min_l4_data_len":20,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51272,"dst_port":40029,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":17,"flow_first_seen":1431970675992,"flow_last_seen":1431970693146,"flow_tot_l4_data_len":789,"flow_min_l4_data_len":20,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51272,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970695489,"flow_tot_l4_data_len":848,"flow_min_l4_data_len":20,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51277,"dst_port":40026,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970695489,"flow_tot_l4_data_len":848,"flow_min_l4_data_len":20,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51277,"dst_port":40026,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":4,"flow_first_seen":1431970685835,"flow_last_seen":1431970687666,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59052,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":4,"flow_first_seen":1431970685835,"flow_last_seen":1431970687666,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59052,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":19,"flow_first_seen":1431970666903,"flow_last_seen":1431970694687,"flow_tot_l4_data_len":844,"flow_min_l4_data_len":20,"flow_max_l4_data_len":128,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51258,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":19,"flow_first_seen":1431970666903,"flow_last_seen":1431970694687,"flow_tot_l4_data_len":844,"flow_min_l4_data_len":20,"flow_max_l4_data_len":128,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51258,"dst_port":40021,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":7,"flow_first_seen":1431970679839,"flow_last_seen":1431970706168,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64364,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":19,"flow_first_seen":1431970673966,"flow_last_seen":1431970700297,"flow_tot_l4_data_len":839,"flow_min_l4_data_len":20,"flow_max_l4_data_len":130,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51269,"dst_port":40029,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":19,"flow_first_seen":1431970673966,"flow_last_seen":1431970700297,"flow_tot_l4_data_len":839,"flow_min_l4_data_len":20,"flow_max_l4_data_len":130,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51269,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":7,"flow_first_seen":1431970636300,"flow_last_seen":1431970662705,"flow_tot_l4_data_len":385,"flow_min_l4_data_len":55,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":50055,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":7,"flow_first_seen":1431970679839,"flow_last_seen":1431970706169,"flow_tot_l4_data_len":378,"flow_min_l4_data_len":54,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60413,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1431970634728,"flow_last_seen":1431970664345,"flow_tot_l4_data_len":742,"flow_min_l4_data_len":20,"flow_max_l4_data_len":123,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51229,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1431970634728,"flow_last_seen":1431970664345,"flow_tot_l4_data_len":742,"flow_min_l4_data_len":20,"flow_max_l4_data_len":123,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51229,"dst_port":40009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":16,"flow_first_seen":1431970655836,"flow_last_seen":1431970685642,"flow_tot_l4_data_len":721,"flow_min_l4_data_len":20,"flow_max_l4_data_len":122,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51246,"dst_port":40020,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":16,"flow_first_seen":1431970655836,"flow_last_seen":1431970685642,"flow_tot_l4_data_len":721,"flow_min_l4_data_len":20,"flow_max_l4_data_len":122,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51246,"dst_port":40020,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":7,"flow_first_seen":1431970694308,"flow_last_seen":1431970701362,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51303,"dst_port":62381,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":7,"flow_first_seen":1431970694308,"flow_last_seen":1431970701362,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51303,"dst_port":62381,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":6,"flow_first_seen":1431970695909,"flow_last_seen":1431970700948,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51306,"dst_port":62381,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":259,"flow_packet_id":6,"flow_first_seen":1431970695909,"flow_last_seen":1431970700948,"flow_tot_l4_data_len":264,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51306,"dst_port":62381,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":76,"flow_first_seen":1431970637197,"flow_last_seen":1431970705557,"flow_tot_l4_data_len":16919,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":222,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":51227,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} +00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":76,"flow_first_seen":1431970637197,"flow_last_seen":1431970705557,"flow_tot_l4_data_len":16919,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":222,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":51227,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":8,"flow_first_seen":1431970634432,"flow_last_seen":1431970687929,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1431970634431,"flow_last_seen":1431970687929,"flow_tot_l4_data_len":376,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60688,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":14,"flow_first_seen":1431970661447,"flow_last_seen":1431970679053,"flow_tot_l4_data_len":956,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":51253,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":14,"flow_first_seen":1431970661447,"flow_last_seen":1431970679053,"flow_tot_l4_data_len":956,"flow_min_l4_data_len":20,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":51253,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":13,"flow_first_seen":1431970684583,"flow_last_seen":1431970693811,"flow_tot_l4_data_len":815,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":51282,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":13,"flow_first_seen":1431970684583,"flow_last_seen":1431970693811,"flow_tot_l4_data_len":815,"flow_min_l4_data_len":20,"flow_max_l4_data_len":111,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":51282,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":14,"flow_first_seen":1431970701461,"flow_last_seen":1431970708429,"flow_tot_l4_data_len":666,"flow_min_l4_data_len":32,"flow_max_l4_data_len":113,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51313,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":14,"flow_first_seen":1431970701461,"flow_last_seen":1431970708429,"flow_tot_l4_data_len":666,"flow_min_l4_data_len":32,"flow_max_l4_data_len":113,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51313,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":23,"flow_first_seen":1431970703073,"flow_last_seen":1431970706415,"flow_tot_l4_data_len":11502,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51315,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":267,"flow_packet_id":23,"flow_first_seen":1431970703073,"flow_last_seen":1431970706415,"flow_tot_l4_data_len":11502,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":500,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51315,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431970707102,"flow_last_seen":1431970708204,"flow_tot_l4_data_len":517,"flow_min_l4_data_len":32,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51318,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431970707102,"flow_last_seen":1431970708204,"flow_tot_l4_data_len":517,"flow_min_l4_data_len":32,"flow_max_l4_data_len":112,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51318,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431970708715,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51319,"dst_port":13392,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431970708715,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51319,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":7,"flow_first_seen":1431970634728,"flow_last_seen":1431970661287,"flow_tot_l4_data_len":301,"flow_min_l4_data_len":43,"flow_max_l4_data_len":43,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62875,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":2,"flow_first_seen":1431970685835,"flow_last_seen":1431970685835,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":140,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":59237,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":7,"flow_first_seen":1431970634276,"flow_last_seen":1431970660781,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64971,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":15,"flow_first_seen":1431970687670,"flow_last_seen":1431970700698,"flow_tot_l4_data_len":748,"flow_min_l4_data_len":20,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51288,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":15,"flow_first_seen":1431970687670,"flow_last_seen":1431970700698,"flow_tot_l4_data_len":748,"flow_min_l4_data_len":20,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51288,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_first_seen":1431970691783,"flow_last_seen":1431970692055,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51300,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_first_seen":1431970691783,"flow_last_seen":1431970692055,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51300,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":6,"flow_first_seen":1431970685852,"flow_last_seen":1431970686318,"flow_tot_l4_data_len":207,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51284,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":6,"flow_first_seen":1431970685852,"flow_last_seen":1431970686318,"flow_tot_l4_data_len":207,"flow_min_l4_data_len":20,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51284,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":6,"flow_first_seen":1431970686319,"flow_last_seen":1431970686843,"flow_tot_l4_data_len":161,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51285,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":6,"flow_first_seen":1431970686319,"flow_last_seen":1431970686843,"flow_tot_l4_data_len":161,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51285,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_tot_l4_data_len":263,"flow_min_l4_data_len":20,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_tot_l4_data_len":263,"flow_min_l4_data_len":20,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_tot_l4_data_len":3022,"flow_min_l4_data_len":32,"flow_max_l4_data_len":367,"flow_avg_l4_data_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_tot_l4_data_len":3022,"flow_min_l4_data_len":32,"flow_max_l4_data_len":367,"flow_avg_l4_data_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_tot_l4_data_len":266,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_tot_l4_data_len":266,"flow_min_l4_data_len":20,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00138{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test"} diff --git a/test/results/skype_udp.pcap.out b/test/results/skype_udp.pcap.out index a67924b2c..9fceefd8e 100644 --- a/test/results/skype_udp.pcap.out +++ b/test/results/skype_udp.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"skype_udp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1156534494734,"flow_last_seen":0,"flow_tot_l4_data_len":39,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534494,"pkt_ts_usec":734879,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"ABbjGScVAAR2lnvaCABFAAA7AABAAEARoZLAqAECGOC+lYyWmV4AJ5lYFpcCrtEAh3kuASsbNLlPtKfPLsSj70vZ59IfZD23vQ=="} 00437{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534496,"pkt_ts_usec":782355,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"ABbjGScVAAR2lnvaCABFAAA7AABAAEARoZLAqAECGOC+lYyWmV4AJ5lYFpcCqvCj5HkuAStybQoRs8uOXAH\/9ayvdzDWsfxVrg=="} @@ -6,3 +7,5 @@ 00527{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1156534494734,"flow_last_seen":1156534500825,"flow_tot_l4_data_len":117,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} 00417{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534567,"pkt_ts_usec":55540,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"ABbjGScVAAR2lnvaCABFAAAuAABAAEARoZ\/AqAECGOC+lYyWmV4AGplLsGsC8X+1b++522uzltBGo\/MQ"} 00417{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534567,"pkt_ts_usec":244697,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"AAR2lnvaABbjGScVCABFAAAuy+IAAGUR8LwY4L6VwKgBAplejJYAGg6E4FcCztAyD8zMjQ7u\/eBiRTNa"} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_first_seen":1156534494734,"flow_last_seen":1156534567244,"flow_tot_l4_data_len":169,"flow_min_l4_data_len":26,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5,"source":"skype_udp.pcap","alias":"nDPId-test"} diff --git a/test/results/smb_deletefile.pcap.out b/test/results/smb_deletefile.pcap.out index d3cbbc74f..4f8570700 100644 --- a/test/results/smb_deletefile.pcap.out +++ b/test/results/smb_deletefile.pcap.out @@ -1,3 +1,4 @@ +00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smb_deletefile.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":0,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00972{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368315,"pkt_ts_usec":417275,"pkt_caplen":434,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":434,"pkt_l4_len":400,"pkt":"2MuK4S0uKDc3AG3ICABFAAGkAABAAEAGtNLAqAF2wKgBu94QAb3ooAVq8kMyI1AYqgDfmAAAAAABeP5TTUJAAAEAAAAAAAUAAAEAAAAAmAAAAJwPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgAHAAAAAAAAAAAAEwAdQBjAGEAXABEAG8AdwBuAGwAbwBhAGQAcwAAAAAA\/lNNQkAAAQAAAAAADgAAAQQAAACIAAAAnQ8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AAJgAAAAEAaQBuAG4AbwBzAGUAdAB1AHAALQA1AC4ANgAuADEALgBlAHgAZQAAAP5TTUJAAAEAAAAAAAYAAAEEAAAAAAAAAJ4PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAP\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8="} 00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":0,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"NetBIOS.SMBv23","breed":"Acceptable","category":"System"}} @@ -15,3 +16,5 @@ 01100{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587603,"pkt_caplen":554,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":554,"pkt_l4_len":520,"pkt":"KDc3AG3I2MuK4S0uCABFAAIcOLRAAIAGO6bAqAG7wKgBdgG93hDyQzhN6KALGlAYEAS2GQAAAAABgP5TTUJAAAEAAAAAAAUAAAABAAAAuAAAAKUPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAADPCUzktmNQBM3a2TJv71QGqtlA8LZjUAceu0c0iWdUBAAAeAAAAAACA9B0AAAAAACAAAAAAAAAAFQQAAAoAAADFAAAACgAAAJgAAAAgAAAAAAAAABAABAAAABgACAAAAE14QWMAAAAAAAAAAP8BHwD+U01CQAABAAAAAAARAAAABQAAAEgAAACmDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAD+U01CQAABAAAAAAAGAAMABQAAAAAAAACnDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGz+U01CQAAAAAAAAAASAAAAAQAAAAAAAAD\/\/\/\/\/\/\/\/\/\/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALAACAAEAAADNtesUnIBJiady75EwC3S7AwAAAAAAAAAAAAAAAAAAAAAAAAA="} 00415{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587634,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAsa8kM6QVAQqfyBSAAA"} 00560{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587709,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"2MuK4S0uKDc3AG3ICABFAACQAABAAEAGtebAqAF2wKgBu94QAb3ooAsa8kM6QVAYqgANAgAAAAAAZP5TTUJAAAEAAAAAABIAAAEAAAAAAAAAAKgPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAkAAAAAAAAAM216xScgEmJp3LvkTALdLsAAAAAAAAAAAAAAAA="} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":101,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":101,"flow_first_seen":1584368315417,"flow_last_seen":1584368317802,"flow_tot_l4_data_len":27272,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":270,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":101,"source":"smb_deletefile.pcap","alias":"nDPId-test"} diff --git a/test/results/smbv1.pcap.out b/test/results/smbv1.pcap.out index 0225cad09..301207cbc 100644 --- a/test/results/smbv1.pcap.out +++ b/test/results/smbv1.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smbv1.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smbv1.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1492191036092,"flow_last_seen":0,"flow_tot_l4_data_len":157,"flow_min_l4_data_len":157,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":157,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.156.130","dst_ip":"10.128.0.243","src_port":50927,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00592{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smbv1.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492191036,"pkt_ts_usec":92974,"pkt_caplen":191,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":191,"pkt_l4_len":157,"pkt":"AFBW6AqxAAwpAu9qCABFAACxF9IAAIAGzm+sEJyCCoAA88bvAb3S22hjm3waG1AY+vCemgAAAAAAhf9TTUJyAAAAABhTwAAAAAAAAAAAAAAAAAAA\/\/4AAEAAAGIAAlBDIE5FVFdPUksgUFJPR1JBTSAxLjAAAkxBTk1BTjEuMAACV2luZG93cyBmb3IgV29ya2dyb3VwcyAzLjFhAAJMTTEuMlgwMDIAAkxBTk1BTjIuMQACTlQgTE0gMC4xMgA="} 00566{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"smbv1.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492191036,"pkt_ts_usec":120420,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"pkt":"AAwpAu9qAFBW6AqxCABFAACdcSEAAIAGdTQKgADzrBCcggG9xu+bfBob0tto7FAY+vCpnwAAAAAAcf9TTUJyAAAAAJhTwAAAAAAAAAAAAAAAAAAA\/\/4AAEAAEQUAAzIAAQAEEQAAAAABAAAAAAD84wEAQPSc00S10gHwAAgsAAirHC\/h7OapVwBPAFIASwBHAFIATwBVAFAAAABKAE8ASABOAC0AUABDAAAA"} @@ -7,3 +8,5 @@ 00539{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"smbv1.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492191036,"pkt_ts_usec":157874,"pkt_caplen":148,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":148,"pkt_l4_len":114,"pkt":"AFBW6AqxAAwpAu9qCABFAACGF9QAAIAGzpisEJyCCoAA88bvAb3S22l4m3wbTVAY+b51+wAAAAAAWv9TTUJ1AAAAABgHwAAAAAAAAAAAAAAAAAAA\/\/4ACEAABP8AWgAIAAEALwAAXABcADEAMAAuADEAMgA4AC4AMAAuADIANAAzAFwASQBQAEMAJAAAAD8\/Pz8\/AA=="} 00493{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"smbv1.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492191036,"pkt_ts_usec":191436,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":114,"pkt_l4_len":80,"pkt":"AAwpAu9qAFBW6AqxCABFAABkcSUAAIAGdWkKgADzrBCcggG9xu+bfBtN0ttp1lAY+vBBMgAAAAAAOP9TTUJ1AAAAAJgHwAAAAAAAAAAAAAAAAAAI\/\/4ACEAAB\/8AOAABAP\/\/HwD\/\/x8ABwBJUEMAAAAA"} 00521{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"smbv1.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492191036,"pkt_ts_usec":191677,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"AFBW6AqxAAwpAu9qCABFAAB6F9UAAIAGzqOsEJyCCoAA88bvAb3S22nWm3wbiVAY+YJgRQAAAAAATv9TTUIyAAAAABgHwAAAAAAAAAAAAAAAAAAI\/\/4ACEEADwwAAAABAAAAAAAAAMxs6wAAAAwAQgAAAE4AAQAOAA0AAAAAAAAAAAAAAAAAAA=="} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":7,"source":"smbv1.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1492191036092,"flow_last_seen":1492191036191,"flow_tot_l4_data_len":959,"flow_min_l4_data_len":80,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":137,"midstream":1,"l3_proto":"ip4","src_ip":"172.16.156.130","dst_ip":"10.128.0.243","src_port":50927,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":7,"source":"smbv1.pcap","alias":"nDPId-test"} diff --git a/test/results/smpp_in_general.pcap.out b/test/results/smpp_in_general.pcap.out index c6d7f4164..dcaf24295 100644 --- a/test/results/smpp_in_general.pcap.out +++ b/test/results/smpp_in_general.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smpp_in_general.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smpp_in_general.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1217149853878,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"10.226.202.118","dst_ip":"10.226.202.53","src_port":1770,"dst_port":9000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smpp_in_general.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1217149853,"pkt_ts_usec":878966,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AAKlxo7UABbU5r3hCABFAAAwUN5AAIAG\/3kK4sp2CuLKNQbqIyjmvft6AAAAAHACf\/9NLQAAAgQE7AEBBAI="} 00422{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"smpp_in_general.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1217149853,"pkt_ts_usec":879393,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":24,"pkt":"ABbU5r3hAAKlxo7UCABFAAAsMy0AADwGoS8K4so1CuLKdiMoBuqoDP5A5r37e2AS8ABLDAAAAgQFtAAA"} @@ -15,3 +16,5 @@ 00441{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"smpp_in_general.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1217149884,"pkt_ts_usec":833412,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"ABbU5r3hAAKlxo7UCABFAAA4M4EAADwGoM8K4so1CuLKdiMoBuqoDP5\/5r379VAY8ADh3gAAAAAAEIAAAAYAAAAAAAAABA=="} 00417{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"smpp_in_general.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1217149884,"pkt_ts_usec":833512,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAKlxo7UABbU5r3hCABFAAAoUPVAAIAG\/2oK4sp2CuLKNQbqIyjmvfv1qAz+j1ARhJbNagAA"} 00424{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"smpp_in_general.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1217149884,"pkt_ts_usec":833831,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"ABbU5r3hAAKlxo7UCABFAAAoM4IAADwGoN4K4so1CuLKdiMoBuqoDP6P5r379lAQ8ABiAAAAAAAAAAAA"} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":17,"source":"smpp_in_general.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":17,"flow_first_seen":1217149853878,"flow_last_seen":1217149884833,"flow_tot_l4_data_len":552,"flow_min_l4_data_len":20,"flow_max_l4_data_len":70,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.226.202.118","dst_ip":"10.226.202.53","src_port":1770,"dst_port":9000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":17,"source":"smpp_in_general.pcap","alias":"nDPId-test"} diff --git a/test/results/snapchat.pcap.out b/test/results/snapchat.pcap.out index e37d57349..a9f0a0c24 100644 --- a/test/results/snapchat.pcap.out +++ b/test/results/snapchat.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"snapchat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431417993318,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":318652,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8f1tAAEAG3k0KCAABSn2IjYHRAbtgYhiTAAAAAKAC\/\/8GegAAAgQFtAQCCAoAKmfIAAAAAAEDAwY="} 00409{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":319843,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAalAABAGjBRKfYiNCggAAQG7gdGfnedsYGIYlFAS\/\/9PMgAA"} @@ -52,3 +53,7 @@ 00412{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349295,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfVAABAGi8hKfYiNCggAAQG724HUfVNeK4Kzo1AQ\/\/\/uggAA"} 00612{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349448,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"pkt":"ABoRAAACABoRAAABCABFAAC4wNhAAEAGnFQKCAABSn2IjduBAbsrgrOj1H1TXlAY\/\/\/G6wAAstjj3\/bsqpZpfZBbB0U0MfQ1fvcBtg\/ngUbvEy0ydo\/TCHa74MV9Zwi2677DhjDQ7Y8hgLv04yaniKcq9e1oXDbG0nZBEfAhi3hvl9olQoHXtdnYwEdx7D2DuVvaqcLIx2lazMNmhLU53oscsI35lmtDhvLcFW6nY5DJFHZ\/uvNo7JO137yNDEMdsY\/zZaRu"} 00412{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349631,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfZAABAGi8dKfYiNCggAAQG724HUfVNeK4K0M1AQ\/\/\/t8gAA"} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":22,"flow_first_seen":1431417993318,"flow_last_seen":1431417995589,"flow_tot_l4_data_len":2131,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":17,"flow_first_seen":1431418008133,"flow_last_seen":1431418008853,"flow_tot_l4_data_len":3365,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1089,"flow_avg_l4_data_len":197,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":56193,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":17,"flow_first_seen":1431418008131,"flow_last_seen":1431418008701,"flow_tot_l4_data_len":2799,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":164,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":44536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test"} diff --git a/test/results/snapchat_call.pcapng.out b/test/results/snapchat_call.pcapng.out index b273fffe9..495e198f3 100644 --- a/test/results/snapchat_call.pcapng.out +++ b/test/results/snapchat_call.pcapng.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"snapchat_call.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"snapchat_call.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1595865799020,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"18.184.138.142","src_port":42083,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02203{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"snapchat_call.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595865799,"pkt_ts_usec":20160,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"CL6sCxdumt9Y+uvcCABFAAViAIdAAEARymzAqAypEriKjqRjAbsFTpy2w1EwNDZQw4BG53qjBuoAAAABZPU1L7U5tyJMVD1ioAEEAENITE8MAAAAUEFEAEgDAABWRVIATAMAAENDUwBcAwAAUERNRGADAABTTUhMZAMAAElDU0xoAwAATk9OUIgDAABNSURTjAMAAFNDTFOQAwAAQ1NDVJADAABDRkNXlAMAAFNGQ1eYAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tUTA0NgHogWCSkhrofu2AhqIVgpFYNTA5AQAAACgAAAAzbE4qRvvkp4rlFQIkD4jjmdOAAP5SZ2hG5WgHAg7x+2QAAAABAAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00582{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"snapchat_call.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1595865799020,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"18.184.138.142","src_port":42083,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"24":"SNI TLS extension was missing"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {}} @@ -15,3 +16,5 @@ 00453{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"snapchat_call.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595865799,"pkt_ts_usec":105753,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"CL6sCxdumt9Y+uvcCABFAABCAJFAAEARz4LAqAypEriKjqRjAbsALmnoQMOARud6owbqB97g\/jhJ9kT7eseQiNAVbouFZELJBQ7vbNXPBus="} 00453{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"snapchat_call.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595865799,"pkt_ts_usec":105760,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"CL6sCxdumt9Y+uvcCABFAABCAJJAAEARz4HAqAypEriKjqRjAbsALq54QMOARud6owbqCFB\/R6QkZ4cH6CMIS5RzQDZFuCrfWVfg0GUd8kY="} 00618{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"snapchat_call.pcapng","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595865799,"pkt_ts_usec":105971,"pkt_caplen":201,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":201,"pkt_l4_len":167,"pkt":"CL6sCxdumt9Y+uvcCABFAAC7AJNAAEARzwfAqAypEriKjqRjAbsAp9wkQMOARud6owbqCRc3SXpZ6Q9b9545QLOgrmU7yrTkDeu1OuRMhPND6AkTs3ROozWJziUGPGTD7NgdmiQX5t0ozTRtTxbk7\/KukXzKWYmVD9Mk3HoJXFObywsgcQzdtt+wsCQ6BlbJTbVGz4\/ddaV5nEeaHbghbcZU6VpqPRWkwkqgnOUcsHXDm4\/7lQ3gSNvX5H+o61wG2b9kKE9PLXv5"} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":50,"source":"snapchat_call.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":50,"flow_first_seen":1595865799020,"flow_last_seen":1595865807311,"flow_tot_l4_data_len":11072,"flow_min_l4_data_len":28,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"18.184.138.142","src_port":42083,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":50,"source":"snapchat_call.pcapng","alias":"nDPId-test"} diff --git a/test/results/ssdp-m-search.pcap.out b/test/results/ssdp-m-search.pcap.out index 46a2cc0ba..bb0c7323b 100644 --- a/test/results/ssdp-m-search.pcap.out +++ b/test/results/ssdp-m-search.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ssdp-m-search.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ssdp-m-search.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1532054645808,"flow_last_seen":0,"flow_tot_l4_data_len":29,"flow_min_l4_data_len":29,"flow_max_l4_data_len":29,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.8","dst_ip":"192.168.242.255","src_port":42253,"dst_port":32412,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ssdp-m-search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1532054645,"pkt_ts_usec":808785,"pkt_caplen":63,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":63,"pkt_l4_len":29,"pkt":"\/\/\/\/\/\/\/\/AAibydCMCABFAAAxO0tAAEARmRfAqPIIwKjy\/6UNfpwAHf9xTS1TRUFSQ0ggKiBIVFRQLzEuMQ0K"} 00514{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"ssdp-m-search.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1532054645808,"flow_last_seen":0,"flow_tot_l4_data_len":29,"flow_min_l4_data_len":29,"flow_max_l4_data_len":29,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.8","dst_ip":"192.168.242.255","src_port":42253,"dst_port":32412,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}} @@ -15,3 +16,5 @@ 00435{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ssdp-m-search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1532054705,"pkt_ts_usec":808776,"pkt_caplen":63,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":63,"pkt_l4_len":29,"pkt":"\/\/\/\/\/\/\/\/AAibydCMCABFAAAxvxhAAEARFUrAqPIIwKjy\/6UNfpwAHf9xTS1TRUFSQ0ggKiBIVFRQLzEuMQ0K"} 00435{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ssdp-m-search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1532054710,"pkt_ts_usec":808804,"pkt_caplen":63,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":63,"pkt_l4_len":29,"pkt":"\/\/\/\/\/\/\/\/AAibydCMCABFAAAxwmtAAEAREffAqPIIwKjy\/6UNfpwAHf9xTS1TRUFSQ0ggKiBIVFRQLzEuMQ0K"} 00436{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ssdp-m-search.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1532054715,"pkt_ts_usec":808776,"pkt_caplen":63,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":63,"pkt_l4_len":29,"pkt":"\/\/\/\/\/\/\/\/AAibydCMCABFAAAxxENAAEAREB\/AqPIIwKjy\/6UNfpwAHf9xTS1TRUFSQ0ggKiBIVFRQLzEuMQ0K"} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":19,"source":"ssdp-m-search.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":19,"flow_first_seen":1532054645808,"flow_last_seen":1532054735808,"flow_tot_l4_data_len":551,"flow_min_l4_data_len":29,"flow_max_l4_data_len":29,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.242.8","dst_ip":"192.168.242.255","src_port":42253,"dst_port":32412,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":19,"source":"ssdp-m-search.pcap","alias":"nDPId-test"} diff --git a/test/results/ssh.pcap.out b/test/results/ssh.pcap.out index 63de8c537..d9030f869 100644 --- a/test/results/ssh.pcap.out +++ b/test/results/ssh.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ssh.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ssh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1320435464760,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.238.1","dst_ip":"172.16.238.168","src_port":58395,"dst_port":22,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ssh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1320435464,"pkt_ts_usec":760244,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAwppUXgAFBWwAAICABFAABAek9AAEAGi52sEO4BrBDuqOQbABY3Xn+qAAAAALAC\/\/+abgAAAgQFtAEDAwMBAQgKHJWv9QAAAAAEAgAA"} 00431{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"ssh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1320435464,"pkt_ts_usec":760270,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"AFBWwAAIAAwppUXgCABFAAA8AABAAEAGBfGsEO6orBDuAQAW5BtConY2N15\/q6ASFqC42wAAAgQFtAQCCAoAEyL4HJWv9QEDAwY="} @@ -18,3 +19,5 @@ 00628{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"ssh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1320435464,"pkt_ts_usec":772570,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"AFBWwAAIAAwppUXgCABFAADMVNNAAEAGsI2sEO6orBDuAQAW5BtConlcN16DYIAYAHdn8wAAAQEICgATIwQclbABAAAAlAgfAAAAgQDeSfyQaZlMN50rZWPv03765nhe6x3QoSsJCqwnKyLfjGSkoqt7mc4Ld6mlLggz1S1TsljO3\/0XXcijdmqbmAc2JkbckhVijD9K8OCNAKtgo7nlW65H6CZR2gwVonNV3bBjZcrh3d5MDJfcmUL9ZemGf6UOcuHHhUEe3SjeJ0uzIwAAAAECAAAAAAAAAAA="} 00423{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"ssh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1320435464,"pkt_ts_usec":772673,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"AAwppUXgAFBWwAAICABFAAA0rWVAAEAGWJOsEO4BrBDuqOQbABY3XoNgQqJ59IAQ\/\/\/2uwAAAQEIChyVsAIAEyME"} 00617{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"ssh.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1320435464,"pkt_ts_usec":774287,"pkt_caplen":210,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":210,"pkt_l4_len":176,"pkt":"AAwppUXgAFBWwAAICABFAADEyg1AAEAGO1usEO4BrBDuqOQbABY3XoNgQqJ59IAY\/\/+RQAAAAQEIChyVsAMAEyMEAAAAjAUgAAAAgQCKUG7tHgFITWPHoMxc4wuZ1BXy9n04qGBXJaOb+9wr70emYr8wHGq5ovMs7cviXyxxuF2Wdy30WLOfkouWkCplLGVZjdOTH0a5W2C9UmG80DhI+zr3en+DO3OfgxTtHr+gZJk6dXUbjvnH28419VgXWQUn69FtGg8SjApYMkgSUQAAAAAA"} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":258,"source":"ssh.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":258,"flow_first_seen":1320435464760,"flow_last_seen":1320435713237,"flow_tot_l4_data_len":26774,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1312,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"172.16.238.1","dst_ip":"172.16.238.168","src_port":58395,"dst_port":22,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":258,"source":"ssh.pcap","alias":"nDPId-test"} diff --git a/test/results/starcraft_battle.pcap.out b/test/results/starcraft_battle.pcap.out index c0a92a345..f97443202 100644 --- a/test/results/starcraft_battle.pcap.out +++ b/test/results/starcraft_battle.pcap.out @@ -1,3 +1,4 @@ +00393{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"starcraft_battle.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1437389953643,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":1,"l3_proto":"ip4","src_ip":"192.30.252.91","dst_ip":"192.168.1.100","src_port":443,"dst_port":3213,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00461{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"starcraft_battle.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1437389953,"pkt_ts_usec":643103,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"IImEa8W6hCYVPnXECABFAABHZtpAAPMGok\/AHvxbwKgBZAG7DI12Mx9qhBzaXVAYAB\/+XQAAFwMDABrSe+rfqh1HHm09zJFdvf5O5AwaBTHDWE16Zg=="} 00467{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"starcraft_battle.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1437389953,"pkt_ts_usec":643311,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"hCYVPnXEIImEa8W6CABFAABLZZBAAIAGFpbAqAFkwB78WwyNAbuEHNpddjMfiVAYAP4NnAAAFwMDAB4AAAAAAAAAE\/\/36Dj9UZVbiDpZWB\/\/4P+7KR1Y0OI="} @@ -450,3 +451,74 @@ 02437{"flow_id":46,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":772,"source":"starcraft_battle.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1437389985,"pkt_ts_usec":993138,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"IImEa8W6hCYVPnXECABFAAXc0ClAADkGeJIC5C5wwKgBZABQDci+gjFdcwdVgVAQAepaNwAAGx732slx51tQ8X12DyPwVHd7R4rqC8JIcDb6JIsAsEDNUHTPbFF3PFkLwbF9Kx9xy8Th+SDu+F\/eRMeBYOaDb1QdM9tX+iqk\/wBxM\/w3oO6aT\/xOH\/YN\/BBkDSyCwbq8xa0LQqxJzY8NqXSECMROLidrZSswOnOw1rzxNWu+yKNwPrnZb8CoO8mC53urAe2uu6cQ0O6DpDgof\/XAP91VX+BIg7zdoSUCGWwdcoMWpBmhkYCBnaW3VHRHZFiEeEcZPiqnCF08L6cZzaz8zTb\/AKJCg73MhaQbhaUrpSXbhQQ2U3IJ8lRbBLdx15INfUcG4LX43Fi09EJMQY9kgm7148TbZTYG2lhy5LI5DfQ+ac0S3XX8UkPe59UEc0E3v\/UrxCu0UkeXvbYFhwZ\/9+\/\/ACF5rtl+7\/O\/C937l377\/wAf43dXY0LdlXCf+9sJ\/wCiF3PSPe\/A+THY8u2m9+s38urtdYe2Z\/oJwT\/fH\/5T11ra\/wByYfyvul3vuZ++OP8AI\/FDmHs0\/wCklw5\/98\/+8yrltnPevC+d9qXWduf8w5n5n2KXaI+Bdmh0RRIVZFZ2TmKn\/BdQeOO1b\/8AKbd\/vhh\/\/dwLx7Vff\/51HZS\/pzZ3\/JvzMX7Vb2A7W\/ovYX8xvI3ta\/6Y+Hf71R\/99MvI9rvd1HyI7an9KdzT3oxf5k\/ZoepcOBOF0n+0s\/wQvV8L9nT4ofznmP21fjntX21K\/V86mbRJFLrkeqCknf0SBp+KOF8N4ywabDMUgE1NJqCNHRu5OaeRH9tCvjzmTwc9hTg48XifR4Y8LldM1PNaRmac1lKrVR5pjqmOcT\/e95nrKLiH2eeMmzQk1eFVBs1xuI6qMfZd+68X+XmDr5TiUZvZjOdKnfRPmqjqnqmP73P6IwsXTdvtNnDxI6OLT56J6466Z9PgmHonhPi7DuNcFixLDpc8TtHxn44nc2uHIj+tepZLO4OfwYxsGd3pieqX896tpOa0bNVZXNU2mOE8pjrjwf8Ayd7rrtk7ZGcLRy4Ng0rZMYeLSzN1FKD+L\/LluV1jXtejJROWy03xJ4z8H\/32O\/7H7H1apVTns9FsGOEfD\/6+HnwhoeyHsZdM6LiLiWN0kr3d7T0c2pJ37yS+5O4B9T0XHaFoE1TGdz0Xmd8RPbPq87nNr9sooidL0mbRG6qqPN0aeyZjxR1u8n7FejvC2O7UKhXcgoKX7IOG9p9RxBS8NyycOsDqm9pcgzShnMxjr+W2q4LWq87h5WasjHtufXbweH+4dx2VwtJxdRpp1abUcr7qb\/7p6vRM8dzhnZ92OihkZi3EQ96r3HvG0shzNjO93n7TvLYeZ26\/o+zkYUxms\/7aud9p328M9c+h3PafbicemchpHtMKN01RumY6qeqn0z4I49qbG679Dxt597A\/9GFZ\/uB\/\/eRryLZH3dX8ie2l\/SndL96ML+ZH2a3fRHReuP5rI4aIKyg6I4PPvXbLUSkkWqqt4B9Hi33ryXS\/8TaCqv8A3Vz9p\/Se0EewbF0Yf+zCj00z9zu2R7Y2lz3BjRzJsF6zVVEReX83U01VzamLyxH4pRsdZ1XA0jkZB\/FfjOYwYm01x54fVGSzVUXjCqnyT6lb8VoiP\/Haf\/lG\/wAVPynA+HHnhr8hzfxVX0Z9SW1cM9hHMx99RleDdfpTiUV\/q1RL8K8DFw99dEx44lpsS4HwTGcQNdWUXfVRteTvXt20GgcAuKzGj5HN43s+Nh3q3b7zy8U2diyW0+radloyeVxujh793Rpnjx3zTM+lvnahc06srvf1UEEaoKkEnZBW\/mqIdsEgVuOqSOsMc4d4i4t4lkpaw9xQQnMyRoPdBp2I\/ed\/bQLzPO6fqmrZ6cHH9rh08J\/028HXP97oe86Trez+zmkU5nJx08evdMT+veON\/g0xytxjrm7n2BYBR8O0IpqOINboXvPxPPUld7w="} 00419{"flow_id":46,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":773,"source":"starcraft_battle.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1437389985,"pkt_ts_usec":993148,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"hCYVPnXEIImEa8W6CABFAAAoLRZAAIAG2lnAqAFkAuQucA3IAFBzB1WBvoI3EVAQAQDvPwAA"} 02446{"flow_id":46,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":774,"source":"starcraft_battle.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1437389985,"pkt_ts_usec":993425,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"IImEa8W6hCYVPnXECABFAAXc0CpAADkGeJEC5C5wwKgBZABQDci+gjcRcwdVgVAQAeqJ9AAAjkMDT8KMLApt1zznwy8h1fWM5rWYnMZuq88o5Ux1RH9zPNwPtm2wb\/13\/wAC6Ntl+7\/O\/C9c7l377\/x\/jc34Z\/0NYT\/uSH\/AC7vpnuHA+RT9mHk2v+++c\/mV\/alsLbrknApGysDrDtgB7\/C3fZLZB87tXmW2UT08CfBV9z3zuYVR7Fm6ed6PxOZ8MSNk4cwstNx7tGPmGgFd40qqKshgTHwaeyHkm0VFVGsZuKvjK589UzHobJx0K5R14g0CBuSsjinaXOyLhiRjiA6WRjWjrY3\/ACXUdqMSmjTZpnjVMW89\/ueldz7BrxNcprpjdTTVM+WLdssfsufm4clFvhqXN9fC0\/mvw2SqvkKo6qp7Il9fdIo6Os0T14dM\/Wqj7nLnbLujyoO2QQR4QgBsgYbKiu6gAgZBDkEFBCsB1AXCB0CndBA3QMRdasIIspYRdQHJBN0Agg\/kgUIId8Sos9FANOqAcdAggm5VgA2QF0ANSoGagcHU6KicyCb6IAH8FQt\/EFkTfQXVEXufNQNdAboDlbdADTVBN\/JAZfNBIabIGDf7BBKokBQOCqJ3G5CcR8TFAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIBAIGGyAQCB0EjdAyAQOz4UDIHZsUFo2QS3dBaN0Dt3QWNtY9UFkbSQbILu7LRrz5BABBKC6Pdt9kHI+FM1TWGB\/iaIyGsPO6DY8OyzUcs9CXNEjJbBjtR5oFlZFRmorqeR82YubI0aAG+yDDfm7lhuBI8AkAbDogvxGR9Jh8EGYXltK5o3AtoCg1cEb55mRsaXPeQ1rRzJQei6\/gupkj4D7KMIgdNiFZJHiuNtjOxdyd5Mjufmg984RhNHgWGU2HYfTspKGmjEUMEYs1jRsAgzG7qwGCSJbuVQh0KyGWxDuSzIhQSgEHSM9HVV\/HVZT0U3u9U+smDJc5blOZx3Go0Qcm\/kVxef8Az9\/2yb+CA\/kVxf8A6\/f9sm\/ggn+RXF\/+v3\/bJv8AFQQOCeL\/APX7\/tk38EHMeE8MxDC8NdDiVV75Ud4Xd53jn+E2sLuF+qDYYhh0GLUctJUs7yCQWcPz9UHXVZ2UYhSVBkw2ujc2+neExvA9QDf7kFbOCuL2kFtc8EbWrHaIJ\/kzxvf\/AMcqv+fn\/GQOOGOON\/fKr\/n5\/wAZUUVNdxpw23v6l9SImnV0hbKz5nWyg55wNxi3iqkkbKxsVbDbvGt+FwOzh\/BBywclodA8LcQycMYn75FC2dxjMeV5sNSOnosjmDe2SsH\/AJug\/wCO5BYO2WssP8zYP+OUF7e2est\/nbB\/yhQTJ2x4lI3LBh9M2Q83FzvuuFRrsN4cxvj3GxV17JI4HEd5USNytDR9lg\/h80HdsMbYWNYwZWNGVo6AIOnODf8ATVH+6an\/AAZEHeDBfVBe3X+pWRYAoHtogZig6d7aNOKaTp7kz\/DkQd0UZ\/vSD\/YN\/BB0521\/6KqT\/cTP8ORBtYe3LuomM\/Ut8rQ2\/ve\/\/QQWjt12\/wAw\/wDtf\/4iCwdu1j\/nH\/2v\/wDEVFje3f8A+4f\/AGv\/APEVGrxntLxXjGmfh0DaTC6eYZZHyThpLTyzOtp1sFBz7s14IbwnQSzSzxVNXVZS58JuxrRsGnnve\/p0Qc4YABdOQbYnRQPD8S0OjuCz\/wDXADt\/fVV\/gyKDu6ebINFRhCaztUDGS5\/NFdc8Y9k0OOVstdh1QyjqJTmkikF43O5kEag\/IojjH9znjKlHdw1\/gA07uscB+SBXcH8fwgNZiFS5o\/cxBwA+pCgX+SvaF\/8AZ1Z\/7RP+MgDhfaLhbS9tRWytAv4asSn6FxJ+iK3nAva1iEeKxYZj4Lw9\/dd8WZJI33sA4dL6bAhEd0CS7bg3VDx3IuoLD9TfdAEqiLk="} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1437389982769,"flow_last_seen":1437389982825,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":10,"flow_max_l4_data_len":10,"flow_avg_l4_data_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"62.115.246.51","src_port":53146,"dst_port":1119,"l4_proto":"udp","ndpi": {"proto":"Starcraft","breed":"Fun","category":"Game"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1437389982769,"flow_last_seen":1437389982825,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":10,"flow_max_l4_data_len":10,"flow_avg_l4_data_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"62.115.246.51","src_port":53146,"dst_port":1119,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1437389961548,"flow_last_seen":1437389961598,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"64.233.184.188","src_port":2759,"dst_port":5228,"l4_proto":"tcp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1437389961548,"flow_last_seen":1437389961598,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"64.233.184.188","src_port":2759,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1437389955932,"flow_last_seen":1437389955967,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"216.58.212.110","src_port":3052,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1437389955932,"flow_last_seen":1437389955967,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":21,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"216.58.212.110","src_port":3052,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1437389981134,"flow_last_seen":1437389981218,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":42,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":53145,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":9,"flow_first_seen":1437389964518,"flow_last_seen":1437389964635,"flow_tot_l4_data_len":981,"flow_min_l4_data_len":20,"flow_max_l4_data_len":447,"flow_avg_l4_data_len":109,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"173.194.113.224","src_port":3506,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00459{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1437389976946,"flow_last_seen":1437389980126,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.107","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":13,"flow_first_seen":1437389958129,"flow_last_seen":1437389968685,"flow_tot_l4_data_len":430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":121,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.208.193","src_port":3427,"dst_port":1119,"l4_proto":"tcp","ndpi": {"proto":"Starcraft","breed":"Fun","category":"Game"}} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":13,"flow_first_seen":1437389958129,"flow_last_seen":1437389968685,"flow_tot_l4_data_len":430,"flow_min_l4_data_len":20,"flow_max_l4_data_len":121,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.208.193","src_port":3427,"dst_port":1119,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":4,"flow_first_seen":1437389985821,"flow_last_seen":1437389985912,"flow_tot_l4_data_len":420,"flow_min_l4_data_len":50,"flow_max_l4_data_len":160,"flow_avg_l4_data_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":55468,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1437389968488,"flow_last_seen":1437389968521,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"173.194.113.224","src_port":3484,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_first_seen":1437389968488,"flow_last_seen":1437389968521,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"173.194.113.224","src_port":3484,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":41,"flow_first_seen":1437389985891,"flow_last_seen":1437389985996,"flow_tot_l4_data_len":36033,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":878,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3527,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":29,"flow_first_seen":1437389985892,"flow_last_seen":1437389985994,"flow_tot_l4_data_len":24113,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":831,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3528,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":29,"flow_first_seen":1437389985898,"flow_last_seen":1437389985969,"flow_tot_l4_data_len":24110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":831,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3529,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":29,"flow_first_seen":1437389985898,"flow_last_seen":1437389985982,"flow_tot_l4_data_len":24110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":831,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3530,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":29,"flow_first_seen":1437389985923,"flow_last_seen":1437389985992,"flow_tot_l4_data_len":24110,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":831,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3531,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":4,"flow_first_seen":1437389985925,"flow_last_seen":1437389985961,"flow_tot_l4_data_len":250,"flow_min_l4_data_len":20,"flow_max_l4_data_len":166,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3532,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":4,"flow_first_seen":1437389985925,"flow_last_seen":1437389985962,"flow_tot_l4_data_len":250,"flow_min_l4_data_len":20,"flow_max_l4_data_len":166,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3533,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1437389985960,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3534,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1437389985960,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.112","src_port":3534,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":215,"flow_first_seen":1437389982130,"flow_last_seen":1437389985956,"flow_tot_l4_data_len":42602,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":198,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"213.248.127.130","src_port":3517,"dst_port":1119,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968519,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3479,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968519,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3479,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968525,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3480,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968525,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3480,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968520,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3481,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968520,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3481,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968519,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3482,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968519,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.114","src_port":3482,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968541,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3489,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968541,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3489,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968521,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3490,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968521,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3490,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968522,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3491,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968522,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3491,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1437389968486,"flow_last_seen":1437389968520,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3492,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1437389968486,"flow_last_seen":1437389968520,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":20,"flow_max_l4_data_len":73,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"2.228.46.104","src_port":3492,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1437389964752,"flow_last_seen":1437389964835,"flow_tot_l4_data_len":306,"flow_min_l4_data_len":43,"flow_max_l4_data_len":110,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":60026,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1437389953643,"flow_last_seen":1437389953774,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":42,"midstream":1,"l3_proto":"ip4","src_ip":"192.30.252.91","dst_ip":"192.168.1.100","src_port":443,"dst_port":3213,"l4_proto":"tcp","ndpi": {"proto":"TLS.Github","breed":"Acceptable","category":"Collaborative"}} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1437389953643,"flow_last_seen":1437389953774,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":42,"midstream":1,"l3_proto":"ip4","src_ip":"192.30.252.91","dst_ip":"192.168.1.100","src_port":443,"dst_port":3213,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1437389982884,"flow_last_seen":1437389982933,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":9,"flow_max_l4_data_len":15,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"213.248.127.166","src_port":6113,"dst_port":1119,"l4_proto":"udp","ndpi": {"proto":"Starcraft","breed":"Fun","category":"Game"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1437389982884,"flow_last_seen":1437389982933,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":9,"flow_max_l4_data_len":15,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"213.248.127.166","src_port":6113,"dst_port":1119,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1437389982782,"flow_last_seen":1437389982833,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":9,"flow_max_l4_data_len":15,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"213.248.127.212","src_port":6113,"dst_port":1119,"l4_proto":"udp","ndpi": {"proto":"Starcraft","breed":"Fun","category":"Game"}} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1437389982782,"flow_last_seen":1437389982833,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":9,"flow_max_l4_data_len":15,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"213.248.127.212","src_port":6113,"dst_port":1119,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":10,"flow_first_seen":1437389981197,"flow_last_seen":1437389981500,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":535,"flow_avg_l4_data_len":87,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.26","src_port":3515,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":12,"flow_first_seen":1437389981330,"flow_last_seen":1437389981497,"flow_tot_l4_data_len":3252,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.21","src_port":3516,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":10,"flow_first_seen":1437389982140,"flow_last_seen":1437389982442,"flow_tot_l4_data_len":872,"flow_min_l4_data_len":20,"flow_max_l4_data_len":539,"flow_avg_l4_data_len":87,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.26","src_port":3518,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":9,"flow_first_seen":1437389982269,"flow_last_seen":1437389982443,"flow_tot_l4_data_len":659,"flow_min_l4_data_len":20,"flow_max_l4_data_len":283,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.21","src_port":3519,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":10,"flow_first_seen":1437389983663,"flow_last_seen":1437389983964,"flow_tot_l4_data_len":870,"flow_min_l4_data_len":20,"flow_max_l4_data_len":535,"flow_avg_l4_data_len":87,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.26","src_port":3521,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":11,"flow_first_seen":1437389983788,"flow_last_seen":1437389983963,"flow_tot_l4_data_len":3232,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":293,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.21","src_port":3522,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":10,"flow_first_seen":1437389985308,"flow_last_seen":1437389985615,"flow_tot_l4_data_len":854,"flow_min_l4_data_len":20,"flow_max_l4_data_len":511,"flow_avg_l4_data_len":85,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.26","src_port":3523,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":10,"flow_first_seen":1437389985320,"flow_last_seen":1437389985635,"flow_tot_l4_data_len":860,"flow_min_l4_data_len":20,"flow_max_l4_data_len":519,"flow_avg_l4_data_len":86,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.26","src_port":3524,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":12,"flow_first_seen":1437389985434,"flow_last_seen":1437389985610,"flow_tot_l4_data_len":3511,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.40","src_port":3525,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":11,"flow_first_seen":1437389985446,"flow_last_seen":1437389985631,"flow_tot_l4_data_len":3298,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":299,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"80.239.186.40","src_port":3526,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":6,"flow_first_seen":1437389955670,"flow_last_seen":1437389984611,"flow_tot_l4_data_len":271,"flow_min_l4_data_len":32,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"173.194.40.22","dst_ip":"192.168.1.100","src_port":443,"dst_port":53568,"l4_proto":"udp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":6,"flow_first_seen":1437389955670,"flow_last_seen":1437389984611,"flow_tot_l4_data_len":271,"flow_min_l4_data_len":32,"flow_max_l4_data_len":49,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"173.194.40.22","dst_ip":"192.168.1.100","src_port":443,"dst_port":53568,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1437389982769,"flow_last_seen":1437389982823,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":10,"flow_max_l4_data_len":10,"flow_avg_l4_data_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"5.42.180.154","src_port":53146,"dst_port":1119,"l4_proto":"udp","ndpi": {"proto":"Starcraft","breed":"Fun","category":"Game"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1437389982769,"flow_last_seen":1437389982823,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":10,"flow_max_l4_data_len":10,"flow_avg_l4_data_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"5.42.180.154","src_port":53146,"dst_port":1119,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968610,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"199.38.164.156","src_port":3486,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1437389968487,"flow_last_seen":1437389968610,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"199.38.164.156","src_port":3486,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":11,"flow_first_seen":1437389963466,"flow_last_seen":1437389963469,"flow_tot_l4_data_len":4610,"flow_min_l4_data_len":380,"flow_max_l4_data_len":460,"flow_avg_l4_data_len":419,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"239.255.255.250","src_port":38605,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":179,"flow_first_seen":1437389964790,"flow_last_seen":1437389968014,"flow_tot_l4_data_len":128106,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":715,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"87.248.221.254","src_port":3508,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1437389953741,"flow_last_seen":1437389953805,"flow_tot_l4_data_len":296,"flow_min_l4_data_len":52,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":58818,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1437389954543,"flow_last_seen":1437389954714,"flow_tot_l4_data_len":281,"flow_min_l4_data_len":52,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":58831,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1437389955747,"flow_last_seen":1437389955800,"flow_tot_l4_data_len":142,"flow_min_l4_data_len":52,"flow_max_l4_data_len":90,"flow_avg_l4_data_len":71,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":58844,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":4,"flow_first_seen":1437389956550,"flow_last_seen":1437389956605,"flow_tot_l4_data_len":319,"flow_min_l4_data_len":52,"flow_max_l4_data_len":123,"flow_avg_l4_data_len":79,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.254","src_port":58851,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":9,"flow_first_seen":1437389967432,"flow_last_seen":1437389968027,"flow_tot_l4_data_len":562,"flow_min_l4_data_len":20,"flow_max_l4_data_len":293,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"12.129.222.54","src_port":3512,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":800,"source":"starcraft_battle.pcap","alias":"nDPId-test"} diff --git a/test/results/steam.pcap.out b/test/results/steam.pcap.out index efc37e0e0..f1057175a 100644 --- a/test/results/steam.pcap.out +++ b/test/results/steam.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"steam.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"steam.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1357332164693,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.13","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"steam.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1357332164,"pkt_ts_usec":693497,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AFBW4RiuAAwp3FvtCABFAABAAABAAEARkx\/AqLyVkkKYDbJhaYoALLORVlMwMQAAAQAABgAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA"} 00498{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"steam.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1357332164693,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.13","src_port":45665,"dst_port":27018,"l4_proto":"udp","ndpi": {"proto":"Steam","breed":"Fun","category":"Game"}} @@ -212,3 +213,59 @@ 00551{"flow_id":50,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"steam.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1357332165,"pkt_ts_usec":949380,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"AAwp3FvtAFBW4RiuCABFAACQWVEAAIAR3WxIpT28wKi8lWmKsmEAfEkXVlMwMVAABgQAwKtTAAYAAAUAAAADAAAAAQAAAAUAAABQAAAAgux1ympnhlJKXy0zvwqCQYTlqRzT2LWXTXvx\/11gCr4VUXaqpbhFIulso4n7wIJQpJ1kPnewIgY2tvvA5o3XJWewqSsndHrQTTMCTo8TCAM="} 00440{"flow_id":50,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"steam.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1357332165,"pkt_ts_usec":950083,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AAwp3FvtAFBW4RiuCABFAABAWVIAAIAR3btIpT28wKi8lWmKsmEALJhoVlMwMQAABQQAwKtTAAYAAAYAAAADAAAAAQAAAAYAAAAAAAAA"} 00440{"flow_id":50,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1357332165,"pkt_ts_usec":983077,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"AFBW4RiuAAwp3FvtCABFAABAAABAAEARNw7AqLyVSKU9vLJhaYoALKBoVlMwMQAABwQABgAAAMCrUwAAAAAGAAAAAAAAAAAAAAAAAAAA"} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1357332165137,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.7","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1357332164737,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.8","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1357332165138,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.5","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1357332164694,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.6","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1357332165289,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.6","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1357332165037,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.5","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1357332164786,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.7","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1357332164694,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.8","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1357332165287,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.7","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1357332164937,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.5","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1357332164837,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.6","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1357332164787,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"81.171.115.8","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1357332164987,"flow_last_seen":1357332165020,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.171","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1357332164837,"flow_last_seen":1357332164869,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.172","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1357332164787,"flow_last_seen":1357332164823,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.170","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1357332165337,"flow_last_seen":1357332165370,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.171","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1357332165238,"flow_last_seen":1357332165266,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.170","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1357332164736,"flow_last_seen":1357332164761,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"69.28.145.172","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":2,"flow_first_seen":1357332165337,"flow_last_seen":1357332165375,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.176","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1357332165188,"flow_last_seen":1357332165229,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.185","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1357332165137,"flow_last_seen":1357332165175,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.187","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1357332165037,"flow_last_seen":1357332165075,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.175","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1357332164987,"flow_last_seen":1357332165027,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.174","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1357332164888,"flow_last_seen":1357332164927,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.188","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":11,"flow_first_seen":1357332165288,"flow_last_seen":1357332165983,"flow_tot_l4_data_len":1080,"flow_min_l4_data_len":44,"flow_max_l4_data_len":332,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.188","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1357332165238,"flow_last_seen":1357332165277,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.175","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":2,"flow_first_seen":1357332165187,"flow_last_seen":1357332165226,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.176","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1357332165087,"flow_last_seen":1357332165125,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.174","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1357332164936,"flow_last_seen":1357332164974,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.185","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1357332164836,"flow_last_seen":1357332164873,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"72.165.61.187","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1357332165037,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"203.77.185.5","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1357332164887,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"203.77.185.4","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":1357332165188,"flow_last_seen":1357332165285,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"68.142.91.35","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":2,"flow_first_seen":1357332165288,"flow_last_seen":1357332165310,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"68.142.116.178","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1357332164888,"flow_last_seen":1357332164912,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"68.142.116.179","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1357332164886,"flow_last_seen":1357332164980,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"68.142.91.34","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1357332164737,"flow_last_seen":1357332164834,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"68.142.91.36","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1357332165187,"flow_last_seen":1357332165344,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.133.85","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1357332165088,"flow_last_seen":1357332165243,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.133.84","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1357332164936,"flow_last_seen":1357332165017,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.171.82","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1357332164787,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.171.83","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1357332165138,"flow_last_seen":1357332165291,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.133.84","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1357332164987,"flow_last_seen":1357332165148,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"208.111.133.85","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1357332165238,"flow_last_seen":1357332165425,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.15","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1357332164986,"flow_last_seen":1357332165166,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.14","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1357332165088,"flow_last_seen":1357332165279,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.12","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1357332164937,"flow_last_seen":1357332165121,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.13","src_port":45665,"dst_port":27017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1357332165337,"flow_last_seen":1357332165520,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.14","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1357332165038,"flow_last_seen":1357332165230,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.15","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1357332164737,"flow_last_seen":1357332164925,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.12","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1357332164693,"flow_last_seen":1357332164876,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.13","src_port":45665,"dst_port":27018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1357332165087,"flow_last_seen":1357332165270,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.15","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1357332165237,"flow_last_seen":1357332165424,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.13","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1357332164836,"flow_last_seen":1357332165015,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.14","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1357332164693,"flow_last_seen":1357332164892,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":44,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.188.149","dst_ip":"146.66.152.12","src_port":45665,"dst_port":27019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":104,"source":"steam.pcap","alias":"nDPId-test"} diff --git a/test/results/teams.pcap.out b/test/results/teams.pcap.out index 33cdc18f4..dd51fb57f 100644 --- a/test/results/teams.pcap.out +++ b/test/results/teams.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"teams.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1587041672419,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00777{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041672,"pkt_ts_usec":419153,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzES1AAEARZ+TAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGABgr52AAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"} 00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1587041672419,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,3"}} @@ -1031,3 +1032,88 @@ 02051{"flow_id":80,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2776,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":676447,"pkt_caplen":1256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1256,"pkt_l4_len":1222,"pkt":"KDc3AG3IEBMx8Tl2CABFAATa6dkAADURCXddR27NwKgBBj\/Mw2AExilggMkBKwAAdOzsa5K8UoqAgMkd6DyrDFM5Z5ls+wHmur1BhbBuUi5o3AHNCpvPNXoPapE6jrC+JzT+SZK8D06h9KkWZnNZ0to+rDxXAL8qfeNCyQf8VSQ0AntLdH\/K59E3hXZoxKxbgv5xmpBpN4h1DRb9ss3Zw9lHvXc\/zsARlFA3rTxVvmG8JuxQyZ11l2MiBj9O9PdNIgqmQ1X\/t8VvsmcP+oaVyL3Rye4vON7N9\/i3GQfK6jefXyT1F\/FReir67ocbsdrX4arGdGCd4Z7JejYiBJDSTjGNHiAnz7fAVLR2qqJL4\/Sd8X8dQV+r3yS+02htPEKHVN9cxfg\/OrSm57mPr52PrYaZ7ojRC3fnjoDXQu9PKKdBMNxw2ArNdoz0fpib6VWO\/EXu8gg09eqHwBEubXujZe+W8VKaLv\/4JLWNuhjLYaYTayQdmWDR\/ghya9BFOZMgbQTqjCeK5p0rW7VJ84jhVQ0JrJEtvM7SR3GN6Aksfur8vluQMNljEf0pe4ZXLIkwKxbUw2XInUe\/MrWGHIrq72jgjiaeuCLdP9pTVb23+PswDjwfr24AhxZxhkjRbp5SqjFwht1aWh0EXq3HsBzNii+irNEd6Pb7dvdE\/xlAVPTYMjZRBlTGv7elYyfGxw9YcKOu\/mcnyL2wusZdMc\/2lW0e\/\/s70KlhN4cSdg9+68j9qKCKCjrk5ts8OacUCq6sdwpP93U\/vaeEBHyR47Tzyfv1Jimai1ElwYHqr9C4C5ZMSfglAU97+eT9jCQG6NLM4gCbt+557epmUASqswbBeTk\/nN5weW6zTNPFW2iB9hYQxGa1WOY2dnVWQ06fxh08sjwfySpW5jTPNnpJa+ebIDJ1gmhlQom6TSavGEaLMnUlBSh40YzBoSITQ6\/hPa6QMANwcufrSnM9lfVHtQcxEQUmXywUAOQss+xImJic9lANftI7cg53ol9psrYwRvwIP6sJl9ct990QvLyQHF0+BGcKIQaVCLLS8z5Vq7PNqxYl0pZXe6VJ4fVCVoUBgYAs5oSxFmGHh5UnV7TXlPgZfuAWfZR70M3xVymqw6DLqU25r\/DNfjLFP37YjFuvJEGlAsHex+mfPYAR1UcKjdn3O1LchDrKOblh1YKg7ZVE7mAzkAi\/1nM3ZZfXZ7nGnqyWZEE6SeX9J8d557nRzBbgKQfX8b6QyIipZQHaKYLT1uCeQuHhoeOi9nka4DyXixxciPGXsP3CYn8rMacQg+2nCZtkAzyP643oGuCmv4OoP\/dPKqpk\/G67Lpw5G55kJ0UbCgi6jUrG7bVFWMuv8L\/JEjEuNlGyMphzfPfmlXefF647EGhTXLymFznu95xGlhre0omC5\/AvhztRX7vR8nN372CvUepGLo\/oMN5Jb6zz2V8i2oXn8NMp5kLbZxjRl0ZjFk3uRvayyWBSNvfY\/nxbVl9cjJOWlDhjRo0LH5FrIx+L08J\/U01uek5LCClDUdc9KzE1t7PZL1\/sNf+f1xp5CANozF\/uu+\/QNRdgulBTdfDW6IKj8XEvdzIHuOEs9UL2y8mbR7h1NTWsZfYTDiwy11ObRF6CUkaZP08bUDvAfGLcVYzBXFUCQZOJgAAAAg7rLYYXyWxwhDw="} 00592{"flow_id":72,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2784,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":713165,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"KDc3AG3IEBMx8Tl2CABFAACtVxwAAGwRBno0cvqJwKgBBg2Ww3QAmStwAQMAfSESpEKq36JSlpzO4UFUsSMADwAEcsZLxgANAAQAAAAAAAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHObHGnagqAUAAYmiULR7BQSjV7GJ7mOy6WXuQ5anUAAAAAgCIACTIuMC4xLjIxMQAIACBb+0dO7XG7sUjMCcGQZhDcW3hrI\/E2Bu3cGSpxYdsKow=="} 00594{"flow_id":73,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2785,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":714311,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"KDc3AG3IEBMx8Tl2CABFAACtVx0AAGwRBnk0cvqJwKgBBg2Ww3UAmdF8AQMAfSESpEJ\/K8mw63L1SVFc8SkADwAEcsZLxgANAAQAAAAAAAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHAaHGnagqAUAAYaOUMdiD0+ug9lexVR\/3YR6\/W6KUAAAAAgCIACTIuMC4xLjIxMQAIACDm9keelgh3gAU1t68wEkZCoxEf5LkRAoAG52M5NOQtKg=="} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":25,"flow_first_seen":1587041693828,"flow_last_seen":1587041694047,"flow_tot_l4_data_len":7466,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":298,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":33,"flow_first_seen":1587041693516,"flow_last_seen":1587041695435,"flow_tot_l4_data_len":7582,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":31,"flow_first_seen":1587041693582,"flow_last_seen":1587041694243,"flow_tot_l4_data_len":7530,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":242,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00455{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_first_seen":1587041697660,"flow_last_seen":1587041697673,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":30,"flow_first_seen":1587041693849,"flow_last_seen":1587041697765,"flow_tot_l4_data_len":7994,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":266,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":40,"flow_first_seen":1587041676435,"flow_last_seen":1587041676536,"flow_tot_l4_data_len":13457,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":336,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1300,"flow_first_seen":1587041677243,"flow_last_seen":1587041697130,"flow_tot_l4_data_len":776162,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":597,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":37,"flow_first_seen":1587041682144,"flow_last_seen":1587041685098,"flow_tot_l4_data_len":9810,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":265,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":52,"flow_first_seen":1587041685240,"flow_last_seen":1587041685471,"flow_tot_l4_data_len":31500,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":605,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":25,"flow_first_seen":1587041685984,"flow_last_seen":1587041686156,"flow_tot_l4_data_len":8660,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":346,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":5,"flow_first_seen":1587041695278,"flow_last_seen":1587041696498,"flow_tot_l4_data_len":600,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50016,"dst_port":50005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":29,"flow_first_seen":1587041687745,"flow_last_seen":1587041687963,"flow_tot_l4_data_len":10410,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.169.186.119","src_port":60563,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681744,"flow_tot_l4_data_len":230,"flow_min_l4_data_len":61,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63106,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":5,"flow_first_seen":1587041695278,"flow_last_seen":1587041696498,"flow_tot_l4_data_len":600,"flow_min_l4_data_len":120,"flow_max_l4_data_len":120,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50036,"dst_port":50020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1587041685092,"flow_last_seen":1587041685105,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":69,"flow_max_l4_data_len":127,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65230,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1587041685090,"flow_last_seen":1587041685136,"flow_tot_l4_data_len":228,"flow_min_l4_data_len":53,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":61245,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681754,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":46,"flow_max_l4_data_len":148,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":77,"flow_first_seen":1587041676362,"flow_last_seen":1587041677077,"flow_tot_l4_data_len":62529,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":812,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60532,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":34,"flow_first_seen":1587041677042,"flow_last_seen":1587041677375,"flow_tot_l4_data_len":21202,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":623,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60535,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":26,"flow_first_seen":1587041678029,"flow_last_seen":1587041678303,"flow_tot_l4_data_len":12901,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":496,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60537,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":20,"flow_first_seen":1587041681745,"flow_last_seen":1587041681895,"flow_tot_l4_data_len":8326,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":416,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60538,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":20,"flow_first_seen":1587041681755,"flow_last_seen":1587041681908,"flow_tot_l4_data_len":8282,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":414,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1587041682355,"flow_last_seen":1587041682370,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":59,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":24,"flow_first_seen":1587041682076,"flow_last_seen":1587041682204,"flow_tot_l4_data_len":12988,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":541,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60540,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":22,"flow_first_seen":1587041682077,"flow_last_seen":1587041682212,"flow_tot_l4_data_len":11276,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":512,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":106,"flow_first_seen":1587041682420,"flow_last_seen":1587041683086,"flow_tot_l4_data_len":89754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":846,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.77.33","dst_ip":"192.168.1.6","src_port":443,"dst_port":60543,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":37,"flow_first_seen":1587041682423,"flow_last_seen":1587041692106,"flow_tot_l4_data_len":10500,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":283,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.76.48","dst_ip":"192.168.1.6","src_port":443,"dst_port":60544,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":83,"flow_first_seen":1587041682698,"flow_last_seen":1587041691929,"flow_tot_l4_data_len":16124,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":194,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.58","src_port":60545,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":35,"flow_first_seen":1587041683186,"flow_last_seen":1587041683511,"flow_tot_l4_data_len":11564,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":330,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.88.59","src_port":60547,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":29,"flow_first_seen":1587041683333,"flow_last_seen":1587041683650,"flow_tot_l4_data_len":16494,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":568,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60548,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":24,"flow_first_seen":1587041685106,"flow_last_seen":1587041685981,"flow_tot_l4_data_len":9376,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":390,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.15.45","src_port":60551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":25,"flow_first_seen":1587041685232,"flow_last_seen":1587041685890,"flow_tot_l4_data_len":10437,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":417,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60552,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":31,"flow_first_seen":1587041685248,"flow_last_seen":1587041688035,"flow_tot_l4_data_len":12708,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60555,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":33,"flow_first_seen":1587041686239,"flow_last_seen":1587041686589,"flow_tot_l4_data_len":19902,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":603,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":37,"flow_first_seen":1587041687245,"flow_last_seen":1587041688061,"flow_tot_l4_data_len":23569,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":637,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60561,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":33,"flow_first_seen":1587041691149,"flow_last_seen":1587041691582,"flow_tot_l4_data_len":11237,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":340,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.108.8","src_port":60565,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":24,"flow_first_seen":1587041694219,"flow_last_seen":1587041695993,"flow_tot_l4_data_len":8848,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":368,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":60567,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1587041672419,"flow_last_seen":1587041697427,"flow_tot_l4_data_len":1722,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1587041673094,"flow_last_seen":1587041677380,"flow_tot_l4_data_len":84,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":28,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"149.154.167.91","src_port":58533,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Telegram","breed":"Acceptable","category":"Chat"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1587041673094,"flow_last_seen":1587041677380,"flow_tot_l4_data_len":84,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":28,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"149.154.167.91","src_port":58533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1587041684291,"flow_last_seen":1587041684304,"flow_tot_l4_data_len":226,"flow_min_l4_data_len":46,"flow_max_l4_data_len":180,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":59403,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":54,"flow_first_seen":1587041684306,"flow_last_seen":1587041685465,"flow_tot_l4_data_len":15603,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":288,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"13.107.18.11","src_port":60549,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1587041685243,"flow_last_seen":1587041685256,"flow_tot_l4_data_len":194,"flow_min_l4_data_len":59,"flow_max_l4_data_len":135,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51309,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":20,"flow_first_seen":1587041682809,"flow_last_seen":1587041688190,"flow_tot_l4_data_len":3592,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1258,"flow_avg_l4_data_len":179,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":17,"flow_first_seen":1587041692808,"flow_last_seen":1587041695538,"flow_tot_l4_data_len":4664,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1257,"flow_avg_l4_data_len":274,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1587041683142,"flow_last_seen":1587041683184,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":58,"flow_max_l4_data_len":188,"flow_avg_l4_data_len":123,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_tot_l4_data_len":12691,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1209,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Skype","breed":"Acceptable","category":"VoIP"}} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_tot_l4_data_len":12691,"flow_min_l4_data_len":45,"flow_max_l4_data_len":1209,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1587041682668,"flow_last_seen":1587041682697,"flow_tot_l4_data_len":213,"flow_min_l4_data_len":66,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":4,"flow_first_seen":1587041692528,"flow_last_seen":1587041692578,"flow_tot_l4_data_len":320,"flow_min_l4_data_len":32,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":4,"flow_first_seen":1587041692528,"flow_last_seen":1587041692578,"flow_tot_l4_data_len":320,"flow_min_l4_data_len":32,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1587041682129,"flow_last_seen":1587041682143,"flow_tot_l4_data_len":222,"flow_min_l4_data_len":52,"flow_max_l4_data_len":170,"flow_avg_l4_data_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":37,"flow_first_seen":1587041695305,"flow_last_seen":1587041698021,"flow_tot_l4_data_len":7878,"flow_min_l4_data_len":46,"flow_max_l4_data_len":1222,"flow_avg_l4_data_len":212,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16332,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":8,"flow_first_seen":1587041695305,"flow_last_seen":1587041697619,"flow_tot_l4_data_len":776,"flow_min_l4_data_len":54,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16333,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1587041685091,"flow_last_seen":1587041685104,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":69,"flow_max_l4_data_len":139,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":53678,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1587041690880,"flow_last_seen":1587041690915,"flow_tot_l4_data_len":329,"flow_min_l4_data_len":62,"flow_max_l4_data_len":267,"flow_avg_l4_data_len":164,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63930,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":1587041693517,"flow_last_seen":1587041693530,"flow_tot_l4_data_len":226,"flow_min_l4_data_len":75,"flow_max_l4_data_len":151,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":55765,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":16,"flow_first_seen":1587041682740,"flow_last_seen":1587041682856,"flow_tot_l4_data_len":9564,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":597,"midstream":1,"l3_proto":"ip4","src_ip":"162.125.19.131","dst_ip":"192.168.1.6","src_port":443,"dst_port":60344,"l4_proto":"tcp","ndpi": {"proto":"TLS.Dropbox","breed":"Acceptable","category":"Cloud"}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":16,"flow_first_seen":1587041682740,"flow_last_seen":1587041682856,"flow_tot_l4_data_len":9564,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":597,"midstream":1,"l3_proto":"ip4","src_ip":"162.125.19.131","dst_ip":"192.168.1.6","src_port":443,"dst_port":60344,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_first_seen":1587041679059,"flow_last_seen":1587041680074,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":49,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":64046,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":7,"flow_first_seen":1587041693597,"flow_last_seen":1587041695591,"flow_tot_l4_data_len":1470,"flow_min_l4_data_len":140,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":210,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":3,"flow_first_seen":1587041693515,"flow_last_seen":1587041693640,"flow_tot_l4_data_len":432,"flow_min_l4_data_len":76,"flow_max_l4_data_len":195,"flow_avg_l4_data_len":144,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":2,"flow_first_seen":1587041695422,"flow_last_seen":1587041695432,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":108,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.8","dst_ip":"192.168.1.6","src_port":3479,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":6,"flow_first_seen":1587041693611,"flow_last_seen":1587041697663,"flow_tot_l4_data_len":1001,"flow_min_l4_data_len":76,"flow_max_l4_data_len":222,"flow_avg_l4_data_len":166,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50017,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":9,"flow_first_seen":1587041693654,"flow_last_seen":1587041697713,"flow_tot_l4_data_len":1817,"flow_min_l4_data_len":140,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":201,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":3,"flow_first_seen":1587041693582,"flow_last_seen":1587041693698,"flow_tot_l4_data_len":432,"flow_min_l4_data_len":76,"flow_max_l4_data_len":195,"flow_avg_l4_data_len":144,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":6,"flow_first_seen":1587041693668,"flow_last_seen":1587041697714,"flow_tot_l4_data_len":1001,"flow_min_l4_data_len":76,"flow_max_l4_data_len":222,"flow_avg_l4_data_len":166,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50037,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":2,"flow_first_seen":1587041695421,"flow_last_seen":1587041695433,"flow_tot_l4_data_len":240,"flow_min_l4_data_len":108,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.21","dst_ip":"192.168.1.6","src_port":3480,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1587041687370,"flow_last_seen":1587041687435,"flow_tot_l4_data_len":279,"flow_min_l4_data_len":49,"flow_max_l4_data_len":230,"flow_avg_l4_data_len":139,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":54069,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":25,"flow_first_seen":1587041676612,"flow_last_seen":1587041676808,"flow_tot_l4_data_len":9285,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":371,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.5","src_port":60534,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":27,"flow_first_seen":1587041685251,"flow_last_seen":1587041685681,"flow_tot_l4_data_len":11055,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.7","src_port":60556,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":26,"flow_first_seen":1587041686889,"flow_last_seen":1587041687253,"flow_tot_l4_data_len":11027,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":424,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.67","src_port":60560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1587041680294,"flow_last_seen":1587041680294,"flow_tot_l4_data_len":1230,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1122,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"93.62.150.157","dst_ip":"192.168.1.6","src_port":443,"dst_port":60512,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1587041680294,"flow_last_seen":1587041680294,"flow_tot_l4_data_len":1230,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1122,"flow_avg_l4_data_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"93.62.150.157","dst_ip":"192.168.1.6","src_port":443,"dst_port":60512,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1587041685171,"flow_last_seen":1587041685185,"flow_tot_l4_data_len":246,"flow_min_l4_data_len":44,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":123,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":58457,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":21,"flow_first_seen":1587041690916,"flow_last_seen":1587041691089,"flow_tot_l4_data_len":9656,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":459,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60564,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":21,"flow_first_seen":1587041697061,"flow_last_seen":1587041697244,"flow_tot_l4_data_len":9672,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":460,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60568,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":1587041687731,"flow_last_seen":1587041687745,"flow_tot_l4_data_len":247,"flow_min_l4_data_len":56,"flow_max_l4_data_len":191,"flow_avg_l4_data_len":123,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62735,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1587041681218,"flow_last_seen":1587041681248,"flow_tot_l4_data_len":163,"flow_min_l4_data_len":55,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":56634,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1587041675997,"flow_last_seen":1587041676010,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":59,"flow_max_l4_data_len":75,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60813,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":1587041691075,"flow_last_seen":1587041691148,"flow_tot_l4_data_len":193,"flow_min_l4_data_len":69,"flow_max_l4_data_len":124,"flow_avg_l4_data_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62863,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_first_seen":1587041694221,"flow_last_seen":1587041694234,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":66,"flow_max_l4_data_len":142,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60837,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":32,"flow_first_seen":1587041687436,"flow_last_seen":1587041687725,"flow_tot_l4_data_len":10405,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"104.40.187.151","src_port":60562,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1587041685093,"flow_last_seen":1587041685127,"flow_tot_l4_data_len":243,"flow_min_l4_data_len":61,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":50653,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test"} diff --git a/test/results/teamspeak3.pcap.out b/test/results/teamspeak3.pcap.out index b8268955b..943098850 100644 --- a/test/results/teamspeak3.pcap.out +++ b/test/results/teamspeak3.pcap.out @@ -1,3 +1,4 @@ +00387{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"teamspeak3.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00466{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"teamspeak3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946745680740,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"10.0.0.2","src_port":53187,"dst_port":9987,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"teamspeak3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946745680,"pkt_ts_usec":740311,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"REREREREZmZmZmZmCABFAAA+yVhAAHgRnjQKAAABCgAAAs\/DJwMAKptdVFMzSU5JVDEAZQAAiA3QV2YAX1kW4K3na2EAAAAAAAAAAA=="} 00500{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"teamspeak3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946745680740,"flow_last_seen":0,"flow_tot_l4_data_len":42,"flow_min_l4_data_len":42,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"10.0.0.2","src_port":53187,"dst_port":9987,"l4_proto":"udp","ndpi": {"proto":"TeamSpeak","breed":"Acceptable","category":"VoIP"}} @@ -13,3 +14,5 @@ 00443{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"teamspeak3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946745717,"pkt_ts_usec":152877,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"YDjgxTWgZmZmZmZmCABFAAA+24JAAK8RVQoKAAABCgAAAs\/DJwMAKptdVFMzSU5JVDEAZQAAiA3QV2YAX1kXBU+nh1IAAAAAAAAAAA=="} 00655{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"teamspeak3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946745717,"pkt_ts_usec":152941,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"YDjgxTWgZmZmZmZmCABFAADX24NAAK8RVHAKAAABCgAAAs\/DJwMAw5v2GKGXKYQPUukAAAAAIp10i0Wqe++5nv6tCBm6z0HgFqIrSNf449weIP3Mtxs2f5CVIz4AlysccbJOh2Hx12\/FfvZIUr+CaqJ1NptjWD4c\/54KoGPBsG2TxDXHlEIv0\/gMC2N1sDtT78ZQaJDzVZlIiJ77J6cpv3JiGD+0usMBNzYePKwevp\/qOojGedOx6lkmihZs5dImFMit4tG7yLMrbaiHxknDDM0H2fni\/wB8qDeNKn5ajIuG8cxGCA=="} 00443{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"teamspeak3.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946745717,"pkt_ts_usec":746131,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"REREREREZmZmZmZmCABFAAA+3ANAAK8RVIkKAAABCgAAAs\/DJwMAKptdVFMzSU5JVDEAZQAAiA3QV2YAX1kXBU+nh1MAAAAAAAAAAA=="} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":13,"source":"teamspeak3.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":13,"flow_first_seen":946745680740,"flow_last_seen":946745717746,"flow_tot_l4_data_len":1469,"flow_min_l4_data_len":42,"flow_max_l4_data_len":196,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"10.0.0.2","src_port":53187,"dst_port":9987,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":13,"source":"teamspeak3.pcap","alias":"nDPId-test"} diff --git a/test/results/telegram.pcap.out b/test/results/telegram.pcap.out index 3d042ffa0..0c8f2d230 100644 --- a/test/results/telegram.pcap.out +++ b/test/results/telegram.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"telegram.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00780{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779596,"pkt_ts_usec":451825,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzGJVAAEARYHzAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGANsCwWgAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"} 00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1588779596451,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,3"}} @@ -471,3 +472,45 @@ 00771{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1512,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779653,"pkt_ts_usec":520455,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"pkt":"jP5XIzfkKDc3AG3ICABFAAEy5oIAAP8RUE\/AqAFNwKgBSxTpFOkBHhkOAACEAAAAAAEAAAAED19jb21wYW5pb24tbGluawRfdGNwBWxvY2FsAAAMAAEAABGUABANTHVjYeKAmXMgaU1hY8AMwDIAIYABAAAAeAATAAAAAMAFCkx1Y2FzLWlNYWPAIcAyABCAAQAAEZQAWBZycEJBPTM5OjJBOjg4OkFDOjQxOkFCCnJwVnI9MTUyLjERcnBIST1mOWM0NmM2ZGQwN2QRcnBITj0zYzVkYzVjZTk1NzgRcnBIQT04Y2E4Y2I3MzFjMWMNTHVjYeKAmXMgaU1hYwxfZGV2aWNlLWluZm\/AHAAQAAEAABGUABoObW9kZWw9aU1hYzExLDMKb3N4dmVycz0xN8BUAAGAAQAAAHgABMCoAU0="} 00571{"flow_id":52,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1563,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779654,"pkt_ts_usec":853807,"pkt_caplen":168,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":168,"pkt_l4_len":134,"pkt":"AQBef\/\/6wJrQLWJ0CABFAACa7R8AAAERGlzAqAE17\/\/\/+txAB2wAhjvUTS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANCk1BTjogInNzZHA6ZGlzY292ZXIiDQpNWDogMQ0KU1Q6IHVybjpkaWFsLW11bHRpc2NyZWVuLW9yZzpzZXJ2aWNlOmRpYWw6MQ0KDQoA"} 00814{"flow_id":51,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1564,"source":"telegram.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1588779654,"pkt_ts_usec":853821,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"AQBeAAD7eCjKBfrMCABFAAFTjhBAAAERR6HAqAFF4AAA+xTpFOkBP9DmAACEAAAAAAEAAAADEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAAADAABAAAAeAAvEXNvbm9zNzgyOENBMDVGQUNDEF9zcG90aWZ5LWNvbm5lY3QEX3RjcAVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MQX3Nwb3RpZnktY29ubmVjdARfdGNwBWxvY2FsAAAQgAEAABGUAB0LVkVSU0lPTj0xLjAQQ1BhdGg9L3Nwb3RpZnl6YxFzb25vczc4MjhDQTA1RkFDQxBfc3BvdGlmeS1jb25uZWN0BF90Y3AFbG9jYWwAACGAAQAAAHgAHwAAAAAFeBFzb25vczc4MjhDQTA1RkFDQwVsb2NhbAARc29ub3M3ODI4Q0EwNUZBQ0MFbG9jYWwAAAGAAQAAAHgABMCoAUU="} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1588779629044,"flow_last_seen":1588779629045,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":38,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":5812,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1588779615019,"flow_last_seen":1588779615032,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61120,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":12,"flow_first_seen":1588779596451,"flow_last_seen":1588779651446,"flow_tot_l4_data_len":3444,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":123,"flow_first_seen":1588779616036,"flow_last_seen":1588779620617,"flow_tot_l4_data_len":22264,"flow_min_l4_data_len":40,"flow_max_l4_data_len":264,"flow_avg_l4_data_len":181,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.7","src_port":23174,"dst_port":521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618928,"flow_tot_l4_data_len":1624,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":23174,"dst_port":523,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619034,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":23174,"dst_port":527,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":21,"flow_first_seen":1588779616036,"flow_last_seen":1588779618946,"flow_tot_l4_data_len":1624,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.1","src_port":23174,"dst_port":536,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779619007,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.4","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":20,"flow_first_seen":1588779616036,"flow_last_seen":1588779618748,"flow_tot_l4_data_len":1520,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":23174,"dst_port":538,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1588779619914,"flow_last_seen":1588779619916,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":47127,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_first_seen":1588779611355,"flow_last_seen":1588779611657,"flow_tot_l4_data_len":399,"flow_min_l4_data_len":133,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"239.255.255.250","src_port":57916,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1588779600828,"flow_last_seen":1588779600842,"flow_tot_l4_data_len":116,"flow_min_l4_data_len":50,"flow_max_l4_data_len":66,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":61631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_first_seen":1588779626394,"flow_last_seen":1588779626394,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1588779650652,"flow_last_seen":1588779650666,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":51,"flow_max_l4_data_len":67,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":9,"flow_first_seen":1588779597291,"flow_last_seen":1588779653520,"flow_tot_l4_data_len":2574,"flow_min_l4_data_len":286,"flow_max_l4_data_len":286,"flow_avg_l4_data_len":286,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.75","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":5,"flow_first_seen":1588779647380,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":1595,"flow_min_l4_data_len":319,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":319,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.69","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655297,"flow_tot_l4_data_len":20763,"flow_min_l4_data_len":108,"flow_max_l4_data_len":435,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.75","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":18,"flow_first_seen":1588779596464,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":1460,"flow_min_l4_data_len":53,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":3,"flow_first_seen":1588779639103,"flow_last_seen":1588779650102,"flow_tot_l4_data_len":200,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":28150,"dst_port":59772,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":8,"flow_first_seen":1588779608134,"flow_last_seen":1588779649019,"flow_tot_l4_data_len":384,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1588779637830,"flow_last_seen":1588779640832,"flow_tot_l4_data_len":728,"flow_min_l4_data_len":182,"flow_max_l4_data_len":182,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"239.255.255.250","src_port":52127,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1588779617174,"flow_last_seen":1588779618677,"flow_tot_l4_data_len":144,"flow_min_l4_data_len":56,"flow_max_l4_data_len":88,"flow_avg_l4_data_len":72,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"87.11.205.195","src_port":23174,"dst_port":60723,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":3,"flow_first_seen":1588779634764,"flow_last_seen":1588779634797,"flow_tot_l4_data_len":2752,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":917,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":50822,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1588779628757,"flow_last_seen":1588779628804,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":39,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":49764,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1588779596464,"flow_last_seen":1588779598465,"flow_tot_l4_data_len":268,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":54306,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1588779648840,"flow_last_seen":1588779654853,"flow_tot_l4_data_len":536,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":56384,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651686,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.1","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":298,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_tot_l4_data_len":57280,"flow_min_l4_data_len":40,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":192,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.8","src_port":28150,"dst_port":529,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651659,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.3","src_port":28150,"dst_port":530,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":288,"flow_first_seen":1588779637543,"flow_last_seen":1588779654458,"flow_tot_l4_data_len":59616,"flow_min_l4_data_len":40,"flow_max_l4_data_len":296,"flow_avg_l4_data_len":207,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.8.1","src_port":28150,"dst_port":533,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":25,"flow_first_seen":1588779637543,"flow_last_seen":1588779651680,"flow_tot_l4_data_len":1944,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":77,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.16.3","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":24,"flow_first_seen":1588779637543,"flow_last_seen":1588779651645,"flow_tot_l4_data_len":1840,"flow_min_l4_data_len":40,"flow_max_l4_data_len":104,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"91.108.12.5","src_port":28150,"dst_port":537,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1588779607374,"flow_last_seen":1588779607388,"flow_tot_l4_data_len":216,"flow_min_l4_data_len":41,"flow_max_l4_data_len":175,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":52118,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":5,"flow_first_seen":1588779603292,"flow_last_seen":1588779643386,"flow_tot_l4_data_len":675,"flow_min_l4_data_len":108,"flow_max_l4_data_len":204,"flow_avg_l4_data_len":135,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::18a0:a412:8935:c01b","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1588779647380,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.53","dst_ip":"239.255.255.250","src_port":50698,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":2,"flow_first_seen":1588779650651,"flow_last_seen":1588779650681,"flow_tot_l4_data_len":136,"flow_min_l4_data_len":47,"flow_max_l4_data_len":89,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":58615,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1588779637560,"flow_last_seen":1588779637572,"flow_tot_l4_data_len":151,"flow_min_l4_data_len":49,"flow_max_l4_data_len":102,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.1","src_port":54595,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":301,"flow_first_seen":1588779617174,"flow_last_seen":1588779629315,"flow_tot_l4_data_len":61960,"flow_min_l4_data_len":56,"flow_max_l4_data_len":280,"flow_avg_l4_data_len":205,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"192.168.1.52","src_port":23174,"dst_port":31480,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":3,"flow_first_seen":1588779634762,"flow_last_seen":1588779634795,"flow_tot_l4_data_len":2752,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":917,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.77","dst_ip":"216.58.205.68","src_port":61974,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":120,"flow_first_seen":1588779596708,"flow_last_seen":1588779655298,"flow_tot_l4_data_len":20763,"flow_min_l4_data_len":108,"flow_max_l4_data_len":435,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::4ba:91a:7817:e318","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1566,"source":"telegram.pcap","alias":"nDPId-test"} diff --git a/test/results/teredo.pcap.out b/test/results/teredo.pcap.out index 103f513e0..02e04ce18 100644 --- a/test/results/teredo.pcap.out +++ b/test/results/teredo.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"teredo.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"teredo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1438853615305,"flow_last_seen":0,"flow_tot_l4_data_len":69,"flow_min_l4_data_len":69,"flow_max_l4_data_len":69,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.106","dst_ip":"194.136.28.76","src_port":52513,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00485{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"teredo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1438853615,"pkt_ts_usec":305874,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"bEFqjICJABsXAAEVCABFAABZWboAAH4R6SsKcBBqwogcTM0hDdgARX2HAAEAALEbP+pGqa\/pAGAAAAAACDr\/\/oAAAAAAAAAAAP\/\/\/\/\/\/\/v8CAAAAAAAAAAAAAAAAAAKFAH04AAAAAA=="} 00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"teredo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1438853615305,"flow_last_seen":0,"flow_tot_l4_data_len":69,"flow_min_l4_data_len":69,"flow_max_l4_data_len":69,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.106","dst_ip":"194.136.28.76","src_port":52513,"dst_port":3544,"l4_proto":"udp","ndpi": {"proto":"Teredo","breed":"Acceptable","category":"Network"}} @@ -32,3 +33,9 @@ 00463{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"teredo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1438853651,"pkt_ts_usec":224097,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"bEFqjICJABsXAAEVCABFAABQbEIAAH4R1tMKcBBDwogcTMpkDdgAPJPWYAAAAAAMOhUgAQAAwogcTCDzNZtG+T9GIALCiBxMAAAAAAAAwogcTYAA1cXm4AnCAAAAAA=="} 00486{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"teredo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1438853653,"pkt_ts_usec":349933,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"bEFqjICJABsXAAEVCABFAABZW7oAAH4R5ysKcBBqwogcTM0hDdgARX2HAAEAALEbP+pGqa\/pAGAAAAAACDr\/\/oAAAAAAAAAAAP\/\/\/\/\/\/\/v8CAAAAAAAAAAAAAAAAAAKFAH04AAAAAA=="} 00561{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1438853653,"pkt_ts_usec":403120,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"pkt":"ABsXAAEVbEFqjICJCABFAACJMcgAAHIRHO7CiBxMCnAQag3YzSEAdV9uAAEAALEbP+pGqa\/pAAAAMt5G+T9GYAAAAAAwOv\/+gAAAAAAAAIAA8ic9d+Oz\/oAAAAAAAAAAAP\/\/\/\/\/\/\/oYAZL4AAAAAAAA6mAAAB9ADBEBA\/\/\/\/\/\/\/\/\/\/8AAAAAIAEAAMKIHEwAAAAAAAAAAA=="} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":14,"flow_first_seen":1438853633749,"flow_last_seen":1438853651224,"flow_tot_l4_data_len":828,"flow_min_l4_data_len":48,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.67","dst_ip":"194.136.28.76","src_port":51812,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1438853632713,"flow_last_seen":1438853632766,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":69,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.64","dst_ip":"194.136.28.76","src_port":56154,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1438853619792,"flow_last_seen":1438853619844,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":69,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.89","dst_ip":"194.136.28.76","src_port":60381,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1438853615305,"flow_last_seen":1438853653403,"flow_tot_l4_data_len":372,"flow_min_l4_data_len":69,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.106","dst_ip":"194.136.28.76","src_port":52513,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1438853629357,"flow_last_seen":1438853629411,"flow_tot_l4_data_len":186,"flow_min_l4_data_len":69,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":93,"midstream":0,"l3_proto":"ip4","src_ip":"10.112.16.92","dst_ip":"194.136.28.76","src_port":63448,"dst_port":3544,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":24,"source":"teredo.pcap","alias":"nDPId-test"} diff --git a/test/results/tftp_rrq.pcap.out b/test/results/tftp_rrq.pcap.out index cca09bbf4..7c5779f69 100644 --- a/test/results/tftp_rrq.pcap.out +++ b/test/results/tftp_rrq.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tftp_rrq.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tftp_rrq.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1367411051972,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.253","dst_ip":"192.168.0.10","src_port":50618,"dst_port":69,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00419{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tftp_rrq.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1367411051,"pkt_ts_usec":972852,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AFCN14tDAAu+GJpACABFAAAwAAAAAP8ROWXAqAD9wKgACsW6AEUAHD4gAAFyZmMxMzUwLnR4dABvY3RldAA="} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"tftp_rrq.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1367411052077,"flow_last_seen":0,"flow_tot_l4_data_len":524,"flow_min_l4_data_len":524,"flow_max_l4_data_len":524,"flow_avg_l4_data_len":524,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.10","dst_ip":"192.168.0.253","src_port":3445,"dst_port":50618,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -17,3 +18,7 @@ 01086{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"tftp_rrq.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1367411052,"pkt_ts_usec":104726,"pkt_caplen":558,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":558,"pkt_l4_len":524,"pkt":"AAu+GJpAAFCN14tDCABFAAIgkzAAAIARI0XAqAAKwKgA\/Q11xboCDA\/KAAMAB1RlbG5ldCBQcm90b2NvbAogICBTcGVjaWZpY2F0aW9uIiBbM10uKSAgTm90ZSB0aGF0IGl0IGlzIDggYml0IGFzY2lpLiAgVGhlIHRlcm0KICAgIm5ldGFzY2lpIiB3aWxsIGJlIHVzZWQgdGhyb3VnaG91dCB0aGlzIGRvY3VtZW50IHRvIG1lYW4gdGhpcwogICBwYXJ0aWN1bGFyIHZlcnNpb24gb2YgYXNjaWkuKTsgb2N0ZXQgKFRoaXMgcmVwbGFjZXMgdGhlICJiaW5hcnkiIG1vZGUKICAgb2YgcHJldmlvdXMgdmVyc2lvbnMgb2YgdGhpcyBkb2N1bWVudC4pIHJhdyA4IGJpdCBieXRlczsgbWFpbCwKICAgbmV0YXNjaWkgY2hhcmFjdGVycyBzZW50IHRvIGEgdXNlciByYXRoZXIgdGhhbiBhIGZpbGUuICAoVGhlIG1haWwKICAgbW9kZSBpcyBvYnNvbGV0ZSBhbmQgc2hvdWxkIG5vdCBiZSBpbXBsZW1lbnRlZCBvciB1c2VkLikgIEFkZGl0aW9uYWwKICAgbW9kZXMgY2FuIGJlIGRlZmluZWQgYnkgcGFpcnMgb2YgY29vcGVyYXRpbmcgaG9zdHMuCgogICBSZWZlcmVuY2UgWzRdIChzZWN0aW9uIDQuMikg"} 00417{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"tftp_rrq.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1367411052,"pkt_ts_usec":107183,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":12,"pkt":"AFCN14tDAAu+GJpACABFAAAgAAcAAP8ROW7AqAD9wKgACsW6DXUADKpDAAQABwAAAAAAAAAAAAAAAAAA"} 01085{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"tftp_rrq.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1367411052,"pkt_ts_usec":107258,"pkt_caplen":558,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":558,"pkt_l4_len":524,"pkt":"AAu+GJpAAFCN14tDCABFAAIgkzEAAIARI0TAqAAKwKgA\/Q11xboCDBNwAAMACHNob3VsZCBiZSBjb25zdWx0ZWQgZm9yIGZ1cnRoZXIgdmFsdWFibGUKICAgZGlyZWN0aXZlcyBhbmQgc3VnZ2VzdGlvbnMgb24gVEZUUC4KCjIuIE92ZXJ2aWV3IG9mIHRoZSBQcm90b2NvbAoKICAgQW55IHRyYW5zZmVyIGJlZ2lucyB3aXRoIGEgcmVxdWVzdCB0byByZWFkIG9yIHdyaXRlIGEgZmlsZSwgd2hpY2gKICAgYWxzbyBzZXJ2ZXMgdG8gcmVxdWVzdCBhIGNvbm5lY3Rpb24uICBJZiB0aGUgc2VydmVyIGdyYW50cyB0aGUKICAgcmVxdWVzdCwgdGhlIGNvbm5lY3Rpb24gaXMgb3BlbmVkIGFuZCB0aGUgZmlsZSBpcyBzZW50IGluIGZpeGVkCiAgIGxlbmd0aCBibG9ja3Mgb2YgNTEyIGJ5dGVzLiAgRWFjaCBkYXRhIHBhY2tldCBjb250YWlucyBvbmUgYmxvY2sgb2YKICAgZGF0YSwgYW5kIG11c3QgYmUgYWNrbm93bGVkZ2VkIGJ5IGFuIGFja25vd2xlZGdtZW50IHBhY2tldCBiZWZvcmUgdGhlCiAgIG5leHQgcGFja2V0IGNhbiBiZSBzZW50LiAgQSBkYXRhIHBhY2tldCBvZiBsZXNzIHRoYW4g"} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"tftp_rrq.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":98,"flow_first_seen":1367411052077,"flow_last_seen":1367411052258,"flow_tot_l4_data_len":25775,"flow_min_l4_data_len":12,"flow_max_l4_data_len":524,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.10","dst_ip":"192.168.0.253","src_port":3445,"dst_port":50618,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":99,"source":"tftp_rrq.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1367411051972,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.253","dst_ip":"192.168.0.10","src_port":50618,"dst_port":69,"l4_proto":"udp","ndpi": {"proto":"STUN","breed":"Acceptable","category":"Network"}} +00474{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":99,"source":"tftp_rrq.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1367411051972,"flow_last_seen":0,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.253","dst_ip":"192.168.0.10","src_port":50618,"dst_port":69,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":99,"source":"tftp_rrq.pcap","alias":"nDPId-test"} diff --git a/test/results/tinc.pcap.out b/test/results/tinc.pcap.out index d927b49c9..27fb9e0af 100644 --- a/test/results/tinc.pcap.out +++ b/test/results/tinc.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tinc.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tinc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1495983427717,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.168.27","dst_ip":"185.83.218.112","src_port":59244,"dst_port":55655,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tinc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495983427,"pkt_ts_usec":717971,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABcILL3nACbGCvpSCABFEAA8vEtAAEAGvw6DcqgbuVPacOds2We5l\/9AAAAAAKACchD0JwAAAgQFtAQCCAp3tTETAAAAAAEDAwc="} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"tinc.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1495983427744,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.168.27","dst_ip":"185.83.218.112","src_port":49290,"dst_port":55656,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -66,3 +67,8 @@ 02116{"flow_id":4,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"tinc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495983429,"pkt_ts_usec":93001,"pkt_caplen":1310,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1310,"pkt_l4_len":1276,"pkt":"ABcILL3nACbGCvpSCABFAAUQAABAAEARdouDcqgbuVPacNlo2WgE\/NC1K5DIzsdIHxzc\/dytvhMIhrCvkmp22D1RS8eQoCv0RroWF99\/t8hUHp3OU5w5IhdzP\/JdNSfL0skiJu7GRd8+qCi0BkYy5MK1DqeI0ZIwrnK6o142YEopprAxKvT2gVlZWGDltMms7\/6EqH0yEFVoYFJ7Z2HbqYJfdM4LDDtE5mkXok3kf3ZAUsZ2lEql1MdcUOQpOiqvPZOVQxpP8aBZbEJkAZClr065SN2wu\/i8NXpT30V6tCIwgwWh10U8o9IFP\/1tDhWufRcyb95tpUHMPxZRNDP9L4OZme57n2h+\/JUPQNZSQGSt+1LFkwcCdf2hbitNACXxS+TmW3rhMTqTi4f\/rV6RhKV0GCsAneHDli\/8TvcfL3bEo9OjqcrX1pfDgieBxaQTbp4wKrlQWWkibRJ1Klpes5F+nUsuFWEOnz765Fi1FZfz0rdPVKIVI\/tPs\/SqKOIo8lp7Ju9JpHgnWRl4171pCPvvvVHbn3qlkb6tMPU40QvgbEUN9v741qWewttg0twaP3fm3a3zNxAM3Epis\/w2fDAiDUelXi1vzZr13QCNBCmFkoSZG1dsJMOuXhmDEAqmx17sBY6qSCKaPRUUAr7tam4m\/Drpw73dO+xM+uu0YsbCKTzQPOgMqewBc0tee+PdeSxEO0yiWmMydQ0+b\/AgkLb30iCx1fDuFE\/6bSX1ReR8dI4uZlnnjg+JSpjtrjVjOes81VUa9nwlhjoZNOege+s6RanuO2rek4VxesYuVos1\/D5pAhpFltvJc4W6wjnh7v8LbwbvO8JqdNCRW3YNZVzJKv9YXml+Aqj29Vyxqpd20lMbqoizWco\/MvFHLrYswB4V6A+6hzPdm+rRVPypoqJWDRzwwEZV5TRI6\/NMGzQIxoYrvkAJq9o0bdGtQJYejrzZyxNl9pY7yKtmJbeXsy8t5Vs\/d12jCBnEqp4kZ66RLn334xaOUwW\/lLbQkeeEdEZATa7Jbe2ppgEBYVByd7N1w8kMqd85T3RgFtL\/HhUzx8PEFsAfAE53qzRdl5Kt0fYBHag4UdYch4v9sIlvR+z3uN7AGZ23IsmyYjRlHPbJ5wz1vACwXCgggxOyFntxaUx5BsMW7q3UHHXM2XKlBeCIItaRMF+DKAOJ65btGtNIKG8\/W2YuDZMj+1pX47o\/G4u88iFYX0Qo5x55G3gLhSLdgWL+1I3U8OnwLOCybyNWBJpRjdR5x7RfS2lYHyzrLg8CFwglW0xGrXhXn6KpCa3g4MLnemAc4bX0ogOx1c9Jfwjcn6S+erIt5\/9es2cKnjGffD6mGfgCc4DwJ9F4AvTDn6DjRjsVgzag+JU8JzYXs\/b0evFQ9lh8MqDDlNUumenvzH3pLkT03ZO65SVrQ4bpKAlhNxOL7xK8YZz9pAu1hKjctYYOfCjptSyusTs5ZigqhGUfln1aF5Cuw799f3rD3Z+K9b4tx6FqX3FDII1QVNMV\/moLlM46vopos7H9hrLQBk\/26J24DeWJpS8m+QSZ5hC4dHpadiv2Rr1iNPXgnqsRPb5VV0zGNds3QrJy1oHiPnyeLno+3uvI5U5ocpIN2st6Avk8bj4OxlkP9NjVpj8n+39ITREHaBD2Pmu6baozbSi9zownOtAiZ9EZBKzGmGxODjTID+7Ltge4L6X9s0T\/ox3GDuuRL0WUioH3qt\/SHfCBzUiKaTKdiqg="} 01045{"flow_id":4,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"tinc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495983429,"pkt_ts_usec":93120,"pkt_caplen":526,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":526,"pkt_l4_len":492,"pkt":"ABcILL3nACbGCvpSCABFAAIAAABAAEAReZuDcqgbuVPacNlo2WgB7J62aRDhv5lHZCc70ajhTJHa5jVi1efjSbFWsOD919+OPkOe23wCU\/SRc\/iz14OUCbnWQNvjwGKVLH6ApV++AQZwJOHvLZ8AbeieaoCZOKJ1J3nC6kIVkNErHfR9I4+evq9eRdylqwEVqye8D9E8j6K+I6BRQCJuDqiiFaL\/8HC24C9RLbT7AsGIvIT9aaTc4pX9XpdHUedKRlAcZjkMQlGiZn1rd4ADQnn4rOxP7u3OatTT04QI6e+zLLW29sNlsrV6YGCEi7FZm6vzmisMQnLVfeekLe6wzR3UA0u4rtCg3ZBOF8Wk3bGNIMy8+iwepSJg0N1KqeJRJ0Y0B1dKnbNcErAdukQgssBeoF9UhuQoxd3TuVi4bp7oTFvKnof8bkTw8HLxqckRQ4YHHb23TclrB1hc\/8a27rKJ53l5UoY5t4wYz7EGq+JKP0MYfGzVrz3FTzRHqSj1eaAyQR776gmVMWpxTfF4i\/1tYY+SaVYbfcridlAI1GzlEC1Q6UGxCYosiljcM+mAHS1zJ5jhJTA9uogDQ0K7\/GSRHVaTvI283Gh7GpGqXG8HwVOWTeFwc4IvrZy9nmg3Ck3uzR3TEJMVTuHQ1EWTT+fki0boCyE4Bmvi4Ct9VxQgC2kKLhE0vYYyLEvMvw=="} 01241{"flow_id":4,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"tinc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1495983429,"pkt_ts_usec":93240,"pkt_caplen":670,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":670,"pkt_l4_len":636,"pkt":"ABcILL3nACbGCvpSCABFAAKQAABAAEAReQuDcqgbuVPacNlo2WgCfHXgG5Pnen+JSm0ePn+sTkg7n8QrD3+u+zSxhclrXawOkmKPI5bQdv8gm+E1mLFTfemDp3GzZ9aP3lMufgknIZokx5WVaMn1as2QWkbPVcnUkRAMT80HsUKqp8rklAmrENv9H5ZkeRDvhpVV\/GDdo5praAfFXazwg027M9FdOV9GZ08TX\/KZr4HR8hivoScZJ8N4xCsiEYYBPqYKBQK0A4QXRxATS9KQ2l8bJKxfUPoNI35xL+fV9E3rk2r2IGc048fNTmRPQTAtbIDIgSJj4hLymgZV0a7ppEOQkq\/03efwd5+Sfy\/pbJJ8Nos9ca4TgPSGdo7XTCiigTQfH1Gx8h+QZsf7r6w2mhcsJsxYBOqt8fERE\/KodQZ4bV5oKEYnNm6lNGHl+jZSm3hPSyXbDN8mgWCBDkTPAwepc4r1dJZfPA0kuPa7Ylxw+MBohuEOaqDl2hN7uJSkTdk3a9wL7xkPFn+xBu5jTJI\/EYc9\/typ6KiVjpCgKIk+hNiO2vtca9pYSzpgmZSavhzDbFHWSxJjLerRfI\/wmQaOmhH5tk+aq48UaU1PlxcdxTvlLbr9A93C7cUyHbli4i0W30Qw14WubnbvpCZzi2UCRuONDPsUkW69WsqgZv\/oKADeYT6OsBNUovblOnWv6E8KVOiUv7mO0kB8RL5APFHYNeEEUlRETzv9bBLzsBVeUiiYmis8BNg8NMBLzSRhSWvLOLFuoasg8iGOZxX0FrPgiTEt48UmCEXaKlkbwQjcrZc1oEZbcHx\/aCeSxnsXDsV4GYXioTDmy68q+x1MlrtVibHJ0aNy3HR0X4G7PZuYKN7diHTrKiLVC9nRmw=="} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":317,"source":"tinc.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":27,"flow_first_seen":1495983427744,"flow_last_seen":1495983475109,"flow_tot_l4_data_len":5962,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1059,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.168.27","dst_ip":"185.83.218.112","src_port":49290,"dst_port":55656,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":317,"source":"tinc.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":130,"flow_first_seen":1495983428000,"flow_last_seen":1495983470973,"flow_tot_l4_data_len":165096,"flow_min_l4_data_len":84,"flow_max_l4_data_len":1476,"flow_avg_l4_data_len":1269,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.168.27","dst_ip":"185.83.218.112","src_port":55655,"dst_port":55655,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":317,"source":"tinc.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":134,"flow_first_seen":1495983428043,"flow_last_seen":1495983463866,"flow_tot_l4_data_len":165208,"flow_min_l4_data_len":84,"flow_max_l4_data_len":1476,"flow_avg_l4_data_len":1232,"midstream":0,"l3_proto":"ip4","src_ip":"185.83.218.112","dst_ip":"131.114.168.27","src_port":55656,"dst_port":55656,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":317,"source":"tinc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":26,"flow_first_seen":1495983427717,"flow_last_seen":1495983475073,"flow_tot_l4_data_len":5199,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1059,"flow_avg_l4_data_len":199,"midstream":0,"l3_proto":"ip4","src_ip":"131.114.168.27","dst_ip":"185.83.218.112","src_port":59244,"dst_port":55655,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":317,"source":"tinc.pcap","alias":"nDPId-test"} diff --git a/test/results/tk.pcap.out b/test/results/tk.pcap.out index 53a54ddd7..8772764ce 100644 --- a/test/results/tk.pcap.out +++ b/test/results/tk.pcap.out @@ -1,3 +1,4 @@ +00379{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tk.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00465{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1613939315029,"flow_last_seen":0,"flow_tot_l4_data_len":38,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":51954,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1613939315,"pkt_ts_usec":29133,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA6W4cAAEARmyjAqAGywKgBAcryADUAJu9GCIYBAAABAAAAAAAABXdob2lzA2RvdAJ0awAAAQAB"} 00624{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"tk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1613939315029,"flow_last_seen":0,"flow_tot_l4_data_len":38,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":51954,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"whois.dot.tk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -13,3 +14,7 @@ 00625{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"tk.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1613939315184,"flow_last_seen":0,"flow_tot_l4_data_len":38,"flow_min_l4_data_len":38,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":53820,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"whois.dot.tk","num_queries":0,"num_answers":0,"reply_code":0,"query_type":15,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00508{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1613939315,"pkt_ts_usec":239614,"pkt_caplen":131,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":131,"pkt_l4_len":97,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB1ZXdAADkRV\/3AqAEBwKgBsgA10jwAYQAAmIaBgAABAAAAAQAABXdob2lzA2RvdAJ0awAADwABwBIABgABAAAOEAAvA25zMQNkbnPAFgNzb2EHZnJlZW5vbQNjb20AYBhZHgAAA4QAABwgAAk6gAAAHCA="} 00646{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1613939315184,"flow_last_seen":1613939315239,"flow_tot_l4_data_len":135,"flow_min_l4_data_len":38,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":53820,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"whois.dot.tk","num_queries":1,"num_answers":1,"reply_code":0,"query_type":15,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1613939315127,"flow_last_seen":1613939315183,"flow_tot_l4_data_len":135,"flow_min_l4_data_len":38,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":55591,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1613939315184,"flow_last_seen":1613939315239,"flow_tot_l4_data_len":135,"flow_min_l4_data_len":38,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":53820,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1613939315029,"flow_last_seen":1613939315127,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":38,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.178","dst_ip":"192.168.1.1","src_port":51954,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00121{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"tk.pcap","alias":"nDPId-test"} diff --git a/test/results/tls-esni-fuzzed.pcap.out b/test/results/tls-esni-fuzzed.pcap.out index a96865805..123782d20 100644 --- a/test/results/tls-esni-fuzzed.pcap.out +++ b/test/results/tls-esni-fuzzed.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 01382{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590680386,"pkt_ts_usec":576239,"pkt_caplen":770,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":770,"pkt_l4_len":736,"pkt":"EBMx8Tl2KDc3AG3ICABFAAL0AABAAEAGjOfAqAEMaBuBTcLeAbt3Q5LX\/48DFVAYIACwHgAAFgMBAscBAALDAwOTwM86TEdZaYZx77QiKeLaOUyI6FPS+J3L+0S3MA31OCDtrXy2AkmiC5EC8aXH8NKs5TG5ofTGvlsmIWUcTFlOhgAkEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAMwA5AC8ANQAKAQACVgAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAMwBrAGkAHQAg9C+VXLX0pUAYcvwRMlm2BfjMFL+A2Ha+teHeYm8XszAAFwBBBKhP+5j\/iIqKULsVEv1xkLdgIoxwczB5EVKfTq\/0aLaIOqqUx255GoGIKzaHGdYeWvgG2FTscntynOjMKiH+1xMAKwAJCAMEAwMDAgMBAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAf\/OAW4TAQAdACAoJey8d6KdccaSJO2lCYt20kw0EEYFyldVNE\/b+wVlLQAgHyQSymUyoBaYNvGbjOJlOzPcW4r7yiRdTxErCb+vUsgBJJYkyzxOIwgn94z1v2QNIt6jP8xZjqajLZOZBVhvvpl7nmhmH4lW1IkwcuGd4kzR+4ip9x\/EzAG6tckU\/flqZH1nG16JhZuu6rEiIYaISW303wwyjD1flAsQnOsqJ0PVy+NZQoiiKbjH4viDA+P+GiaonlAB8r2TaJD+948G4F7MBjpovbjBjfrBFM8f7NuL4fwv7ssjFdJ5mNaCsSn9Hj6115hdy9xFKhCCzMA44L9pVw\/vrGvG+5UfibZ5LK2nZAPALOtdzhzm7d0W1ff7a4XSuSSFRI3gCI5CHoPx4osmf747Wa4ElvuEUhPCcdTFrF6efl9qMHJEUwf8zrcwZxBFmZHEDMTcH8MlFUx5dN14A3E5eAVFahmuI+6IR1wd8HaXtmYAHAACQAE="} 00768{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"e5ef852e686954ba9fe060fbfa881e15","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} @@ -7,3 +8,7 @@ 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 01380{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1590680391,"pkt_ts_usec":590254,"pkt_caplen":770,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":770,"pkt_l4_len":736,"pkt":"EBMx8Tl2KDc3AG3ICABFAAL0AABAAEAGxnTAqAEMaBZHxcLpAbsLJg40SW6gUlAYIAANXgAAFgMBAscBAALDAwMJLl9l\/OldUJYbpqd0xOpts3Kv4zg2hroTXcdX9KeB2CBjkfBVUTqX532YPuVZHQd0J5lIK2OZH9nsSRBnWwKDWwAkEwETAxMCwCvAL8ypzKjALMAwwArACcATwBQAMwA5AC8ANQAKAQACVgAXAAD\/AQABAAAKAA4ADAAdABcAGAAZAQABAQALAAIBAAAjAAAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAAMwBrAGkAHQAgsbxhJX9IcnjB7rdgEb2YIBohnnxEhKIToNk1er8CIioAFwBBBLtlLNXLCuP0okhISXwuyj6tgeyLGZ5yaSZ9uT3zAbum2y5l1gYjS6RGBBL9dNcuY2pA4Ze582sOuuo0cAvw2TsAKwAJCAMEAwMDAgMBAA0AGAAWBAMFAwYDCAQIBQgGBAEFAQYBAgMCAQAtAAIBAf\/OAW4TAQAdACCgcq\/jSZGFwhXJHl9nfU84W9RHblecX+XHXi+knd++egAgHyQSymUyoBaYNvGbjOJlOzPcW4r7yiRdTxErCb+vUjmwk2PLEJ57JKeThEiW3dFrbufb5XbXZxYdeC179v7EU6Bakj2Njpvv\/Jfo5WxPGqtwjTPLrxKpdN+3jkm4v5pXmXQY7xTIeDCWHjyEgNKkvyfWHZEc70MAkkqfNhBXSLrthF\/1heQEBlRbs1xtqteJZDPsTf1rb0lyjahdcH23rHhPVaZljcat4wh7Hka7vt+kTz6HVLMaa8+FGdKR02KYBfqCbkN5nqbjMCHPCoPKBXF7APN9aYQZNPW1vyVMZGeIilksOKMAfbO31cu423QrZX+PlzwFC6qBeqVxOTzYpLwLIxJGCnfdBRD0u85D1TvPM05OjHVwJVu9F3FEA\/S2klQ0zWf5b6ngXXAHdoEO61eGscgYik1z+CCLYUuTKEqAk5KVlL4AHAACQAE="} 00820{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"24":"SNI TLS extension was missing"},"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"e5ef852e686954ba9fe060fbfa881e15","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1590680386576,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.27.129.77","src_port":49886,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1590680391590,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.22.71.197","src_port":49897,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1590680387847,"flow_last_seen":0,"flow_tot_l4_data_len":736,"flow_min_l4_data_len":736,"flow_max_l4_data_len":736,"flow_avg_l4_data_len":736,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.12","dst_ip":"104.16.125.175","src_port":49887,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3,"source":"tls-esni-fuzzed.pcap","alias":"nDPId-test"} diff --git a/test/results/tls-rdn-extract.pcap.out b/test/results/tls-rdn-extract.pcap.out index 023174659..dd5c7d106 100644 --- a/test/results/tls-rdn-extract.pcap.out +++ b/test/results/tls-rdn-extract.pcap.out @@ -1,3 +1,4 @@ +00392{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"213.199.149.251","src_port":31337,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00585{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946681200,"pkt_ts_usec":0,"pkt_caplen":181,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":181,"pkt_l4_len":147,"pkt":"ERERERERIiIiIiIiCABFAACnLudAAIAGnZoKAAAB1ceV+3ppAbtkZ4Ye79i2a1AYQCmgXgAAFgMBAHoBAAB2AwEAAAAAM7RDB2u\/HXE+9PsbFMYgy+4A2s6CH4THeQytZwAAGAAvADUABQAKwBPAFMAJwAoAMgA4ABMABAEAADX\/AQABAAAAABMAEQAADmFkczEubXNhZHMubmV0AAUABQEAAAAAAAoABgAEABcAGAALAAIBAA=="} 00731{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":946681200000,"flow_last_seen":0,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":147,"flow_max_l4_data_len":147,"flow_avg_l4_data_len":147,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"213.199.149.251","src_port":31337,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"ads1.msads.net","ja3":"2201d8e006f8f005a6b415f61e677532","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} @@ -8,3 +9,5 @@ 02376{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946681200,"pkt_ts_usec":0,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"ERERERERIiIiIiIiCABFAAXc5UxAADUGLQDVx5X7CgAAAQG7emnv2MeHZGeGnVAQGJhPMQAAiAWJbWaSMKuviDnX1C0Llpx4JK8Aq88JPhOua8Pg4c9gf4tT3ALQ87CGEd69AgMBAAGjggHaMIIB1jASBgNVHRMBAf8ECDAGAQH\/AgEAMB0GA1UdDgQWBBQIQuPbThFm87UIxUDbVXwzRhGDODALBgNVHQ8EBAMCAYYwEgYJKwYBBAGCNxUBBAUCAwgACDAjBgkrBgEEAYI3FQIEFgQUforCnFoyjMJxotlPdXD3qRv2lAUwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwHwYDVR0jBBgwFoAUMyHwy\/6ioESS3vY7M9hfAUuXeF0wgaMGA1UdHwSBmzCBmDCBlaCBkqCBj4Y2aHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvbXN3d3coNSkuY3JshjRodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvbXN3d3coNSkuY3Jshh9odHRwOi8vY29ycHBraS9jcmwvbXN3d3coNSkuY3JsMHkGCCsGAQUFBwEBBG0wazA8BggrBgEFBQcwAoYwaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvbXN3d3coNSkuY3J0MCsGCCsGAQUFBzAChh9odHRwOi8vY29ycHBraS9haWEvbXN3d3coNSkuY3J0MA0GCSqGSIb3DQEBBQUAA4ICAQCPwtFc7xQRdxdjBzxMfGja\/oZK4iDMP7AnPdHirMiLSKbkWfc6Bq19UvH2ZWGWISKuaL4vet6zDPXpxd34ZYJdy2w+DDcRdBUJeFW9JhK71pV007z1dgkqat82xI5W1R8g33+CMNdDq2gii2paxZvQnY0LDFCFfsxagAeLA06\/vV9sVg8FqeJUw6XTUlxfTQvdBfhREgMhb5xsl5gqwcERvL0brvvjV19PHwCe4qRR0\/esCTdYpQkh0XLQssGL203cE9FUWE0rwK36Uxk1sRWoQmS37ccfpXmoDTjUUL\/0Wv8v6b8\/fTjl+yAM1E7gLx1FevsoLzFIb8xuXGhC+urICwEw7BAmQjgjqcMZuNlwGmgsksufc+bM\/zMj7ttetX8FWD9QxRwIGPTrL2KqU\/ehzd7j64IcGmdroUynaHFA0WU7QRicSeNx++tNg5PTR+ZkQsu2NRz7NA6hKPuMoacfAShR5XGUN5zcQVt8fuksI2eUnXPfX0B5o42VMMxTFwi8UIbz\/BAZgfz0Wm7z3KKadXvDrKBR7TK2WN9PjpFTatKqG13mU7iJo56JoeMp4LNs6xrMb1qqwuL2HkUp79bCQ7E7rT4m\/IGXXEj9Ylk0ksn7uaHXQgX7GfZ+MvspNNWHZuUEHcg+EPqmePUefd4aOnh83CpxBqMtbwVVI4uQ7wAFFjCCBRIwggR7oAMCAQICBAcnYgIwDQYJKoZIhvcNAQEFBQAwdTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1c3QgU29sdXRpb25zLCBJbmMuMSMwIQYDVQQDExpHVEUgQ3liZXJUcnVzdCBHbG9iYWwgUm9vdDAeFw0xMDA0MTQxODEyMjZaFw0xODA0MTQxODEyMTRaMCcxJTAjBgNVBAMTHE1pY3Jvc29mdCBJbnRlcm5ldCBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC99M0npUrYkBnbsgp7YKROjw6Yo5x8UHbrs0qMnxiw55rFK4KGCSisERIyJvUZ6vC4Z2jFBv30Ga7ZE6DQgScIpnmcBPVIMi42H6trJuyhQ7SdgLBJA+qCSV8FE8Wgg1\/hKvQEGUt+yNqIvLVdA7x4VqHpf8Vq77b\/HQFZtx9TWl\/G+JFtxX1Dkxg="} 01643{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":946681200,"pkt_ts_usec":0,"pkt_caplen":968,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":968,"pkt_l4_len":934,"pkt":"ERERERERIiIiIiIiCABFAAO65U1AADUGLyHVx5X7CgAAAQG7emnv2M07ZGeGnVAYGJh7iQAAdEXtFbqyfMg6NBQeqmP35dRLyCMrh2mVE5kJFO96ASBOt8ZIQa7JhwEp2cKHOH+2QqTwss4t\/bRMV\/Co1stO+l9d\/bn7CdwWhWTlcZzV8TOXOGcum7wXNgV+EDZ\/fuuYWlscraXnCRB9+Uovs483FdZvuVs33Leff45mfyNc7RJ\/jAfw\/hn5uDRDe7LqhfuMqarf\/ZENLPX7r5eJ8QaKr0n2PC4j9kQWJZER4iPDyoVVSSrIIa99ESaGsChFuofuNhOB1UtHGo7bCfHRlylQFDKZCePywOdTj2v0+hNcPI3uVJkPJ0dOPBLzjxIXRvCJakWztTwMd0UEL72+tZ6YPAU7u0E5hCC8eQTWQs0+iennejdJELTMnyRcI6ZIbvvj1O4hKZPk\/YAaGzpswffr2dRNvvER9qKOQiShT2m10mgUidmfkNgfnhvmbWQlKbY0Q6Rb9Q3rdAZ+n\/Fj3EWnfDqaXGtz2MNYBI6IbxPQ5tDfzcQKDgcCAwEAAaOCAXcwggFzMBIGA1UdEwEB\/wQIMAYBAf8CAQEwWwYDVR0gBFQwUjBIBgkrBgEEAbE+AQAwOzA5BggrBgEFBQcCARYtaHR0cDovL2N5YmVydHJ1c3Qub21uaXJvb3QuY29tL3JlcG9zaXRvcnkuY2ZtMAYGBFUdIAAwDgYDVR0PAQH\/BAQDAgGGMIGJBgNVHSMEgYEwf6F5pHcwdTELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD0dURSBDb3Jwb3JhdGlvbjEnMCUGA1UECxMeR1RFIEN5YmVyVHJ1c3QgU29sdXRpb25zLCBJbmMuMSMwIQYDVQQDExpHVEUgQ3liZXJUcnVzdCBHbG9iYWwgUm9vdIICAaUwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL3d3dy5wdWJsaWMtdHJ1c3QuY29tL2NnaS1iaW4vQ1JMLzIwMTgvY2RwLmNybDAdBgNVHQ4EFgQUMyHwy\/6ioESS3vY7M9hfAUuXeF0wDQYJKoZIhvcNAQEFBQADgYEAK0jzlPtExZNq1k3+tBNOEiYXyrJaqwm5VqRvf1eeZLL15NM172Nly+UsFZzvzvgqxZJkK0k+PDZsvRibZGeXP+1o0BbBEzzyUaBX3iTONatpkE4rDDr5tPGA+m0AeaY6lplOOm5U0KNZbosdlUm7ldh1uOESM6xcJ7vLVXHV+u0WAwEABA4AAAA="} 02965{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":946681200000,"flow_last_seen":946681200000,"flow_tot_l4_data_len":7001,"flow_min_l4_data_len":147,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1166,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"213.199.149.251","src_port":31337,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher","9":"TLS Expired Certificate"},"proto":"TLS.Microsoft","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"ads1.msads.net","server_names":"*.vo.msecnd.net,*.officeapps.live.com,*.msads.net,*.ads2.msads.net,*.stc.s-msn.com,cdn.dc2files.*.livefilestore-int.com,cdn.*.livefilestore.com,*.marketplace.windowsmobile.com,*.marketplace.windowsmobile-int.com,*.marketplace.windowsmobile-perf.com,*.stj.s-msn.com,ajax.microsoft.com,*.microsoft-sbs-domains.com,*.live.net,*.msn.com,*.msn-int.com,*.f1ds.shared.live-int.com,*.f1ds.wlxrs-int.com,*.shared.live-int.com,*.shared.live.com,*.microsoft.com,*.live.com,*.live-int.com,*.wlxrs.com,*.wlxrs-int.com,*.st.s-msn.com,*.stb.s-msn.com,images.moxy.windowsphone-int.com,*.wlxrsu-int.com,images.partner.windowsphone-int.com,images.partner.windowsphone.com,*.jp.msn.com,*.c3scs.jp.msn.com,*.aspnetcdn.com,*.hotmail.com,*.partner-df.windowsphone-int.com,*.s-msn.com,*.live-int.net,*.windowsphone-int.com,*.windowsphone.com,*.partner-pc.windowsphone-int.com,*.manage.microsoft.com","ja3":"2201d8e006f8f005a6b415f61e677532","ja3s":"18e962e106761869a61045bed0e81c2c","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_128_CBC_SHA","issuerDN":"CN=Microsoft Secure Server Authority","issuerDN":"C=US, L=Redmond, O=Microsoft, OU=GFS, CN=*.officeapps.live.com, CN=*.msads.net, CN=*.ads2.msads.net, CN=*.stc.s-msn.com, CN=cdn.dc2files.*.livefilestore-int.com, CN=cdn.*.livefilestore.com, CN=*.marketplace.windowsmobile.com, CN=*.marketplace.windowsmobile-int.com, CN=*.marketplace.windowsmobile-perf.com, CN=*.stj.s-msn.com, CN=ajax.microsoft.com, CN=*.microsoft-sbs-domains.com, CN=*.live.net, CN=*.msn.com, CN=*.msn-int.com, CN=*.f1ds.shared.live-int.com, CN=*.f1ds.wlxrs-int.com, CN=*.shared.live-int.com, CN=*.shared.live.com, CN=*.microsoft.com, CN=*.live.com, CN=*.live-int.com, CN=*.wlxrs.com, CN=*.wlxrs-int.com, CN=*.st.s-msn.com, CN=*.stb.s-msn.com, CN=images.moxy.windowsphone-int.com, CN=*.wlxrsu-int.com, CN=images.partner.windowsphone-int.com, CN=images.partner.windowsphone.com, CN=*.jp.msn.com, CN=*.c3scs.jp.msn.com, CN=*.aspnetcdn.com, CN=*.hotmail.com, CN=*.partner-df.windowsphone-int.com, CN=*.s-msn.com, CN=*.live-int.net, CN=*.windowsphone-int.com, CN=*.windowsphone.com, CN=*.partner-pc.windowsphone-int.com, CN=*.manage.microsoft.com, CN=*.vo.msecnd.net","fingerprint":"FF:BF:9A:69:8F:C8:44:FF:89:F2:61:49:A7:D1:9A:98:DE:32:84:3B"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":6,"source":"tls-rdn-extract.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":946681200000,"flow_last_seen":946681200000,"flow_tot_l4_data_len":7001,"flow_min_l4_data_len":147,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1166,"midstream":1,"l3_proto":"ip4","src_ip":"10.0.0.1","dst_ip":"213.199.149.251","src_port":31337,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":6,"source":"tls-rdn-extract.pcap","alias":"nDPId-test"} diff --git a/test/results/tls_esni_sni_both.pcap.out b/test/results/tls_esni_sni_both.pcap.out index 1c6362086..357d55103 100644 --- a/test/results/tls_esni_sni_both.pcap.out +++ b/test/results/tls_esni_sni_both.pcap.out @@ -1,3 +1,4 @@ +00394{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1595697574192,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":192522,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"LLBdqyO5+P\/CRWqLCABFAABAAABAAEAGYZTAqAEVaBGvVdjMAbsVnUj1AAAAALAC\/\/+ITAAAAgQFtAEDAwYBAQgKRX5W8wAAAAAEAgAA"} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":222665,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"+P\/CRWqLLLBdqyO5CABFAAA0AABAADkGaKBoEa9VwKgBFQG72MxjNlEZFZ1I9oAS\/\/+oqwAAAgQFeAEBBAIBAwMK"} @@ -34,3 +35,6 @@ 00419{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":832925,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAok5VAADkG1RZoEa9VwKgBFQG72NpkmjYD8nDyI1AQAEJ8pgAA"} 00419{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":833514,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAok5ZAADkG1RVoEa9VwKgBFQG72NpkmjYD8nDynFAQAEJ8LQAA"} 02313{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":855003,"pkt_caplen":1445,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1445,"pkt_l4_len":1411,"pkt":"+P\/CRWqLLLBdqyO5CABFAAWXk5dAADkGz6VoEa9VwKgBFQG72NpkmjYD8nDynFAYAELIhwAAFwMDBWplzicVCZkneNntXmzlkgcFPUoR724b66\/4aFGXjza5mmC3zqfD8bM7gil7myUhARY2kw9OHvr9uwzPmTvBHjRsELIrWZwcLZLV99JfhGJTo2AoCcZCgLpYTIgfIUP5yU7xwkkVNn+vj1tSupzP0tmv56auqdA\/UR+KA1PORkvMHA3ya80UFD6NE5E0Bg7xxaZ6cP0Px7YhPWHKZn6s4KxtzuFOOydj9eGw5Kehc\/SnpSlwzmcxdp3iCWueCFDfp29IsYOBx\/gPDnQbEVHXpyd0ziy\/lVYJCR6VM9MRn8QvKeGW3AiZR4yFbraogEKpcTGTh1T55hGtYvibNUKrIBdcIwzGVctVJ9bIWJ8pypthvUjVxU7s9kaKdI+vH\/LIT1Nj\/kTSSAsltH2kDpRkeP78vWQVSTKSa\/NLd7OJuWWyHjfdMVIsulnSNLRm2mLF+DB\/2DgVryJ+Np2bhlT70OQRLbs5mXEare2aozleJtcUPNPTD8weucmD8+PVHdQUdlfUTt3zjzhdzsp82hjYg5yjrJpzTSonmIPTNwOpysWltsa6zXRjk++cCbFk6QUoiZ9+Dn3JJ4O5fc3K59ax2s6cgnpIvwqQkWpV4WdTqyWxjefa498GtVerV7PY\/XzcsCtBEWzDdjlLDmwBobWpGfk3s\/VszXVEAR4rwm7\/\/yu558oAFlDkTgiBSfzj7qp00\/kRFuxfc3L2G05sb7A5RRZ7sr3OJE0pckqzmYOP26SoI1UMKRR\/HW7PxUmEa+3WKEktQ3kYEFQrQwxdy70ku1m7PjlyidteV5MEOUoIILdx75zVIQaHbJcMNE78mY5kgGcqjPjHDKQSdksBlgoV025VzfLuNCoo8kMBGIGzuBryleLJHnPP29XCAqV6gYFw9PiLwC5V9dEcjAnkr4apoDL1NTRE+ca4io6PUqFcpjKEbz1X\/bNC2EPVLRfm9+BFFYjQpR7\/AeuLjJEyVnbvapEltGx1fTnDg5+p\/viBdp9FPrECd5xeMKznZ\/Z5uz7VTMjvpK5c\/6dtLQ6MzoNtDx6U5vKyu03ougGxsI67C96xoB8Ru9mrmEhNLGaZPMo\/MRHGcoWPWdMu4DD4nrPmUrq7hJMKsmFPV3tyhx\/ZUIqLpKeZdTP7ffnHf6G6BjvTfKoi8RXLa3S18CBhnC+bfrYD1d2teesludojFv\/XikOZSDkYBRSTeC1ECOOalXjjIkc2AZd1XaxX\/729CzpGwA0n3hvku6mS9RZ+KQhlhv\/dCRi45nUxoccgJQQaBNSCpC9jU3xQOF+ZEOweldBvTqKcPu+Q2DEH4H0dQIFQWnxk\/DhQY4Via144XNb4Bo+4k8s271yWtexNCD1KfV2TjPrCNb6XVaWfklvPy3BpTSHcfinyRMyVNzQam\/e\/vOZRMuTmWx\/HIjOVWq5Ipi+MMW5i8nd7G12OHiuFMIhjlyt5uSA5H8QXC0aY6O2firVleGCsdkSDTJ0qUe3PMMtHhXoMkY24TtILf\/hZk\/u5Bbn6h7m3wcle8fSJFRbjLGhRfoUeMBRG6KbjmEpDoeCvVvDn3MEI26y4dLEtY6O0uPHIP6TTYInmwFv51IzzmyLwQKuWJnZRAISY4Lq3SAOetGVLBgDL+tlvlCu6krmwzJzE1DgAjIjr4TjX9JKtMSJWDu9ecXMyAkU6c\/sSb9HZq4Loprj4HvS9SCMdbYMyQye3e4YdAWX+KS98qzGBclqf4EZV255jjHhTlQMCf8l4+bN5U8wSPZbVeatya7uJFa7OmqBgpuzwu4unc9EHFcOKqGY5ZFnBjvD449vjrPDMJ3GKlrwyQp4JU+DlPlxYM51pSY5AYewjIEAHGag="} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1595697574192,"flow_last_seen":1595697574326,"flow_tot_l4_data_len":8051,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":402,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1595697597731,"flow_last_seen":1595697597855,"flow_tot_l4_data_len":6556,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":364,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55514,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test"} diff --git a/test/results/tls_long_cert.pcap.out b/test/results/tls_long_cert.pcap.out index 94c5e8040..7a2b5700e 100644 --- a/test/results/tls_long_cert.pcap.out +++ b/test/results/tls_long_cert.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls_long_cert.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls_long_cert.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1553619078033,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.126","dst_ip":"104.111.215.93","src_port":60174,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls_long_cert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1553619078,"pkt_ts_usec":33240,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"BBjWMe9aeDHBvV4kCABFAABAAABAAEAGN8XAqAJ+aG\/XXesOAbssL+yBAAAAALAC\/\/8wZwAAAgQFtAEDAwYBAQgKJK\/ZdwAAAAAEAgAA"} 00441{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"tls_long_cert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1553619078,"pkt_ts_usec":58439,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eDHBvV4kBBjWMe9aCABFAAA8AABAADYGQclob9ddwKgCfgG76w4xmkZeLC\/sgqAScSAcqQAAAgQFtAQCCArQt2rgJK\/ZdwEDAwc="} @@ -17,3 +18,5 @@ 00605{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"tls_long_cert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1553619078,"pkt_ts_usec":96422,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"BBjWMe9aeDHBvV4kCABFAACyAABAAEAGN1PAqAJ+aG\/XXesOAbssL+6HMZpZdIAYCAB8QwAAAQEICiSv2bLQt2sFFgMDAEYQAABCQQRP4nTO7t1gsI+sncz3jLxPpGhLzyoJgYH\/Heat+NBgLeKqEhe7mj2inNwoJCD5LV\/qCPQv+KYPvBQWRUBtB06EFAMDAAEBFgMDACgAAAAAAAAAAA4cTqcj7y\/hvDbKtXE0ElrDaudKH2f2AXwmK1WfLrv\/"} 00563{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"tls_long_cert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1553619078,"pkt_ts_usec":104774,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"BBjWMe9aeDHBvV4kCABFAACRAABAAEAGN3TAqAJ+aG\/XXesOAbssL+8FMZpZdIAYCABWXQAAAQEICiSv2bvQt2sFFwMDAFgAAAAAAAAAAb\/x0RnZJwH8uWLyU9jchZrDqEEG9N2hXfwbnHQL0G\/XqSw4vJO5tvQIFj88Tjie\/WjLQdGBWvdE9B6uhvyryoJCQ\/EEkL8iR\/LrKxkDArPO"} 01566{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"tls_long_cert.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1553619078,"pkt_ts_usec":105197,"pkt_caplen":902,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":902,"pkt_l4_len":868,"pkt":"BBjWMe9aeDHBvV4kCABFAAN4AABAAEAGNI3AqAJ+aG\/XXesOAbssL+9iMZpZdIAYCACgXgAAAQEICiSv2bvQt2sFFwMDAz8AAAAAAAAAAuMmufqqvCfCAgI+Y8ziAqtHnha8l08vk42HEKw5f8DNApnAf8eKGbrx81Mau3Kmxm7mc51VsRf3eP8BKCREjqar62CkMs3353fhMkczdZrTQh04YZgdkMJnSYFA4IiBLU1ncL\/o7W5EdFOmDG80nxc+JX5TM5N8c\/68A8pL7d4\/SXNUhHxe6BYbqz1ca6V0ykfLrkBJfeIMsQX1HGuKEEVBqn4ldYw\/k4Hc7PjMH4SPmr5Eor\/tMJjXaJhp9Bo+WuiHzj+8r+qVGVESvVM5uAiGhFbV\/jTRSXhGemYw82ONxC+6sF137EptS2HXtf2+Q89WVpGM\/UqKRf0xutuxtqQgaj50Bo136z61I3zDp5DgRhPhbx7UmTMY6G3yG4D2C\/6ylHqdx8IwZxbf3txr1TnyZ6t6NEUGLPyRtff+UZinltNjRbDh0OeMHX6qgYfdh+mmJSxUItZc7CDFNjqeoSIK5duKt9Oh\/nL1tHm+ZqKSxfLuhJ3ohEAsQAES3V\/pC3OtgKA5W60oylVTTb5\/i4dxCH820+amYUnuY5nY93oDQifKZRf83pgimFeleqpIkko1q3+6G4oF64xQ2oU7TX41+jdTIt\/wMtO4bo85mmZKePkoS5Dq5W8LtVNMBzUhbMZHJjxK5vanJNtBQOT6Vgc1ts7Z3VUqKIHrbCkw+riLw5taZE7qi+G8+Kh54juPU9m63V5iVXtN6S60y+EkKeVI+nAxw+2qVfFHV7RAnrM8KkXjFxvnUdSPSEFVr\/YGrOy1R8ltnqncOwARaMuX+zBwS\/XV5N8iC8p4uJsKUWh0i9VWtZtQkThVs3QiX362SVnNNPocF0+IQy+zl+fhkUuQ4X5wfhipaWHAKjxCavdUYRgE7LBRhFBQ6y6aBJ+y61PNJdt4N7yU7gydERP1C0+C\/xTDZztQVRZNmNyfILw2mQVuoP8ICAbsjc7MhFI6qu+kcMxy2+L32f+JInMGFsDu\/mOves3MgjcTzzjivlqZ1EBBgY2vFvckrPKwnJNGye6e1H8jhmGRGsrq6Dc5YlcV0qstUWKAnYlX5noGh9TZ0AY7xXAldx5TQ40IiedW1b41+pyOgjQ="} +00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":182,"source":"tls_long_cert.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":182,"flow_first_seen":1553619078033,"flow_last_seen":1553619149372,"flow_tot_l4_data_len":111413,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":612,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.126","dst_ip":"104.111.215.93","src_port":60174,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":182,"source":"tls_long_cert.pcap","alias":"nDPId-test"} diff --git a/test/results/tls_verylong_certificate.pcap.out b/test/results/tls_verylong_certificate.pcap.out index db6abc2d3..5f2e6e7b6 100644 --- a/test/results/tls_verylong_certificate.pcap.out +++ b/test/results/tls_verylong_certificate.pcap.out @@ -1,3 +1,4 @@ +00401{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1578254908457,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.160","dst_ip":"151.101.66.49","src_port":54804,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578254908,"pkt_ts_usec":457751,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGntnAqAGgl2VCMdYUAbur4+BEAAAAALAC\/\/9+XwAAAgQFtAEDAwUBAQgKAb+3BwAAAAAEAgAA"} 00451{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578254908,"pkt_ts_usec":469342,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADYGqN2XZUIxwKgBoAG71hTYdp3Gq+PgRaASauCAYQAAAgQFZAQCCApynbuCAb+3BwEDAwk="} @@ -17,3 +18,5 @@ 00442{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578254908,"pkt_ts_usec":490605,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGnuXAqAGgl2VCMdYUAbur4+JK2Haz+YAQD87xlwAAAQEICgG\/tyVynbuH"} 00615{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578254908,"pkt_ts_usec":501216,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAGnmfAqAGgl2VCMdYUAbur4+JK2Haz+YAYEAAKWAAAAQEICgG\/ty9ynbuHFgMDAEYQAABCQQTH5tGUopjSjWc3V5g8OPm4JB2tlghwqc4c7itepwfZrwFWixAP48WmSW\/oHUg0\/tDllM9KvSI4LF83FbIwkaj5FAMDAAEBFgMDACgAAAAAAAAAAGH0xPBqc1LQH3P3k4+rU181NnTrTx84D0HwPLdrBsFz"} 00513{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1578254908,"pkt_ts_usec":512283,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnJkZAADYGgmyXZUIxwKgBoAG71hTYdrP5q+PiyIAYADhRZgAAAQEICnKdu40Bv7cvFAMDAAEBFgMDACj8bciWxFxco8nBV+vz6uJapqJf1ww4lYVxVlyDlR2X\/\/a25cyE9xS0"} +00510{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":48,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":48,"flow_first_seen":1578254908457,"flow_last_seen":1578254908551,"flow_tot_l4_data_len":20597,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1400,"flow_avg_l4_data_len":429,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.160","dst_ip":"151.101.66.49","src_port":54804,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00144{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":48,"source":"tls_verylong_certificate.pcap","alias":"nDPId-test"} diff --git a/test/results/tor.pcap.out b/test/results/tor.pcap.out index caefb2e41..283b0e75b 100644 --- a/test/results/tor.pcap.out +++ b/test/results/tor.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tor.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00371{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1,"source":"tor.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1383821660,"pkt_ts_usec":212806,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAA\/lQA2EYhACZCQgMAAAAAAIAAUlQAwqwfAAAAAIAAUlQAwqwfgAMAABQAAgAAAAAAAAAAAAAA"} 00150{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":1,"source":"tor.pcap","alias":"nDPId-test","type":38} 00371{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"tor.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1383821662,"pkt_ts_usec":212866,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAA\/lQA2EYhACZCQgMAAAAAAIAAUlQAwqwfAAAAAIAAUlQAwqwfgAMAABQAAgAAAAAAAAAAAAAA"} @@ -464,3 +465,10 @@ 00153{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":3858,"source":"tor.pcap","alias":"nDPId-test","type":38} 00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1383822276,"pkt_ts_usec":211998,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAA\/lQA2EYhACZCQgMAAAAAAIAAUlQAwqwfAAAAAIAAUlQAwqwfgAMAABQAAgAAAAAAAAAAAAAA"} 00153{"basic_event_id":5,"basic_event_name":"Unknown Ethernet packet type","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","type":38} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":38,"flow_first_seen":1383822129897,"flow_last_seen":1383822265221,"flow_tot_l4_data_len":11192,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":294,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.252","dst_ip":"91.143.93.242","src_port":51175,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1383822274144,"flow_last_seen":0,"flow_tot_l4_data_len":152,"flow_min_l4_data_len":152,"flow_max_l4_data_len":152,"flow_avg_l4_data_len":152,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1383822217531,"flow_last_seen":1383822248944,"flow_tot_l4_data_len":582,"flow_min_l4_data_len":97,"flow_max_l4_data_len":97,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c583:1972:5728:7323","dst_ip":"ff02::1:2","src_port":546,"dst_port":547,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":29,"flow_first_seen":1383822190886,"flow_last_seen":1383822265123,"flow_tot_l4_data_len":8633,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":297,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.252","dst_ip":"62.210.137.230","src_port":51185,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":32,"flow_first_seen":1383822129889,"flow_last_seen":1383822265160,"flow_tot_l4_data_len":9301,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":290,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.252","dst_ip":"212.83.155.250","src_port":51174,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1826,"flow_first_seen":1383822130889,"flow_last_seen":1383822265215,"flow_tot_l4_data_len":1448416,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":793,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.252","dst_ip":"38.229.70.53","src_port":51176,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":3859,"source":"tor.pcap","alias":"nDPId-test"} diff --git a/test/results/trickbot.pcap.out b/test/results/trickbot.pcap.out index d09f8a3b4..a1b64bda3 100644 --- a/test/results/trickbot.pcap.out +++ b/test/results/trickbot.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"trickbot.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"trickbot.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1609266107551,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.29.101","dst_ip":"82.118.225.196","src_port":61318,"dst_port":7080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"trickbot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609266107,"pkt_ts_usec":551500,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"IOUqtpPxAAgCHEeuCABFAAA0c9FAAIAGK0cKDB1lUnbhxO+GG6gSdtdWAAAAAIAC\/\/8eaQAAAgQFtAEDAwgBAQQC"} 00415{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"trickbot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609266107,"pkt_ts_usec":797175,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"pkt":"AAgCHEeuIOUqtpPxCABFAAAsYEQAAIAGftxSduHECgwdZRuo74Zi7VJcEnbXV2AS+vCXMwAAAgQFtA=="} @@ -16,3 +17,5 @@ 02158{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"trickbot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609266109,"pkt_ts_usec":211419,"pkt_caplen":1337,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1337,"pkt_l4_len":1303,"pkt":"AAgCHEeuIOUqtpPxCABFAAUrYEsAAIAGedZSduHECgwdZRuo74Zi7WKtEnbcVFAY+vD7bAAAawe5rQdB18cRNYwP9H12ICqsTdYSAXHsJb3kVdaHDZmteN+FhZcKiwd0uGSY2Ln2tNhGYI\/W3sbikFe0sqfREPsx6ZgTbH6JLQpFVzLYhqoMFoo7TPYBMrcOPqfPsi\/6JuRDpI9yxkUD+iGOu6vRgPjgdPrp4vCQB1cVfELTzyTp76Sy\/yOuP58LajXVZsDb9xuu5hJ4iPWLX0AMQGCaHHoEtWqDMkQ9IWtWHPoHl2uL62Zcxsv2ewXM2a7eGXQQHLVtG23DKp8b2iMTb3KqK4jfTUzCPZbu0P6DbPhkanxWKtAsM+wExQVVaLstVJ9vs3p0T0USqZUr6NkyTxc+I8zFpsiGNegFljxO3WxMytBberzkI1HZdCUn0d\/Wq+xEnSjl7MiXAHWfpNaCKX3SKazOzNKAeIRh+hn9Tcp9Fz\/lRt3iG36YbiZm+aiqPwGeWuXmFbwk6sQFBS\/KY0q6o508hZJOfxTEdCBJywjSlBbTBn2KlO7c1iDlLFLzI5y1CADqMsqBJjFwz2JDuESyvaipEJgchjHyIcSOI51FJHzrEY3bTrEhFcvistP8ijiS6Ddrm0qw4lO5zxezmPnzEi2pkwp+zOyYSGoJP7p7Q3HXlXbHo4kTVrNzPHer43ytGV5NZcpBAa+7wJDgys72yjxRCA3jHzMYsVNRer8bjAyp3bToVFEYlhq4loljXQTJmkzl9Mhkwv11m+3irGy0HIam5ZohkUNho8K4fpubpqemAb5HqF4D+x3+zDYfBJt5n1eCKv8R5wK10cGRalYA\/dQy2R33\/jpVV4SPgu6fsvK05EYGgkBkHwlaXojbj\/SC4Zr3g5XTJVKAT51\/ovKfWC3oAyftKTJgc9TNVwpVXWGHCWhvDbnxH0cHUxDKtGe+Pax\/q20BdePl5SmZ2igjyaG\/e0nlC3oirk+eE+Xq+iGp4Ww1Ud2AgkhL59lKMFZjhpqQfhrwWCNmtdCDeiBuygGfDkZCmPc5FMtFhq57rVa2AJddnBCwlGtDMquxkYWB1O2LMg4XocsKYxT2XDLZ7usm0N4xtZAcu+eY9qQXbIXg1RIe168AU3u398rdWoExKGL\/B6RWQGfO2kHCWdMu2hDqjFlL85FPbXaGaQJLUBES8CmxT3++M4kIsDT1OQzdoaypaAijsi6UhL9Zs5OW\/6RB\/mf0cojWV8D52lO9l33qYCbtSPK6rNdJgvFWHzkne2NKphN49\/o4xMtbuj4H8KR\/HdME2HhizqBJtVphLx+J6Sr4lVZo7QcJ+9EDk1aFlh0FlrT7pTIMmQYqKAMIKBFB9ZnzERlD8\/Qc0cH97Tbu3hSpGyQttu\/Zo9i6ecgtUE4lI0D\/GtrWyw6x4PSh0Yggmv\/KjRXBuc2huhw9y1+B4w1B\/A7z02klinrbZh6VekIcTq+uJsYOJi1XHIAX4D2DNMzkZ8wMa6ayxBrPZMq+V3Zv1j3\/AcCsigUfR\/DkLmzkEBrahjuEaR9yZkYHt8YuwYqYF\/Z0bqdOwDsKiYyz\/VN5VInCFM089BDi8prytU2EUU5Y3VFqUqM+6BajAYDuSLFe+Sx9jKFpZbyafVj3Q7\/Xm1FpBXspidAQZDus8qnHJFlDp5l6xrHCr4itKZ72iDdWR1FSth9hv9b2LQWKn\/3nfrqNJv\/Wqq+P5cFBv0o3cG+0Ad\/eQhXM2l3yqzXnGG\/1794F8Ae3wSGS46FYePo="} 00411{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"trickbot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609266109,"pkt_ts_usec":211610,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"IOUqtpPxAAgCHEeuCABFAAAoc9dAAIAGK00KDB1lUnbhxO+GG6gSdtxUYu1nsFAQ\/\/+PkQAA"} 02403{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"trickbot.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1609266109,"pkt_ts_usec":508985,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AAgCHEeuIOUqtpPxCABFAAXcYE0AAIAGeSNSduHECgwdZRuo74Zi7WewEnbcVFAQ+vCZ3wAAKxkPv0AaA6ZGcQjAFPG1i3bFgP7usmIhGBKyiXvC+9Coca73cem7oBgmT\/W0abVcwBTLNBjxNKVWAHQ4nygPFvB01N+NUYOWTHfT9BmVMGJLX68WbXxyyW4BWXsrgNax7AkOcb9M8cpE2wfv+Syw1p2\/3b19rXRJhamDlMt7QQCyVLj7MG\/gmo5aA\/RMLoovC\/cnwNKc4yHWMQ\/spJ5AqgmiozWq7NpbcFXR6FeOs+bFx5vY3zBfokCkV7h0fwMLoGubeAdlxHIF5vqz3WZYoyRDF7MGVkzLVX8n1NghN6XolPvX75Zwox0rUZVWSJD3XhMVU\/E\/IXpndmjItwgKgMdfrMlo+LZ0tGMMAhYMSZnC\/5MVT+VB0pLkzr753cFidiyQesvEx26Uvpw7amSYI\/k\/eHnCs5V3pkgxmyEXlj3AaE7IhPh\/3ZGl0pWRqBWT2FCvfC210NkKOsPoWKdErIZZ+dDtfUiIXGC3JCByN8o2TVtDdsHUiik7FsKEcX5TMyGJKXFAQP1XFBEIGgYKdeY3ED2tmOdYYGrBzKy+koAAgJXqZ0q1h3iFh2RrGL4tysay2MTGZiGDjF8hRpd1O8\/s7glx+VWCUa4f29+nbunC9+eh1djoeE0yYlUf25swEQHzTdM86HExsD\/znUfBQ30i4lz5F8omVaNwZC+\/HNRWFKu7g0r6kJ3fFg9yxqQtFbPbu+KXEH02jlKE6Qr0T9X36ZNG0cRuEBIpLRknN6Zp8ugd2Ga6hIlICjGA99gCumhWqU3FJJ66wIr1+Kcsh6XBUk9HqOE5Wyu9siM4gDySlCu+oXAg6\/xgSilX2mbXQU0rt0fCyrLrLm9hFcn6arcSqN4LyIv3Zgb5GNOqlS7VHIkzRnGRgCTwe8EvCWN\/v6EgXDQ1DHFrzgusR+nvjBfCcC83mpGRb9TLQ1zYJr\/u\/abfVw80vOeM2ZWp3Cb+l5i24AZF5ytjOsJAmq6oXHwznGBDGbyOTVWDiUZNU6TsmZulUQs5tMVAgpChF\/7E+gHoeWinkxc\/a0VOUmEEPH06pjPsiIOmd\/9apUwMV\/l+wKmptaS+LQMLHbNj2VaNPPwzXvR9k3Y0x7ZELJzo41B8VLjajkegyhOiGz47IFUHiZThn4UvYBnnsWYBZIeajBkbS1QREMxuZVz6Vm5Pp+K9t5nY+SimaScNl9WLDmHOAOtW4n9FH4zlN8z9D0F\/a1maWmRHFJN4Kt5Mu+r\/FrWazx3ECmYB80\/Xuj7cHSofm8Uk0wACYiSd9+vUkmYel7uV9c85NwAxkVazfPvCgLQL\/U4Ldoc2Qxz1\/54oE3uRFk9h\/V7WvtguMFm4LPPB9TlhO\/LXtUXVYqp91zHP36CgItPdmRLyg96LS3eyGGWomV0QNG4Zyf\/H0Gfyik4d25JvDgixmtOeK+EjU3ob07I3+xY7wSO3QELs3tUX2O5F\/8mKYxURnBDle9ZCs1xR7LffyD3IhzxsGl0pIAddsfcwzjb2G1pUPNdQ5kMBAD+gxPZWVJaN\/jzh4Zjx0Lte9IS+nTCfaHYkIJXpnIKYnipEOH5Flsd7+vohDpige+YQHRZVG2LlzghLfY0gBkuppDdOhrgA5HYnUxu9FNWVkOumFlvD5W+DkRvWL\/r6ouDQB1CyE9ybFYTUoAyiclYov9WWv5JLWLTcc5oqDZRMUnk8LMnIcEEGSTbaq7GhpzepcUz6IA1KsLUj+rvvww1hoe3HUUDZgZsWwKM3jL756Ht\/OrdOVuxtL2xBIgpeu7dcLIdPrmQDbN6GAUQagfSDS0vFfbfF06tAOI2B3G36NuxPUeQdJU8QBCY12yiab\/DH\/AX6bHTMRxzY8yktz2iRCVkcb7CEdvUZY\/ZpHqZJF\/AX5PWXS\/jzQLmWyemVvh0PBn0HowzcWrkaDlMqPQ+aaxgwq8idVQc8LQM3F5G2OgOALbU="} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":74,"source":"trickbot.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":74,"flow_first_seen":1609266107551,"flow_last_seen":1609266115947,"flow_tot_l4_data_len":59486,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":803,"midstream":0,"l3_proto":"ip4","src_ip":"10.12.29.101","dst_ip":"82.118.225.196","src_port":61318,"dst_port":7080,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":74,"source":"trickbot.pcap","alias":"nDPId-test"} diff --git a/test/results/tumblr.pcap.out b/test/results/tumblr.pcap.out index ce5b9de2e..3a1881249 100644 --- a/test/results/tumblr.pcap.out +++ b/test/results/tumblr.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tumblr.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00503{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1605292102219,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56592,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tumblr.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605292102,"pkt_ts_usec":219041,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gCcfOACAGQCoBywEgSYsHmR3shSjf9ikAZP+bAAAAAAAAAACXZXmM3RABu9uJhiq5D+6LgBAB9a70AAABAQgKqXs\/nsLc288="} 00503{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1605292102602,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -395,3 +396,81 @@ 00514{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":24733,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1605292122874,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24733,"source":"tumblr.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605292122,"pkt_ts_usec":874816,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"qtsDr8lk5EKm5WPyht1gDJQ7ACAGQCoBywEgSYsHmR3shSjf9ikqABRQQAcICgAAAAAAACAKnP4Bu4CgSN\/gvLosgBAB9qrlAAABAQgK1OQQnsLdMvM="} 00457{"flow_id":48,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1605292122,"pkt_ts_usec":899206,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"5EKm5WPyqtsDr8lkht1gAAAAACAGPSoAFFBABwgKAAAAAAAAIAoqAcsBIEmLB5kd7IUo3\/YpAbuc\/uC8uiyAoEjggBALQrp6AAABAQgKwt3jAtThR68="} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1605292118714,"flow_last_seen":1605292118786,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:811::2004","src_port":48988,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1605292118714,"flow_last_seen":1605292118786,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:811::2004","src_port":48988,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120853,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:811::2004","src_port":49002,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120853,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:811::2004","src_port":49002,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00560{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1605292103804,"flow_last_seen":1605292104013,"flow_tot_l4_data_len":1490,"flow_min_l4_data_len":32,"flow_max_l4_data_len":696,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2620:116:800d:21:8c6e:cf2c:8d6:9fb5","src_port":41266,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00541{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1605292103804,"flow_last_seen":1605292104013,"flow_tot_l4_data_len":1490,"flow_min_l4_data_len":32,"flow_max_l4_data_len":696,"flow_avg_l4_data_len":165,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2620:116:800d:21:8c6e:cf2c:8d6:9fb5","src_port":41266,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00547{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":75,"flow_first_seen":1605292122076,"flow_last_seen":1605292122470,"flow_tot_l4_data_len":37634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":501,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00528{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":75,"flow_first_seen":1605292122076,"flow_last_seen":1605292122470,"flow_tot_l4_data_len":37634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1080,"flow_avg_l4_data_len":501,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:789d","src_port":48240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1605292114506,"flow_last_seen":1605292114736,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1605292114506,"flow_last_seen":1605292114736,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1605292108746,"flow_last_seen":1605292108796,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56564,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1605292108746,"flow_last_seen":1605292108796,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56564,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1605292108747,"flow_last_seen":1605292108805,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56578,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1605292108747,"flow_last_seen":1605292108805,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56578,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1605292108746,"flow_last_seen":1605292108789,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1605292108746,"flow_last_seen":1605292108789,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56582,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1605292102219,"flow_last_seen":1605292102653,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56592,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1605292102219,"flow_last_seen":1605292102653,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56592,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1605292108747,"flow_last_seen":1605292108796,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56594,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1605292108747,"flow_last_seen":1605292108796,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56594,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00531{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":31,"flow_first_seen":1605292105433,"flow_last_seen":1605292106000,"flow_tot_l4_data_len":8259,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":266,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2001:4998:14:800::1001","src_port":47118,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":13,"flow_first_seen":1605292121674,"flow_last_seen":1605292122517,"flow_tot_l4_data_len":823,"flow_min_l4_data_len":32,"flow_max_l4_data_len":149,"flow_avg_l4_data_len":63,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:817::200a","src_port":55560,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00530{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":13,"flow_first_seen":1605292121674,"flow_last_seen":1605292122517,"flow_tot_l4_data_len":823,"flow_min_l4_data_len":32,"flow_max_l4_data_len":149,"flow_avg_l4_data_len":63,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:817::200a","src_port":55560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1605292102603,"flow_last_seen":1605292102678,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56640,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1605292102603,"flow_last_seen":1605292102678,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::9765:798c","src_port":56640,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:809::200e","src_port":49462,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:809::200e","src_port":49462,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:809::200e","src_port":49464,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:809::200e","src_port":49464,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":49496,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":49496,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":49546,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2003","src_port":49546,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00535{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":107,"flow_first_seen":1605292122064,"flow_last_seen":1605292122440,"flow_tot_l4_data_len":79659,"flow_min_l4_data_len":32,"flow_max_l4_data_len":6072,"flow_avg_l4_data_len":744,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:809::200e","src_port":49548,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":10,"flow_first_seen":1605292104650,"flow_last_seen":1605292122733,"flow_tot_l4_data_len":762,"flow_min_l4_data_len":32,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":76,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::68f4:2ac8","src_port":56782,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00523{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":10,"flow_first_seen":1605292104650,"flow_last_seen":1605292122733,"flow_tot_l4_data_len":762,"flow_min_l4_data_len":32,"flow_max_l4_data_len":319,"flow_avg_l4_data_len":76,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::68f4:2ac8","src_port":56782,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1605292119370,"flow_last_seen":1605292119458,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::200e","src_port":57770,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":2,"flow_first_seen":1605292119370,"flow_last_seen":1605292119458,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::200e","src_port":57770,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::200e","src_port":57788,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::200e","src_port":57788,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00532{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1671,"flow_first_seen":1605292108895,"flow_last_seen":1605292115212,"flow_tot_l4_data_len":1089230,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2458,"flow_avg_l4_data_len":651,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::c000:4d03","src_port":56842,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1605292122698,"flow_last_seen":1605292122741,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::4a72:9a15","src_port":42674,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":2,"flow_first_seen":1605292122698,"flow_last_seen":1605292122741,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::4a72:9a15","src_port":42674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200e","src_port":45706,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200e","src_port":45706,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120839,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::200e","src_port":58004,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120839,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:808::200e","src_port":58004,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1605292118602,"flow_last_seen":1605292118777,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::d83a:d582","src_port":50906,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00521{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":2,"flow_first_seen":1605292118602,"flow_last_seen":1605292118777,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::d83a:d582","src_port":50906,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":9,"flow_first_seen":1605292103804,"flow_last_seen":1605292104007,"flow_tot_l4_data_len":1576,"flow_min_l4_data_len":32,"flow_max_l4_data_len":676,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::8fcc:d927","src_port":57286,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00524{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":9,"flow_first_seen":1605292103804,"flow_last_seen":1605292104007,"flow_tot_l4_data_len":1576,"flow_min_l4_data_len":32,"flow_max_l4_data_len":676,"flow_avg_l4_data_len":175,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::8fcc:d927","src_port":57286,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00547{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":50,"flow_first_seen":1605292105197,"flow_last_seen":1605292105378,"flow_tot_l4_data_len":21326,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1240,"flow_avg_l4_data_len":426,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2606:2800:135:155a:23ba:b2a:25ff:122d","src_port":58380,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00542{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":12,"flow_first_seen":1605292105274,"flow_last_seen":1605292105347,"flow_tot_l4_data_len":980,"flow_min_l4_data_len":20,"flow_max_l4_data_len":549,"flow_avg_l4_data_len":81,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2606:2800:135:155a:23ba:b2a:25ff:122d","src_port":58382,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2002","src_port":35892,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:815::2002","src_port":35892,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2003","src_port":44164,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2003","src_port":44164,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":35,"flow_first_seen":1605292105418,"flow_last_seen":1605292122864,"flow_tot_l4_data_len":10299,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1311,"flow_avg_l4_data_len":294,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::6006:749","src_port":39152,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":19,"flow_first_seen":1605292122674,"flow_last_seen":1605292122861,"flow_tot_l4_data_len":3907,"flow_min_l4_data_len":32,"flow_max_l4_data_len":652,"flow_avg_l4_data_len":205,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::6006:749","src_port":39164,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58614,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58614,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58616,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58616,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58618,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::200e","src_port":58618,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1605292122874,"flow_last_seen":1605292122899,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40190,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1605292122874,"flow_last_seen":1605292122899,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80a::200a","src_port":40190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00528{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":62,"flow_first_seen":1605292121486,"flow_last_seen":1605292122503,"flow_tot_l4_data_len":26052,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1432,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::4a72:9a16","src_port":43328,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::df9:21c6","src_port":43602,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::df9:21c6","src_port":43602,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":28,"flow_first_seen":1605292105726,"flow_last_seen":1605292122804,"flow_tot_l4_data_len":2267,"flow_min_l4_data_len":32,"flow_max_l4_data_len":189,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::c000:4c03","src_port":51874,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00525{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":28,"flow_first_seen":1605292105726,"flow_last_seen":1605292122804,"flow_tot_l4_data_len":2267,"flow_min_l4_data_len":32,"flow_max_l4_data_len":189,"flow_avg_l4_data_len":80,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"64:ff9b::c000:4c03","src_port":51874,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00534{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":63,"flow_first_seen":1605292122095,"flow_last_seen":1605292122344,"flow_tot_l4_data_len":41578,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3173,"flow_avg_l4_data_len":659,"midstream":0,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:80b::200a","src_port":38608,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120853,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":55014,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1605292120654,"flow_last_seen":1605292120853,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:806::200e","src_port":55014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2002","src_port":50960,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00527{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1605292116554,"flow_last_seen":1605292116783,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip6","src_ip":"2a01:cb01:2049:8b07:991d:ec85:28df:f629","dst_ip":"2a00:1450:4007:805::2002","src_port":50960,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":24745,"source":"tumblr.pcap","alias":"nDPId-test"} diff --git a/test/results/ubntac2.pcap.out b/test/results/ubntac2.pcap.out index def83176c..50fe95fcd 100644 --- a/test/results/ubntac2.pcap.out +++ b/test/results/ubntac2.pcap.out @@ -1,3 +1,4 @@ +00384{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"ubntac2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"ubntac2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1486943433175,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"255.255.255.255","src_port":34085,"dst_port":10001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00642{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"ubntac2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486943433,"pkt_ts_usec":175002,"pkt_caplen":217,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":217,"pkt_l4_len":183,"pkt":"\/\/\/\/\/\/\/\/gCqojWksCABFAADLv4FAAEARuPfAqAEB\/\/\/\/\/4UlJxEAtx2vAgYAqwIACoAqqI1pK8CoAhUCAAqAKqiNaSzAqAEBAQAGgCqojWkrCgAEAADeYAsABHVibnQMAARVR1czAwA4VW5pRmlTZWN1cml0eUdhdGV3YXkuRVItZTEyMC52NC4zLjMzLjQ5MzYwODYuMTYxMjAzLjIwMzEWAA40LjMuMzMuNDkzNjA4NhUABFVHVzMXAAEAGAABABMABoAqqI1pKxIABAAAFc8bAAU0LjAuMA=="} 00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"ubntac2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1486943433175,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"255.255.255.255","src_port":34085,"dst_port":10001,"l4_proto":"udp","ndpi": {"proto":"UBNTAC2","breed":"Safe","category":"Network"},"ubntac2": {"version":"UniFiSecurityGateway.ER-e120.v4"}} @@ -29,3 +30,5 @@ 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"ubntac2.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1486943504301,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"255.255.255.255","src_port":42838,"dst_port":10001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00643{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"ubntac2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1486943504,"pkt_ts_usec":301123,"pkt_caplen":217,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":217,"pkt_l4_len":183,"pkt":"\/\/\/\/\/\/\/\/gCqojWksCABFAADLv4hAAEARuPDAqAEB\/\/\/\/\/6dWJxEAt\/Q2AgYAqwIACoAqqI1pK8CoAhUCAAqAKqiNaSzAqAEBAQAGgCqojWkrCgAEAADepwsABHVibnQMAARVR1czAwA4VW5pRmlTZWN1cml0eUdhdGV3YXkuRVItZTEyMC52NC4zLjMzLjQ5MzYwODYuMTYxMjAzLjIwMzEWAA40LjMuMzMuNDkzNjA4NhUABFVHVzMXAAEAGAABABMABoAqqI1pKxIABAAAFdYbAAU0LjAuMA=="} 00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"ubntac2.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1486943504301,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"255.255.255.255","src_port":42838,"dst_port":10001,"l4_proto":"udp","ndpi": {"proto":"UBNTAC2","breed":"Safe","category":"Network"},"ubntac2": {"version":"UniFiSecurityGateway.ER-e120.v4"}} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":8,"source":"ubntac2.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1486943504301,"flow_last_seen":0,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":183,"flow_max_l4_data_len":183,"flow_avg_l4_data_len":183,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"255.255.255.255","src_port":42838,"dst_port":10001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":8,"source":"ubntac2.pcap","alias":"nDPId-test"} diff --git a/test/results/upnp.pcap.out b/test/results/upnp.pcap.out index 0c2cd66dc..b9eb8b969 100644 --- a/test/results/upnp.pcap.out +++ b/test/results/upnp.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"upnp.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1541515314826,"flow_last_seen":0,"flow_tot_l4_data_len":664,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01297{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"upnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1541515314,"pkt_ts_usec":826314,"pkt_caplen":718,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":718,"pkt_l4_len":664,"pkt":"MzMAAAAMGNvyL6AYht1gDeGUApgRAf6AAAAAAAAANEE9JG0wqAf\/AgAAAAAAAAAAAAAAAAAM5jQOdgKYg108P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUmVzb2x2ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozZjQyZGM5YS0yNGNlLTQ4ZDEtODhmOS0xNmI5NmExMzdkNzE8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UmVzb2x2ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDplMzI0ODAwMC04MGNlLTExZGItODAwMC0wMDFiYTk5ZWM5NTY8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOlJlc29sdmU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1541515314827,"flow_last_seen":0,"flow_tot_l4_data_len":664,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -14,3 +15,8 @@ 01272{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"upnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1541515319,"pkt_ts_usec":474552,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"AQBef\/\/6GNvyL6AYCABFAAKsCtsAAAERvoHAqD1C7\/\/\/+uYzDnYCmBmmPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L1Jlc29sdmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6M2Y0MmRjOWEtMjRjZS00OGQxLTg4ZjktMTZiOTZhMTM3ZDcxPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlJlc29sdmU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6ZTMyNDgwMDAtODBjZS0xMWRiLTgwMDAtMDAxYmE5OWVjOTU2PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpSZXNvbHZlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} 01298{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"upnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1541515320,"pkt_ts_usec":458778,"pkt_caplen":718,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":718,"pkt_l4_len":664,"pkt":"MzMAAAAMGNvyL6AYht1gDeGUApgRAf6AAAAAAAAANEE9JG0wqAf\/AgAAAAAAAAAAAAAAAAAM5jQOdgKYg108P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI\/Pjxzb2FwOkVudmVsb3BlIHhtbG5zOnNvYXA9Imh0dHA6Ly93d3cudzMub3JnLzIwMDMvMDUvc29hcC1lbnZlbG9wZSIgeG1sbnM6d3NhPSJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA0LzA4L2FkZHJlc3NpbmciIHhtbG5zOndzZD0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkiPjxzb2FwOkhlYWRlcj48d3NhOlRvPnVybjpzY2hlbWFzLXhtbHNvYXAtb3JnOndzOjIwMDU6MDQ6ZGlzY292ZXJ5PC93c2E6VG8+PHdzYTpBY3Rpb24+aHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNC9kaXNjb3ZlcnkvUmVzb2x2ZTwvd3NhOkFjdGlvbj48d3NhOk1lc3NhZ2VJRD51cm46dXVpZDozZjQyZGM5YS0yNGNlLTQ4ZDEtODhmOS0xNmI5NmExMzdkNzE8L3dzYTpNZXNzYWdlSUQ+PC9zb2FwOkhlYWRlcj48c29hcDpCb2R5Pjx3c2Q6UmVzb2x2ZT48d3NhOkVuZHBvaW50UmVmZXJlbmNlPjx3c2E6QWRkcmVzcz51cm46dXVpZDplMzI0ODAwMC04MGNlLTExZGItODAwMC0wMDFiYTk5ZWM5NTY8L3dzYTpBZGRyZXNzPjwvd3NhOkVuZHBvaW50UmVmZXJlbmNlPjwvd3NkOlJlc29sdmU+PC9zb2FwOkJvZHk+PC9zb2FwOkVudmVsb3BlPg=="} 01272{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1541515321,"pkt_ts_usec":472909,"pkt_caplen":698,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":698,"pkt_l4_len":664,"pkt":"AQBef\/\/6GNvyL6AYCABFAAKsCtwAAAERvoDAqD1C7\/\/\/+uYzDnYCmBmmPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48c29hcDpFbnZlbG9wZSB4bWxuczpzb2FwPSJodHRwOi8vd3d3LnczLm9yZy8yMDAzLzA1L3NvYXAtZW52ZWxvcGUiIHhtbG5zOndzYT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNC8wOC9hZGRyZXNzaW5nIiB4bWxuczp3c2Q9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5Ij48c29hcDpIZWFkZXI+PHdzYTpUbz51cm46c2NoZW1hcy14bWxzb2FwLW9yZzp3czoyMDA1OjA0OmRpc2NvdmVyeTwvd3NhOlRvPjx3c2E6QWN0aW9uPmh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDQvZGlzY292ZXJ5L1Jlc29sdmU8L3dzYTpBY3Rpb24+PHdzYTpNZXNzYWdlSUQ+dXJuOnV1aWQ6M2Y0MmRjOWEtMjRjZS00OGQxLTg4ZjktMTZiOTZhMTM3ZDcxPC93c2E6TWVzc2FnZUlEPjwvc29hcDpIZWFkZXI+PHNvYXA6Qm9keT48d3NkOlJlc29sdmU+PHdzYTpFbmRwb2ludFJlZmVyZW5jZT48d3NhOkFkZHJlc3M+dXJuOnV1aWQ6ZTMyNDgwMDAtODBjZS0xMWRiLTgwMDAtMDAxYmE5OWVjOTU2PC93c2E6QWRkcmVzcz48L3dzYTpFbmRwb2ludFJlZmVyZW5jZT48L3dzZDpSZXNvbHZlPjwvc29hcDpCb2R5Pjwvc29hcDpFbnZlbG9wZT4="} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1541515314826,"flow_last_seen":1541515320458,"flow_tot_l4_data_len":4648,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","ndpi": {"proto":"WSD","breed":"Acceptable","category":"Network"}} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":7,"flow_first_seen":1541515314826,"flow_last_seen":1541515320458,"flow_tot_l4_data_len":4648,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::3441:3d24:6d30:a807","dst_ip":"ff02::c","src_port":58932,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1541515314827,"flow_last_seen":1541515321472,"flow_tot_l4_data_len":4648,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","ndpi": {"proto":"WSD","breed":"Acceptable","category":"Network"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1541515314827,"flow_last_seen":1541515321472,"flow_tot_l4_data_len":4648,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.61.66","dst_ip":"239.255.255.250","src_port":58931,"dst_port":3702,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00124{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":14,"source":"upnp.pcap","alias":"nDPId-test"} diff --git a/test/results/viber.pcap.out b/test/results/viber.pcap.out index 1100839b4..07509bc9a 100644 --- a/test/results/viber.pcap.out +++ b/test/results/viber.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"viber.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"viber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1527155638428,"flow_last_seen":0,"flow_tot_l4_data_len":133,"flow_min_l4_data_len":133,"flow_max_l4_data_len":133,"flow_avg_l4_data_len":133,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"52.0.253.101","src_port":33208,"dst_port":4244,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00561{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"viber.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1527155638,"pkt_ts_usec":428936,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"pkt":"AA6OMNv9MAdNo1+nCABFAACZvbBAAEAGio\/AqAARNAD9ZYG4EJTYH5QATQ0UaIAYAtokAwAAAQEICgAhYEL3kz3SZQAKAAAALtCh9tIA1PL3FQOheV4He+mBM0W\/i9pTb10sHI+OMXtBs1b9JHGGgzJlSCkVK80QeHWJMpbzU2NcxAJaXXoLguc1CK5osKkCx6zZTIH0SZ0piWwLO+YlPXpdR9T6nHw="} 00468{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"viber.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1527155638474,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":45743,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -256,3 +257,34 @@ 02361{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":423,"source":"viber.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1527155685,"pkt_ts_usec":757293,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"AA6OMNv9MAdNo1+nCABFAAXcfu9AAEABNMHAqAARwKgADwgA3UOrGAABMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVI="} 00481{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":423,"source":"viber.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1527155685757,"flow_last_seen":0,"flow_tot_l4_data_len":1480,"flow_min_l4_data_len":1480,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1480,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}} 02361{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1527155685,"pkt_ts_usec":757669,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"MAdNo1+nAA6OMNv9CABFAAXcOTwAAEABunTAqAAPwKgAEQAA5UOrGAABMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWl9fMTIzNDU2Nzg5MEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaX18xMjM0NTY3ODkwQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpfXzEyMzQ1Njc4OTBBQkNERUZHSElKS0xNTk9QUVI="} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":22,"flow_first_seen":1527155639240,"flow_last_seen":1527155640252,"flow_tot_l4_data_len":7101,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":322,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"54.69.166.226","src_port":36986,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":22,"flow_first_seen":1527155640085,"flow_last_seen":1527155641008,"flow_tot_l4_data_len":6877,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"54.69.166.226","src_port":36988,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1527155644240,"flow_last_seen":1527155644244,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":30,"flow_max_l4_data_len":31,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"172.217.23.106","src_port":41993,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_first_seen":1527155644240,"flow_last_seen":1527155644244,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":30,"flow_max_l4_data_len":31,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"172.217.23.106","src_port":41993,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":46,"flow_first_seen":1527155670640,"flow_last_seen":1527155677861,"flow_tot_l4_data_len":5773,"flow_min_l4_data_len":20,"flow_max_l4_data_len":265,"flow_avg_l4_data_len":125,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.32","src_port":47171,"dst_port":7985,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1527155670640,"flow_last_seen":1527155670672,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":28,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.32","src_port":47171,"dst_port":7987,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":24,"flow_first_seen":1527155641697,"flow_last_seen":1527155647390,"flow_tot_l4_data_len":10349,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":431,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"54.230.93.96","src_port":57520,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00462{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1527155685757,"flow_last_seen":1527155685757,"flow_tot_l4_data_len":2960,"flow_min_l4_data_len":1480,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":1480,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":19,"flow_first_seen":1527155648513,"flow_last_seen":1527155648748,"flow_tot_l4_data_len":7127,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":375,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"151.101.1.130","src_port":55746,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":58,"flow_first_seen":1527155638428,"flow_last_seen":1527155685200,"flow_tot_l4_data_len":7373,"flow_min_l4_data_len":32,"flow_max_l4_data_len":623,"flow_avg_l4_data_len":127,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"52.0.253.101","src_port":33208,"dst_port":4244,"l4_proto":"tcp","ndpi": {"proto":"Viber","breed":"Acceptable","category":"VoIP"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":58,"flow_first_seen":1527155638428,"flow_last_seen":1527155685200,"flow_tot_l4_data_len":7373,"flow_min_l4_data_len":32,"flow_max_l4_data_len":623,"flow_avg_l4_data_len":127,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"52.0.253.101","src_port":33208,"dst_port":4244,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":89,"flow_first_seen":1527155641845,"flow_last_seen":1527155647484,"flow_tot_l4_data_len":61632,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":692,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"54.230.93.53","src_port":53934,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1527155647500,"flow_last_seen":1527155647500,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::3207:4dff:fea3:5fa7","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1527155646968,"flow_last_seen":1527155666982,"flow_tot_l4_data_len":276,"flow_min_l4_data_len":69,"flow_max_l4_data_len":69,"flow_avg_l4_data_len":69,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1527155639005,"flow_last_seen":1527155639008,"flow_tot_l4_data_len":309,"flow_min_l4_data_len":40,"flow_max_l4_data_len":269,"flow_avg_l4_data_len":154,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":35283,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1527155646819,"flow_last_seen":1527155646840,"flow_tot_l4_data_len":106,"flow_min_l4_data_len":45,"flow_max_l4_data_len":61,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":35331,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1527155641574,"flow_last_seen":1527155641691,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":45,"flow_max_l4_data_len":151,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":37418,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1527155638474,"flow_last_seen":1527155638476,"flow_tot_l4_data_len":213,"flow_min_l4_data_len":44,"flow_max_l4_data_len":169,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":45743,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1527155670632,"flow_last_seen":1527155677899,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.32","src_port":45424,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00484{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1527155670632,"flow_last_seen":1527155677899,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.32","src_port":45424,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":27,"flow_first_seen":1527155671066,"flow_last_seen":1527155672061,"flow_tot_l4_data_len":8457,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"54.187.91.182","src_port":49048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1527155685529,"flow_last_seen":1527155685530,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":50097,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":43,"flow_first_seen":1527155679411,"flow_last_seen":1527155685088,"flow_tot_l4_data_len":4754,"flow_min_l4_data_len":20,"flow_max_l4_data_len":265,"flow_avg_l4_data_len":110,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.3","src_port":38190,"dst_port":7985,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1527155679411,"flow_last_seen":1527155679443,"flow_tot_l4_data_len":70,"flow_min_l4_data_len":28,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.3","src_port":38190,"dst_port":7987,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":27,"flow_first_seen":1527155646850,"flow_last_seen":1527155680789,"flow_tot_l4_data_len":7857,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1004,"flow_avg_l4_data_len":291,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"172.217.23.78","src_port":43702,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1527155648481,"flow_last_seen":1527155648506,"flow_tot_l4_data_len":197,"flow_min_l4_data_len":48,"flow_max_l4_data_len":149,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":44376,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1527155639234,"flow_last_seen":1527155639237,"flow_tot_l4_data_len":383,"flow_min_l4_data_len":44,"flow_max_l4_data_len":339,"flow_avg_l4_data_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":62872,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":6,"flow_first_seen":1527155679410,"flow_last_seen":1527155685132,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.3","src_port":33744,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":6,"flow_first_seen":1527155679410,"flow_last_seen":1527155685132,"flow_tot_l4_data_len":208,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"18.201.4.3","src_port":33744,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1527155641813,"flow_last_seen":1527155641840,"flow_tot_l4_data_len":195,"flow_min_l4_data_len":44,"flow_max_l4_data_len":151,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.17","dst_ip":"192.168.0.15","src_port":40445,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":424,"source":"viber.pcap","alias":"nDPId-test"} diff --git a/test/results/vnc.pcap.out b/test/results/vnc.pcap.out index 1bd01bf63..285411a3a 100644 --- a/test/results/vnc.pcap.out +++ b/test/results/vnc.pcap.out @@ -1,3 +1,4 @@ +00380{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"vnc.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"vnc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1476111264364,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"95.237.48.208","dst_ip":"192.168.2.110","src_port":59791,"dst_port":6900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00418{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"vnc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1476111264,"pkt_ts_usec":364066,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EP7tAkntxOodxQGGCABFAAA0Xs1AAHQGVCNf7TDQwKgCbumPGvTqxTBkAAAAAIACIADbnAAAAgQFrAEDAwIBAQQC"} 00418{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"vnc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1476111264,"pkt_ts_usec":364590,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xOodxQGGEP7tAkntCABFAAA0fFNAAIAGAADAqAJuX+0w0Br06Y8QfmeF6sUwZYASIABT+gAAAgQFtAEDAwgBAQQC"} @@ -32,3 +33,6 @@ 00446{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3556,"source":"vnc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1476111286,"pkt_ts_usec":680165,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EP7tAkntxOodxQGGCABFAABFbf5AAHQGROFf7TDQwKgCbslnGvTjPDsnT1t9AVAYQGUMdAAAAAtD14zifYG0h7hNY6JEfjTiOFBsN4kA8OBfXio="} 00454{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3557,"source":"vnc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1476111286,"pkt_ts_usec":680351,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"xOodxQGGEP7tAkntCABFAABKAmxAAIAGAADAqAJuX+0w0Br0yWdPW30B4zw7RFAYAQFUEAAAABB5egU6EyiUhjcAQTfjXu4EJ6Tyd+fY2j1lCEncfpiMwQ=="} 00454{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3558,"source":"vnc.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1476111286,"pkt_ts_usec":680712,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"EP7tAkntxOodxQGGCABFAABKbf9AAHQGRNtf7TDQwKgCbslnGvTjPDtET1t9AVAYQGWCBgAAABAyRkBH2n2M0M1lbRupL3R3bhQSGUiIXpMn5oN9qHkc9w=="} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":4551,"source":"vnc.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1008,"flow_first_seen":1476111286462,"flow_last_seen":1476111290613,"flow_tot_l4_data_len":38150,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"95.237.48.208","dst_ip":"192.168.2.110","src_port":51559,"dst_port":6900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":4551,"source":"vnc.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3543,"flow_first_seen":1476111264364,"flow_last_seen":1476111280884,"flow_tot_l4_data_len":135184,"flow_min_l4_data_len":20,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"95.237.48.208","dst_ip":"192.168.2.110","src_port":59791,"dst_port":6900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":4551,"source":"vnc.pcap","alias":"nDPId-test"} diff --git a/test/results/wa_video.pcap.out b/test/results/wa_video.pcap.out index 81bff8d0b..82c97e1ae 100644 --- a/test/results/wa_video.pcap.out +++ b/test/results/wa_video.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wa_video.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561455764448,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00462{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wa_video.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455764,"pkt_ts_usec":448302,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/xiwDYGpkCABFAABI0kIAAEARIhLAqAIBwKgC\/+EV4RUANEtUU3BvdFVkcDC64ScQKi2g\/wABAARIlcIDyUSzc\/3fJAksKuG26pMF0apN5Ek="} 00507{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561455764448,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}} @@ -120,3 +121,17 @@ 00515{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1543,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1561455792273,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":51458,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}} 00579{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1563,"source":"wa_video.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455795,"pkt_ts_usec":276739,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"AQBef\/\/6kLkxKPrKCABFAACgOnoAAAIRyyTAqAIM7\/\/\/+skCB2wAjBoITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpzZXJ2aWNlOldBTklQQ29ubmVjdGlvbjoxDQpNQU46ICJzc2RwOmRpc2NvdmVyIg0KTVg6IDMNCg0K"} 00579{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1564,"source":"wa_video.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455795,"pkt_ts_usec":277117,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"AQBef\/\/6kLkxKPrKCABFAACg4VAAAAIRJE7AqAIM7\/\/\/+v4BB2wAjOUITS1TRUFSQ0ggKiBIVFRQLzEuMQ0KSE9TVDogMjM5LjI1NS4yNTUuMjUwOjE5MDANClNUOiB1cm46c2NoZW1hcy11cG5wLW9yZzpzZXJ2aWNlOldBTklQQ29ubmVjdGlvbjoxDQpNQU46ICJzc2RwOmRpc2NvdmVyIg0KTVg6IDMNCg0K"} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1561455770313,"flow_last_seen":1561455779337,"flow_tot_l4_data_len":535,"flow_min_l4_data_len":109,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":133,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":51277,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":5,"flow_first_seen":1561455769791,"flow_last_seen":1561455792270,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.196.62","src_port":53688,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1561455769790,"flow_last_seen":1561455792270,"flow_tot_l4_data_len":454,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.193.48","src_port":53688,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1561455792273,"flow_last_seen":1561455795276,"flow_tot_l4_data_len":285,"flow_min_l4_data_len":140,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":51458,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1561455791449,"flow_last_seen":1561455791449,"flow_tot_l4_data_len":696,"flow_min_l4_data_len":347,"flow_max_l4_data_len":349,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1561455769790,"flow_last_seen":1561455792270,"flow_tot_l4_data_len":454,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"179.60.192.48","src_port":53688,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1561455769789,"flow_last_seen":1561455792270,"flow_tot_l4_data_len":454,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"185.60.216.51","src_port":53688,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":493,"flow_first_seen":1561455769789,"flow_last_seen":1561455792270,"flow_tot_l4_data_len":231913,"flow_min_l4_data_len":10,"flow_max_l4_data_len":1147,"flow_avg_l4_data_len":470,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.48","src_port":53688,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1561455792270,"flow_last_seen":1561455795277,"flow_tot_l4_data_len":285,"flow_min_l4_data_len":140,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":65025,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":893,"flow_first_seen":1561455781352,"flow_last_seen":1561455792065,"flow_tot_l4_data_len":654475,"flow_min_l4_data_len":34,"flow_max_l4_data_len":1301,"flow_avg_l4_data_len":732,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"91.252.56.51","src_port":53688,"dst_port":32641,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":133,"flow_first_seen":1561455767339,"flow_last_seen":1561455795283,"flow_tot_l4_data_len":16046,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":120,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.20.53","src_port":49355,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"WhatsApp","breed":"Acceptable","category":"Chat"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":133,"flow_first_seen":1561455767339,"flow_last_seen":1561455795283,"flow_tot_l4_data_len":16046,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":120,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.20.53","src_port":49355,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":18,"flow_first_seen":1561455781247,"flow_last_seen":1561455791996,"flow_tot_l4_data_len":936,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"1.60.78.64","src_port":53688,"dst_port":59491,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00130{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1567,"source":"wa_video.pcap","alias":"nDPId-test"} diff --git a/test/results/wa_voice.pcap.out b/test/results/wa_voice.pcap.out index a8fd71623..99b00074f 100644 --- a/test/results/wa_voice.pcap.out +++ b/test/results/wa_voice.pcap.out @@ -1,3 +1,4 @@ +00385{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wa_voice.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561455687942,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":51431,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455687,"pkt_ts_usec":942546,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xiwDYGpkkLkxKPrKCABFAAA8VCwAAP8R4ibAqAIMwKgCAcjnADUAKL4MZG8BAAABAAAAAAAAA3d3dwZnb29nbGUDY29tAAABAAE="} 00631{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1561455687942,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":51431,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Unrated","category":"Web"},"dns": {"query":"www.google.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -258,3 +259,30 @@ 00437{"flow_id":30,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":726,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455742,"pkt_ts_usec":405584,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"xiwDYGpkkLkxKPrKCABFAAA4TCgAAEAB17nAqAIMW\/w4MwMDoOEAAAAARQAAZumbAAAxEUkIW\/w4M8CoAgx\/wNwIAFIAAA=="} 00437{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":727,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455742,"pkt_ts_usec":405951,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"xiwDYGpkkLkxKPrKCABFAAA4HrIAAEABBTDAqAIMW\/w4MwMDoOEAAAAARQAAZp1RAAAxEZVSW\/w4M8CoAgx\/wNwIAFIAAA=="} 00437{"flow_id":30,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":728,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455742,"pkt_ts_usec":405963,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"xiwDYGpkkLkxKPrKCABFAAA4twoAAEABbNfAqAIMW\/w4MwMDoOEAAAAARQAAZq9YAAAxEYNLW\/w4M8CoAgx\/wNwIAFIAAA=="} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":24,"flow_first_seen":1561455688201,"flow_last_seen":1561455742310,"flow_tot_l4_data_len":7191,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":299,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"17.242.60.84","src_port":49354,"dst_port":5223,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1561455738163,"flow_last_seen":1561455738163,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"169.254.162.244","src_port":49352,"dst_port":49159,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1561455738163,"flow_last_seen":1561455738163,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":26,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"169.254.162.244","src_port":49352,"dst_port":49159,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":85,"flow_first_seen":1561455707474,"flow_last_seen":1561455707887,"flow_tot_l4_data_len":44650,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":525,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.20.52","src_port":50504,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":5,"flow_first_seen":1561455721320,"flow_last_seen":1561455738622,"flow_tot_l4_data_len":1540,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":164,"flow_first_seen":1561455730495,"flow_last_seen":1561455742404,"flow_tot_l4_data_len":26358,"flow_min_l4_data_len":34,"flow_max_l4_data_len":297,"flow_avg_l4_data_len":160,"midstream":0,"l3_proto":"ip4","src_ip":"91.252.56.51","dst_ip":"192.168.2.12","src_port":32704,"dst_port":56328,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1561455741432,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":57546,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1561455689728,"flow_last_seen":1561455689761,"flow_tot_l4_data_len":126,"flow_min_l4_data_len":55,"flow_max_l4_data_len":71,"flow_avg_l4_data_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737895,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::414:409d:8afd:9f05","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1561455701309,"flow_last_seen":1561455731356,"flow_tot_l4_data_len":1392,"flow_min_l4_data_len":347,"flow_max_l4_data_len":349,"flow_avg_l4_data_len":348,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1561455687942,"flow_last_seen":1561455687944,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":40,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":51431,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1561455702980,"flow_last_seen":1561455703262,"flow_tot_l4_data_len":270,"flow_min_l4_data_len":20,"flow_max_l4_data_len":63,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"17.171.47.85","dst_ip":"192.168.2.12","src_port":443,"dst_port":50502,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1561455702980,"flow_last_seen":1561455703262,"flow_tot_l4_data_len":270,"flow_min_l4_data_len":20,"flow_max_l4_data_len":63,"flow_avg_l4_data_len":33,"midstream":1,"l3_proto":"ip4","src_ip":"17.171.47.85","dst_ip":"192.168.2.12","src_port":443,"dst_port":50502,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":8,"flow_first_seen":1561455706914,"flow_last_seen":1561455741420,"flow_tot_l4_data_len":826,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.196.62","src_port":56328,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1561455706913,"flow_last_seen":1561455741419,"flow_tot_l4_data_len":826,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"157.240.193.48","src_port":56328,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_first_seen":1561455705874,"flow_last_seen":1561455737893,"flow_tot_l4_data_len":374,"flow_min_l4_data_len":57,"flow_max_l4_data_len":146,"flow_avg_l4_data_len":74,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":16,"flow_first_seen":1561455731665,"flow_last_seen":1561455741046,"flow_tot_l4_data_len":832,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"1.60.78.64","src_port":56328,"dst_port":64282,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1561455741430,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":50191,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":50,"flow_first_seen":1561455689909,"flow_last_seen":1561455690302,"flow_tot_l4_data_len":23052,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1420,"flow_avg_l4_data_len":461,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":3,"flow_first_seen":1561455709984,"flow_last_seen":1561455716020,"flow_tot_l4_data_len":390,"flow_min_l4_data_len":109,"flow_max_l4_data_len":141,"flow_avg_l4_data_len":130,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"239.255.255.250","src_port":64716,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00458{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1561455741484,"flow_last_seen":1561455742405,"flow_tot_l4_data_len":144,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"91.252.56.51","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1561455707435,"flow_last_seen":1561455707470,"flow_tot_l4_data_len":125,"flow_min_l4_data_len":42,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":62,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":60549,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1561455706913,"flow_last_seen":1561455741420,"flow_tot_l4_data_len":826,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"179.60.192.48","src_port":56328,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1561455687991,"flow_last_seen":1561455688018,"flow_tot_l4_data_len":119,"flow_min_l4_data_len":40,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":60765,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":8,"flow_first_seen":1561455706912,"flow_last_seen":1561455741419,"flow_tot_l4_data_len":826,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"185.60.216.51","src_port":56328,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":49,"flow_first_seen":1561455706912,"flow_last_seen":1561455741419,"flow_tot_l4_data_len":4351,"flow_min_l4_data_len":10,"flow_max_l4_data_len":292,"flow_avg_l4_data_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.48","src_port":56328,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":736,"source":"wa_voice.pcap","alias":"nDPId-test"} diff --git a/test/results/waze.pcap.out b/test/results/waze.pcap.out index 897a0d4ba..382805cb8 100644 --- a/test/results/waze.pcap.out +++ b/test/results/waze.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"waze.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1435587866603,"flow_last_seen":0,"flow_tot_l4_data_len":57,"flow_min_l4_data_len":57,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":57,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587866,"pkt_ts_usec":603221,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNMsFAAEAGQsYKECWdriXnUaUQFGaA18okWhY9doAYAVcoQwAAAQEICgAIazhBJdw4gAAWBXL2KZLscQ7\/r4Q3YR6R6YsREWIs0w=="} 00456{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587867,"pkt_ts_usec":103902,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"ABoRAAACABoRAAABCABFAABNMsJAAEAGQsUKECWdriXnUaUQFGaA18okWhY9doAYAVcoEAAAAQEICgAIa2tBJdw4gAAWBXL2KZLscQ7\/r4Q3YR6R6YsREWIs0w=="} @@ -446,3 +447,48 @@ 00409{"flow_id":33,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":587,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":206886,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAo2ilAAEAGerQKCAABLjOtto0pAbvwXaIcD6JtFlAQ\/\/8rywAA"} 00612{"flow_id":33,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":588,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":207621,"pkt_caplen":203,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":203,"pkt_l4_len":169,"pkt":"ABoRAAACABoRAAABCABFAAC92ipAAEAGeh4KCAABLjOtto0pAbvwXaIcD6JtFlAY\/\/+rHQAAFwMBAJDkrrD9SA4+LmKzspcHnXowhPBblCCla204NgqPS0UbDvi3FwMZblBmNtY0jKhmQuQORsNfhK8al25NMwXFLKNdn+z1CtsyYB43HL9wyLLSMNK7nC1Zky+WYPvMpkuwuyJ0+McaUzeUsX5ul4pcc5NuTj8ADh7sJcVgm+9jWgCOQ9KUX5vGtnm3baGraIAVagc="} 00409{"flow_id":33,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":589,"source":"waze.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1435587906,"pkt_ts_usec":208378,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAodYxAABAGD1IuM622CggAAQG7jSkPom0W8F2isVAQ\/\/8rNgAA"} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1435587880580,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52953,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1435587880580,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52953,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":17,"flow_first_seen":1435587868632,"flow_last_seen":1435587869162,"flow_tot_l4_data_len":3437,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1644,"flow_avg_l4_data_len":202,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45529,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":15,"flow_first_seen":1435587869162,"flow_last_seen":1435587869302,"flow_tot_l4_data_len":855,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45536,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":14,"flow_first_seen":1435587871656,"flow_last_seen":1435587871946,"flow_tot_l4_data_len":850,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45538,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":14,"flow_first_seen":1435587871658,"flow_last_seen":1435587871945,"flow_tot_l4_data_len":810,"flow_min_l4_data_len":20,"flow_max_l4_data_len":375,"flow_avg_l4_data_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45540,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":14,"flow_first_seen":1435587871941,"flow_last_seen":1435587872478,"flow_tot_l4_data_len":852,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45546,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":14,"flow_first_seen":1435587872476,"flow_last_seen":1435587872705,"flow_tot_l4_data_len":847,"flow_min_l4_data_len":20,"flow_max_l4_data_len":413,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45552,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":14,"flow_first_seen":1435587872702,"flow_last_seen":1435587872838,"flow_tot_l4_data_len":843,"flow_min_l4_data_len":20,"flow_max_l4_data_len":411,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.230.227.172","src_port":45554,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":15,"flow_first_seen":1435587898822,"flow_last_seen":1435587899372,"flow_tot_l4_data_len":831,"flow_min_l4_data_len":20,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"108.168.176.228","src_port":50828,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsApp","breed":"Acceptable","category":"Chat"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":15,"flow_first_seen":1435587898822,"flow_last_seen":1435587899372,"flow_tot_l4_data_len":831,"flow_min_l4_data_len":20,"flow_max_l4_data_len":211,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"108.168.176.228","src_port":50828,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1435587880579,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":45169,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00479{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":4,"flow_first_seen":1435587880579,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":45169,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":107,"flow_first_seen":1435587868634,"flow_last_seen":1435587888318,"flow_tot_l4_data_len":82074,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17224,"flow_avg_l4_data_len":767,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":37,"flow_first_seen":1435587868635,"flow_last_seen":1435587884546,"flow_tot_l4_data_len":10726,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3626,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":24,"flow_first_seen":1435587894241,"flow_last_seen":1435587901093,"flow_tot_l4_data_len":5769,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3167,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36134,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":23,"flow_first_seen":1435587905035,"flow_last_seen":1435587907392,"flow_tot_l4_data_len":4960,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2155,"flow_avg_l4_data_len":215,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"46.51.173.182","src_port":36137,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":32,"flow_first_seen":1435587878606,"flow_last_seen":1435587882306,"flow_tot_l4_data_len":43531,"flow_min_l4_data_len":20,"flow_max_l4_data_len":11152,"flow_avg_l4_data_len":1360,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36312,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":20,"flow_first_seen":1435587879018,"flow_last_seen":1435587882336,"flow_tot_l4_data_len":4993,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2499,"flow_avg_l4_data_len":249,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36314,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":28,"flow_first_seen":1435587879850,"flow_last_seen":1435587883075,"flow_tot_l4_data_len":26934,"flow_min_l4_data_len":20,"flow_max_l4_data_len":8116,"flow_avg_l4_data_len":961,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.186.180","src_port":36316,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":4,"flow_first_seen":1435587880587,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":43089,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00480{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":4,"flow_first_seen":1435587880587,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.198","src_port":43089,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":16,"flow_first_seen":1435587871939,"flow_last_seen":1435587873226,"flow_tot_l4_data_len":8641,"flow_min_l4_data_len":20,"flow_max_l4_data_len":4014,"flow_avg_l4_data_len":540,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"52.17.114.219","src_port":39010,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":13,"flow_first_seen":1435587868996,"flow_last_seen":1435587869400,"flow_tot_l4_data_len":1700,"flow_min_l4_data_len":20,"flow_max_l4_data_len":568,"flow_avg_l4_data_len":130,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.194.118.48","src_port":36585,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":33,"flow_first_seen":1435587878215,"flow_last_seen":1435587880857,"flow_tot_l4_data_len":57774,"flow_min_l4_data_len":20,"flow_max_l4_data_len":21908,"flow_avg_l4_data_len":1750,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"52.17.114.219","src_port":39021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":23,"flow_first_seen":1435587871918,"flow_last_seen":1435587874945,"flow_tot_l4_data_len":7041,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1388,"flow_avg_l4_data_len":306,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51049,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":18,"flow_first_seen":1435587871929,"flow_last_seen":1435587874378,"flow_tot_l4_data_len":4941,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2131,"flow_avg_l4_data_len":274,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51050,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":21,"flow_first_seen":1435587871935,"flow_last_seen":1435587874495,"flow_tot_l4_data_len":7001,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2131,"flow_avg_l4_data_len":333,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"176.34.103.105","src_port":51051,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1435587880578,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":41823,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1435587880578,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":41823,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1435587880576,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.31","src_port":43991,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1435587880576,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.31","src_port":43991,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1435587880583,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60574,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00478{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_first_seen":1435587880583,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60574,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":37,"flow_first_seen":1435587867755,"flow_last_seen":1435587873026,"flow_tot_l4_data_len":61947,"flow_min_l4_data_len":20,"flow_max_l4_data_len":11799,"flow_avg_l4_data_len":1674,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"65.39.128.135","src_port":54915,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1435587880577,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":46473,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1435587880577,"flow_last_seen":1435587880583,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":46473,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00499{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1435587880589,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60479,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00479{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1435587880589,"flow_last_seen":1435587880590,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.160.4.49","src_port":60479,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1435587867443,"flow_last_seen":1435587867753,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"200.89.75.198","src_port":46214,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1435587880581,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52746,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00482{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1435587880581,"flow_last_seen":1435587880589,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"200.160.4.49","src_port":52746,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1435587866603,"flow_last_seen":1435587898628,"flow_tot_l4_data_len":446,"flow_min_l4_data_len":20,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":44,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00486{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1435587866603,"flow_last_seen":1435587898628,"flow_tot_l4_data_len":446,"flow_min_l4_data_len":20,"flow_max_l4_data_len":57,"flow_avg_l4_data_len":44,"midstream":1,"l3_proto":"ip4","src_ip":"10.16.37.157","dst_ip":"174.37.231.81","src_port":42256,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":597,"source":"waze.pcap","alias":"nDPId-test"} diff --git a/test/results/webex.pcap.out b/test/results/webex.pcap.out index 5abaebb6e..71b08a9b4 100644 --- a/test/results/webex.pcap.out +++ b/test/results/webex.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"webex.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00466{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1444570624853,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":853841,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8OXNAAEAGTZUKCAABQERpZ6GCAbtPGIcMAAAAAKACOQgjFwAAAgQFtAQCCAoATL5\/AAAAAAEDAwY="} 00406{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570624,"pkt_ts_usec":860347,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAQ5AABAGtg5ARGlnCggAAQG7oYKw53jzTxiHDVAS\/\/9Y4AAA"} @@ -885,3 +886,34 @@ 00637{"flow_id":56,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1569,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":706421,"pkt_caplen":219,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":219,"pkt_l4_len":185,"pkt":"ABoRAAACABoRAAABCABFAADNA\/tAABAGPUI+beB4CggAAQG7x\/r74cA8BB5SolAY\/\/+2rwAAFwMBAKD59UDZ7S7geJrVoYTOnjjAElM7mgEB5SfOzss2AtHnIjs7wJRjidoZeLKCsZK3Kzs5xW13JL+ljy2vDIr\/MQmdsFHjUqVYXgzVTVCkmtV8WnZlS3Vb17A2+NAprTG7USXVPvkyuUIRRNg3TVuSGRd3HbKWs4zo22fg7N+B9r+UJZyyPOKqBA1GZbAHLaPDnooAlMupSDk92KNoV3z+SqJ4"} 00409{"flow_id":56,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1570,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570740,"pkt_ts_usec":757122,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAopaRAAEAGbD0KCAABPm3geMf6AbsEHlKi++HA4VAQatU+1wAA"} 12191{"flow_id":56,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1571,"source":"webex.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1444570741,"pkt_ts_usec":261271,"pkt_caplen":8739,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":8739,"pkt_l4_len":8705,"pkt":"ABoRAAACABoRAAABCABFACIVA\/xAABAGG\/k+beB4CggAAQG7x\/r74cDhBB5SolAY\/\/82VAAAFwMBA8DFCTPOqzHwefYO9IhXr6OycdJGxl9DrzQx7TPYR+5D0QIOdbKIQnT70cPdijZrY60a86ffRhoATUhUhmwVqJbbVptIwtp4kvlQc6BxvAR3T6EO7nu1H+Cnlfy\/aSn0jlc5gDRFdzjDVuqJ5QZYNQpcf7Op5wDmxG\/cGTQ+KdLz8uFCL1MAmL7GrXw6soCUITfjQRwx4qSXRD7\/AyAIjhrwPKX9BtFOJVIhWMWLXtGo+bqwBKhVidPVQiwqFmrlyKAu9Sh2BW9N71u284Y8PJSYOxpcHUyHqCdGUDzViDtJVmahEy7qiSCSMtgmuRbkxYkwBS930S1Q074Bpkev1um645QUG02+88BRWeVZf+XphGor+qT54lnjHHPN\/FA3s6GMy2X1YRbCehewPowO8B6mC0mqmqEPG5ePujfTSNt7mbyBR8haGUDyp9VXTvZTd9aLAgwqLgVSgGZkizR+XFrKBKBO1TANRAh6\/sxU5hoo8x3FpueO42Jkg9bn3srQhK14KuTCvXjnOqYFoUKchLTKCBRdnwFYIId7OIEYpV57dk9ujYQGopw1y6SlI\/lKmLbVypKTByPUk2vIBesX4hlFB+fuvd9IXmk71D4vhG3sOvI3LV0vwz8yxir2VzBVbMq7x2osfpDTQei1T7Kh+SvQuKWsD7VLgADhbnVXtdJar3hT23RCnKpB8b0BhtZLPpKAZVgDJkPeK\/bMzbDFpW2cDtjPLqqrFOu1YtlU709XWlxxwW6S\/oXWOaRHO1XT0aRo8LKbtzMAvGbldj2rwUcnpOuAKPmESQ7fd0slunZXgyar0jdF4YT8Tiip+f\/efvpv+y73zK3eJ+RP\/xiAedxSVwmXW9e74jhjYhm+0P7otEZ6fWopLe0cEj+rW4xO0A6zmTLx+Y2M9ohomP+X\/ezgpDzB8I7Zap7FrxsGlSLAvwNHtX4WYu0sAeNfBOQP\/Xbl4H08DP1lGA7coPwae8RL0BtckiIcgP1eXF2dRzJETME07tPHp+tcpR0Ge3VaEFH1Qh7juQLkSVuTsXHYVQIk2ARHEquyvtHMpF+k2GZJDbuEwwvDXvUt0kx7WusonzvQR3ilNakYRrUmP4m\/y3inqVuBXiXPojpihmbrRYvDTxp8aFnCyLBD+4UudbNOTqA21FGiferbFljS4nJOyZ+\/L8tMJAdLDjbsojYZbqbFcXRas3rDliHRvuklu+zvjcUpimDzI1xEQNTSlyH7\/vZZj\/onFT1qPlAwhdK1abHRZTkUvSdYZK0VWve9J1pr\/W8XAwEAkNi411iQFkFYC1KpEPslN0Rq3AZTauftU0I2nfn3JJzv1tjP+UMG5O4ZQEJikGPqavG\/Cjl9XQJi7R4KHJNlc89Ehhuin1YLVtmaqBPDBwCeib6B\/Js4yaNtGBIIfA2BEqTn+zDkU2usRQMZNV5ZUoM2DKUuB1LwjyQ1pfy4w3u\/+H6pB+\/5oY85lj42IFrX6hcDAQBwA6+ZllICNLIYqudd6LnzQzO5vZMvavoO8gNeyfTP+O2TNyPOuHuf9ojNmlZq8+IQ+TGZ0fN8ndel7SA9gUuvvHui3AObULuaFAc8Jf0hVWll++5Dd3VH6rqn6Aezt7kgWAQbbBnNgnWa3OdoSWW1BBcDAQVg7Lb1JcqrwNT6xvkeBAHh\/hN7djvs4KyVjydiL1Wu\/pFKydj\/pydJkY6YcrhaCq0+uP5DSyCKGMjvOJM\/B05PMa\/d6ug9QynNE9IIk6ABU2coZim4xt7TU\/7mSHuQmSYFaHxyKp1zFYgTqQN2amxZmir5vm0M4t3V8TlzNXMhI3yExAj4UW2qlseL24V9ZFbb5cNZCT7BwSp3LwFLnvPn9IUvcnfgHi4G3ZgP1AIFUj4EvzJltMjbp5k6DQ3lBs65TEcTavZIrYa7mkFXf1Fml4qzZFGl9iWoSGOIRh4XHRV6onhR20SD8yGwythnz9fiiafXn1aF2soWuGwmReSWWLMp9C7C55sBXOrVMsMFQofRH54pvfHP4cUksbMJYLEefHowVK0UWQEHsgJYZi\/7QuQBPNGjRTaYNM2ac5Si\/r+yeHXuh57iACOZ69SiMcOCVnhofkBWzx5oq5G+uJ47crOUddlLPHnP1DTIhQx+2o62cZgWNhPLWqYSsmjXntCVAKTqyEwqgenOy\/x+OrFV7wLOsGcSbrXD3n8FTZYNY7nK5gBmMXiN0KCSgmeqQRL9uKdt0PWc4Gpad3Kwon\/A66BxDFU7qHU4+5H0O9nogl2GQeeRL9wC4vHLUgQMWIqxBSj7joNbsiCEAdFlorBI5JoGS0yFbARFc+bT+Egl3Kwm62m2HWrM8YW1EsaV9BSCDTscqD8\/iWhH\/6LLLgtij\/NUDZQaeyF5\/mofnuayDAsqRaUzuWTbKoC7dqEFjw8EHFUjwldO6aN54JN7vGdmLVCNXIBCva\/FdA+FRBUlttuYvsbqg0xbu3c0N90\/7\/7xCL8yn5+Nfb77o\/LOt4ryiv4eGp2S9OQlPpMftEb8lMdu3Cprlx8YWXTsmWlSXX\/RB+cFUP\/o\/IyuEEhOIpdFGhlfvG6ZqCcqVrrh1IQXSaUN9iRc3R6L81nLxFHs6\/sjMUv8+euHyocu9Lvu8\/1naIk6oAdk+MQsvJhLZyzk5YnUHizhYyyh5Nkj2+1Rr1N13uphu9K5jFMAs3c9hKactfTQ1nwsdGlhPirovhC\/GQPu6WuhcZr71nynvcJG3xcqiPYmUUa7h5ZdF2+z7vsI9Z8\/NYNKQrjnj9KX0CU9RWY+n7u\/+90NA\/II2YdUcve2LgAyfdF4JBD8\/DXsiCOcR5lyY5ts6ZFQdFP2slvwDrWaKEaeWbJsK\/fDvKaqnMrkXqi10m7lt6Ziarw6rVyBFmkYy6qzuwR3v5bulTeEXcl3jcmwlmTJzfvIrdiwDn9Uz9091sz24BLoX7CUh76QnMpMn\/z23d5PwsLHoG9\/cINkcD7+ZVBjuFvgrhuowWg4fSdgx9m2Ow\/9UEwODiOs7SSTSMcCCZ+ez3IanpDDx7W98OLFKHgAmcqavSmyJXdP6mvUgxF114\/jIi8qjdwBT8Oer50BfzfPMyEFnmqEGpNbUDwf0qS\/qzMoJxM2vt411Z3EqWJSc4jjEry846kiFJPkgztpVak1GXaNDWXutXky+gG\/PW\/xmGExsvHMwxanpv2dTw79q1DecdGLdbvxUWge686Yv2\/mwyUgagHAZ6srcmr+Z7Vx0DM1F8MVBdsGhq2w5SQeHiUnTg\/K3Og2uSjGrwu4k4Eep1CfYTcQXx6Mm4u01mB\/SOEa4iEKKuHDD+ENPUZeltQcLPp8Myq+jq39k60D95NYdiKV6MFw+Qf7P+aDiHf9vHHYHfGkVM8MWZTWZcsanzsgAd9Y5Es7XQyzNNOIXk+a5xJs1VRHlVgeSS7n4+bdTHhueX34ZQfEAVlcEkgw4ghOazh2s\/GBExA0KFXUYDmb1temqca4BSYXAwEFYNeQA1Amz7L1rzXo3zwpLwXGFCMYG38r+wWI1Pw1FIW\/tuFms\/l4VDIzJ4hUEVkmJHn\/maLf4OfIEbXAP3Yj3VyQn0gifCDr6yrUlzTImU\/n9LgwUo3BI91s8laFzAh9QndCoH13rjABj0S7SsFVmLYo7BkPeASkDGOZwZeVCvsTCoJ0537I8dBUFz0q348Skw0bvOiDHnaJuIPpPh7KV8kHHsgWxuZTEvkf4YZOhodQOJOTfsDiZTf1TiPtlRJOAVTXJz6XMPc98AEOllLji9euCAtO5Gz+0S9kSsCS\/XqcYeB1j0auHx\/b6YgQ6HkHbHK8hRWbiTSTroR7rTwHVZJG8jWEfhMHjbgrBcd231La6ireUD1FCfYfXLAqgmLeP1RbgmijDCFvgRWd5oJCdFomJ57\/VZsQNTtRka0cpiic4FqJRYCm4v1z9E\/g8+DeWm\/vGBHrZEDMKR4Gslauug\/TXTaK9bTax3JvcqF1kKGwGjnrvnBNK2uVCe5Sc3xE+fMcoQCAG9M6m96e4yV4VzQ1Oi8r0UxjYqzM\/Zpf+KN+QxrTJ0Fu55gkpjzQd0ikM1RDfB\/nK7hQ0KvrjTP4i5euhF6PN\/xKqJkbiLRMTuzkY1tiZSyKuaLY5wubOh5u1kfdClpTFlbO2UHhZ+FOxS5w27UQ6RJrYYRlgn27IS5KxlydzYobRXoUF0bgCAg5Eg7zH8vPREHuJvx\/oolzM8C6bH1VIpT5v+vrxLnrb8E2W4miZuZaeq5RrzVE6HRJyV7y1yoNDkeHY6JVltLiRtVB5cTzuNUz3QUHLUZkG3Ic2okiUVSsAkwUmOCzEuB2fZp4q51Oq407YXlwgEYWqyQhsc3pgj2vtCAh6QVXHZXBITzz01RjeHwzJfUgNP4xQ+WZp6XeYYSszB+2F7JqAgJs2TGIC5T3QQdD1Jm1mW68nEcMDg6q7tY2eaqp3LtoLUII7kI++P471z9aV1YKecsZZjAYjDZX+7pbqC+IR0WltOVRFtA3H5KQ\/KoRxgr3TD5fkcFdGA0RWrGttrCvIZ5i2YXWLODtTPITrOR\/yYfsFYJdJBhay\/y7ZDB2mj8Y34T0Ik0vUs8PUwW54Q4hBlBq6KekUmgwL3tiP9KxRt4XNk9iMaWcsS0pYENanKfYoa7JCrRXxmt+jFE\/6woYQxe3qG5O\/0U0R\/ZVEENVZyvfaxh5gaAzzOb0JHt91IVjprRvfpCvxukai3VHsDSZRcn69qeRhKU0N6++kqOIe3rwVRNKB9YZBkEjecbUc7Eh0Mj1TsJe2D9N+9Gv1ExxueKlesmPPZBCmNZSMo0AE1DSXXbKGSHWbyJbTEru3zvJipiIuUlskEJFvBEtuH+yFTjLksyh28CYZlnAboOVCf7BRl8ZF2WA1zw5bd5nZUoe1oMZMQhKckEFFrGIsZz+T5pJdyBTVCaC84bgn3eoRB++Lv\/4e6M9PyvGFoYYg6CyykA4ryrhKsTdd0fkALMM32msGKLqQ0PV4o8NqoWeraJCfLNojnG48scWkah9a\/G1n\/5XT9tnWe6UKSpqWSivu0aE+BOvyHQisWcBCwWBCRemUhE6OGFygMDtjl5\/84EFaK44VMf8TookbNeN\/drvO\/XqtePlhACLd8RmE7vz2fVj\/UIm1BykuYuXhy5NW2nndr89\/H+R8JOrOuuOFxTXynBwXqbnmDa2\/ayvJLprBMvjSjIOK41fhicG8GXZBAN55ZwcgdU1SqFf12NK6VwLJQC\/63WB0Mmhl6oemEBnvAOfWCSRvxIqEI11RS1V0tJTDaQMOH4l9g0rzpb7p3R01pvQr8LaF8ygfM8TOdAQ7iv2FwMBBWAhy0xDKsHFlIlnzuoyK5SargP7jlOmU\/bwO0pca8kuNygxpWiVvmfv3sRMIIGiWyg\/\/NLfsnKPzTpHjtWjF78L+o1F01lM7dApDUjR1AFGSuX3obSNZgvPQP0rAd1z60nd739vtftgYqf95LLPO8R8uM7fQ\/vV3yXCAayTRefOF\/By315dYNgFkFvNkV9\/9da2jUHDAxnyqI64At1ebYtagwS6jgMXmasEIRT9vjbHtwWsXzLgDypDWwT0V\/rpnKMmOs524Ur2Gi78lnuZi6xxS+fZeFS27ie7ajM4er2waCw69YK1hxR9CeO+9qF40ioRuYFTqxn2xFNR6O3N5m82+dA4uXugmx0KHHyC1XZR7VXAHwTOsQ0i+CWVyo68sWlJc\/HOYVLI4tBZrauBFmBEBJi8l7cZddoqYddBXsiSF4W3DIUVYK4OEVeUcb3KStn8akIeaqWucRxrZ9j7grx66s9WbO2n\/90aoYvi+2CSbh7kZWhbQIz7lnJVhLT28Yswx8MbwDLNuNVIAnoYDVoxmvai65z1FddzT17SUSob\/c+PVOcruNKBwhLr4AWnlh8iNRqYu9faqrMzBPqr1ySaBHnJFbcaXCwkNiuxixF4zNnalDZ4J+c9O\/5a5onbZmaWDxbH\/xWupeNBtt4dtwywZ+SH++az1dIpmYOjhMHe57dPNtsnJOfP6Fa93Nw+6ZnDb3mTlWTmrzGanHZmEVu6uhYgzM3Vi0RSYxqsMZcd7Jii8tjicvvedKUoTX5Yq1Z6GtE1+BvDXNG\/otFyQ+yawhu5a\/ghw56tdP7uJdK5YXIVLq7vfibMedfjqZQtTcBp6Y2yq1mzUYUHOp4+2sI28OGLJFBPhQblGEofGFxds3g0iAz0DuVYRQ8+RXQpdiMLlmeLDTi+2pMcwm8eLV2eXksj4G+NpQ0kLcL24ZXc\/gkEGgGuN3rI2ff6m2+FDbwe7+Dsz5smvShZxdw84dpBtfRSC5\/7VVaIGDDWVyIU37OUZ8Wmh2my1KPG5p3Qt5RswlEj868bmDr0yL0xcWFdG1GaktWDOBzf\/qFD2oUW7QZ\/mC5RD10Ph4MnjlFq8Y7d7+btrC3SplH+ZWjn7CsOnfTFOlmjG3OnhLkLMn5HJIK\/XAMgz+SljnIIGmnZQpHnlckscShqABNpH02G5sfTymrDYrAmKSwb5j8s3bpLYFjHX3OtY1Pxg7BO5McFq6yfkW\/vw6uF4oC+nLIwjia3odaYXXV5Tqhwx9xaMJCPWfeduOTWnu1T1z1rNl\/VNpFKyXk\/YsbYmSPEoNhqm2VCWaCbsswHZo78\/+OvSad8tm91u00BmjSNKCpCs6LrjNdhek6RT4HVRKJ8uXqK9jN1M4uZyBql+dPr7XVu4nI9fUxa2tl4llG64Qr1HqedRFLQreHPMvzM3QyOMxhnWj7eS7t8BIGhiurOf8Mc9NlYgSV4KuftVt+kHBgeNPw+CSLWDqaWLBFcQxdcymvf890lBvTTWsivZAio+J9FGqt4DLOy3seM16lMDHWlw+g5b69sAreSQU7jxqwLsEvxo7uSDYItdUjERPrnTmYHquTXeZ4sJeK+o0ryd1nGqhIMmMInZsZSvod9lzOJV\/RRRur\/42Dj8rpJ7rJwCBAF3LbQFDg\/WGjdRpXqHDNIv0mftuotwrnUjFLwWMM\/XYa4jVaz58KEIQQCY+lq6SGehaT1MckNzem1Ljms3384mzm4TuHzHbb+Hxuf9NrSf8GZPkMDUDaxOCbFfdBxrine+0rM4bedtXKgvGJw62rRLXuKIhvVc7kR7wV891X2WounnBJISxBgBARbdP8wM53Hx2PVlBcDAQVgVQ8wbgcYEb1o5lZDD08EkRS+7JcR\/qUEd+T\/AYBnG2A3M4eoBRAeGICxLex\/PUQfr+FCmQzvdwERaroBnzC03J7d629z6gyTa4CcDvMUDdzKd9F7SGJzyAI8ZwBXJBBIiOQJhFIUuXsHaU5jfdMT017bTrRwNzmKlvC\/mqSjOz6tZPPRHeNcoX10Y4LAFDLKinF4FXWZH0GwcSbV8UPdW+9t1mZ7JKQCNTSyM76CmNxGORxa\/NF90sL+5QXrVrX6BkP4SRc8MhNBpO5dcRUEj4xAWjNbFAk38vVnItPw6AVMXK1WnaqzTMfRzDZSmzxv0JxdIt32zW1o7xZLHjxLiszCKV41yUYJ88X1+6i7mFpA0iQKNFuBpeI9bIB5Ch7rykSP1zPljsNRu\/7CfPAxdUbdYgsqo1AN+7mTUms1xmo8aMKLniqN1tLugH63OF\/OTHM9Hch7b7MBINBP57MLDVuVAdOerMl1NhMsMq5B4PzzXWGAwoRblzlWjdGWaEJQAwiXvay0g\/VBdTAUhF5YzbhhRGUAygNeKPqX+Z3BjGbuEVxfOuxyhB3SjsUH72aE2w7uC5bHcPDFGaLHZ6xKVBeIe391engCad8zqo5SKJuopRyg5grgUHr1o2KaIhArDwBNyYsIE7lWK7eWVy921xbIjZ5KhlDwJwQwwxkw\/EKmJ3S3ofgT5LNLKoJ+CB7rUT5EQ6lhvLJjouxdeiomKcRMKhZL3W42ltK4gRFDiNRmaE\/28fsw7tjDP\/Ky1leYZ6tgoTJYRnL7o4H7xqQczQcy+rK4b2G9i511UDp\/UXwIUeBBX6ZJMVKRV+nESRD\/uj\/lEnJCjri84eVbpQNHNIQhyWG2kKHokRsOFgLkhgPrAzrS\/ZBtLeq0MIsD1i576x2CXVCwB3y\/Z09uVygY1PIog13y+P\/dRMX\/FIz+lIjb6gqnN5SJAT4+apbOPty4bbJ2k7EX4Izov1NuHz49a6aybV5+Zi4hPUEHIOtDOng24pmURtEb8QslPUevMPCnRQN9npcPf9r3i5imItyaa18QouJHhH8VU68Z7Ba5cLj3ihPQzBUh7YpvhuLQY4Mr\/1WpSRrwKG5YyAQPEUJ\/a+CGraThOSAPr9DvJa\/cs+Gp8qYFixe+UvMBuC7u6OgfUvlDzxaeiER\/mtBXTxlo4PpwKK4jWDYiZxPmVq7pmfGUToPvQ+GttK+ZN\/SNvKOsmLdloN6mjepuFDNKNLE5iUc1QWcWxXp9DS1DDGj83M3n1r+GiWbkbEnoo5dnbiJWRqsBn+Dd25LYBa+t1zjR5q6iY\/fN6\/On+h7jJfmi65LCNyMrn6OTwrUV4okhFcmlo0usnJ0XuQFW85znaiaJk7hcq3RbaYSeNVx24JSNHXu8CoZHRXov5eFa55n5zCOP+JQCgyDkHrilQAxGdTaA8LsisYCWwdzrrn4Crf0GGWS2LAFtEF6EorU\/Ven2u2Dpb+wzNW9tXYXaxMWH34ZK1YuzR4aZFKs2FWFw+yVvId\/AZKTtp3UUpImKNQwa27CzyQKR3XzSE3uj2WX3FqGjgLr2pcbwvPzqw1VfZveicv9tMSgeDIDpk1crGaYay17YEbM0U0DEN4QWq2M7pvt\/lU2BSvWEKT6enLdz8AI1Sqg4pxSx8Q+ZTMYTqzs6Dr9K5hShgZJO4V6sJ6U3bgyJGq+DSRog9\/37Pg0lD4KtOUQgmQLwLvjVtLxQBkr1DSuOELSZPX+SKNghCreMZf62oInc8sDtoUzX1w519L6GH9225kk7ERGFQBlg6jhV6eYwtDiQy7GLogpRaRCFYmqYRKccgA12DIgWjLYHay2znREXAwEFYHD\/3FlE6PNaQkI9jkDDEvLXLqt3yuM\/DbjpOd\/rivjc4m5QwP9yh\/qNnBixgwGJjZ33cwl5\/H1skfiS07TQlMftVlirB6g4ic1YzHNJAKiYhqNqMVLrXoIwvhAJ4AajUxNN3\/13K7SZfPLTcD+oGZ7N9J96cisFRjDeLxXBMgqOyqWwFeRoWmBTT\/Kr2DRQPaWcomO3Lcbo\/Jed3BMsxWYC0iY2VRuZsmxbqCyqBRncRQv4\/7AEq5tShfZvASQgciFkGowyd+wRqWwxj\/h\/q9PZcNaioWUTfA3S71OxuScsIcEnw0sARxyMXTpIF5dyHA6lC7YiAfmZ3KJVKh8IrS1dNm+WhkAAzAFMHX3kZIOG6rIqT869XsbhjVmftjO2ois9R7AtITzqVns2hjq0bC52m4fmlKb3zdUiWkHqImzs3bzbuNFEEHZiwe8CrOW1dVcbYOIDiho4bo585XIyRrWsDPkGdwiQlc3ambCtvPTa+yj54rfet97m0ryB8qZT3jbHNf7M6\/Kqc+cdZMuUfOmycpV0\/R39H6DTe\/NkdXMRBO8yNb9iTNzcuqpEJPIuXcELVWg7JUOMm87XFdhpiRLUJLb\/sUOIusvW+BKjXeDnqRiHLbm79ZK0dq3CGRkLJdyfhwKcUw3aHpmrklnBU4X\/HvNmCzWI0QZyCL6Z2uLsw2Guaiyq\/V0CpwtAHsaxgb54kEs4qDx229b6m70NGQfkXqY1RKtfGZSRbL+oZgZ+Uag69IefeZWoBSyPzRjgG1M2tMtviVxsTiKzMApy1E6FUmzePD2XKFPiAHrBB5y2dE0xnphCGtkwZeMFjw\/gKdK3ECxyVG2rGUJi9\/CPMj4mZz+uLk3jmBO9u3SOX4zopLWT0IgNPpRAFEtRutSSLjXiPZ+0U32AHj6RPMmZu5\/8B4+oWCqqyQO6AUWhC636zyhK0LD3GzB8ivAW7zyjb4R9gtrMNIsksLEVp6fa5NHU8q9M5FJF\/h1T3jvlOXbXEnvOKFNDqHgBBBDdvWZlnDzpdXCFV2xLToJ4CxM0yf3UCxSJXvpscawrSyZ3QUjX8YmGmhGW9rfxp9AfPy2QDKGGsprT7PQCxFwSugPyDhgG\/LH2jK3sbB6zGZeZ9FMVw5ZaEsB3JXVanm4e7XXRPAHj3YKBzGG9Tw5HL2\/K0+CUpul23ZbjIRQM8\/tSnGY1ywFpNkX7Y1W2IfpOBI7KFzX9TF9VEE7PiDZcqvaTGOA4\/eAqtZT\/mGDprJvxjtckxk0JG8v8QRDJy8KNfPTjc4QpDfs6Oz\/MwuNBAiX7sjydWiv1kh4EtmXd3F+GDn1LUiNUVH\/yyzN+QQ96afTLdR5WGWtc\/WSyk4vVlWB9c7pLCJnW\/fny7WR52RR2v9lJCX68IUfz9ErFMTMNCrkoPripWrysQ6Bz\/OttAUCFDIQ3fQoiYRGj\/o+W\/Q0r7B+CMBFZ7CPUGQ6JglNQspEF\/YLez96AJ6\/nntxg7Ju7n1hVFYLfu8vZbxi932IxeY2qfSOY38UdnSr4Fv2m25lrAx\/h6D9O7RzacHd9kgbadWYZjzM3RSo1dZWHycOVLtzAe7vN9GA2wkokhf19rIIzNnCKbb7Ostce+7Ig1jGmUwLMPHeqgUj8qXHy28dFIiBlzuxGJMG5IZfZqsFdlQVNfPGYBCxvf7lNtn8m43kEj6JM+gqJTxBTuW7RWVebiykN4P14YQmOzKROtWy0TaivfUujEmxzwopbWj+FFA4dXElDjq+c+NCv6WwTqq2KnLkFRFiARsdydwSEGV9y3eEwMldP1z1MxliNuwp6DmHENall7EIFfhZ+z4YTES\/JnHEnFwMBAiBBF1uurGrByHr+4t1R1epIcy52Sce2ujuiKlqZvktniP+SSVsTbZRDkgTt9DtdSBdB8lCxsJQSk8qREy0Icl0tKFuBqJWB5KbqbAkIhRoCjCOZrDu8O974BQDSrAex3T0Xlz2QFMk+5rcWAwMpfy7bSk2mI33hjWvxh6Tl3YXYjgJPKtttznSUbUUDVmk+8uMamP3d4XddjMSmHicrjVVWHaikYUC4Cd9OFoiw8yyNTJwDOywE9D9M606m6jnht3dfx08Xu73+7eSpMeU+a0tdeU72VVHgpvrzR3RLW5QFqA7xs+BlqVm6x0N3G0zBh51CXes6jDIrSZB6oi9fs5DGqxL9FN7g2BCwKDtn5C8qwSaH\/GB5CRIEOI\/eqfmXXanpQUJCZuH\/5JKpVOhos9OVPHLiFvCRZ9l+vvkL0zUxS\/Pi02ztJ27gUXRUCpnldKr0Gf3uTV+YigWxsPihOmMCrIaMVWHMyGXFUXtlqChxrwXlAFaCyqQGRzXy40DsDIWvyb\/I6LDg9EcyMXNbilu6yjukH9p4A13\/6PvZgTxX8QJRsS7TQAOhuTCtLX2tbD67bo+P1d8WPWTKqG51Uw3LrBhwofzD4sUgwmhbnftTdCfMd4n8vAfsVHzQm1uCfTyYir8wxb78lR\/gPHuXOouI7xOffJZNd85yU3DlsLHF6yN1QmXFlEk2q6fW2JtMrsgWoL5xNmj741B0E1bu6APf"} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":12,"flow_first_seen":1444570699096,"flow_last_seen":1444570740249,"flow_tot_l4_data_len":1383,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59756,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":10,"flow_first_seen":1444570699101,"flow_last_seen":1444570740248,"flow_tot_l4_data_len":1051,"flow_min_l4_data_len":20,"flow_max_l4_data_len":517,"flow_avg_l4_data_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"78.46.237.91","src_port":59757,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":22,"flow_first_seen":1444570637191,"flow_last_seen":1444570733113,"flow_tot_l4_data_len":14608,"flow_min_l4_data_len":664,"flow_max_l4_data_len":664,"flow_avg_l4_data_len":664,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"172.16.1.75","src_port":64538,"dst_port":5060,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":8,"flow_first_seen":1444570675941,"flow_last_seen":1444570690940,"flow_tot_l4_data_len":367,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51833,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":8,"flow_first_seen":1444570694561,"flow_last_seen":1444570709697,"flow_tot_l4_data_len":367,"flow_min_l4_data_len":20,"flow_max_l4_data_len":207,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51839,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":50,"flow_first_seen":1444570716599,"flow_last_seen":1444570737975,"flow_tot_l4_data_len":8660,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51857,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Webex","breed":"Acceptable","category":"VoIP"}} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":3,"flow_first_seen":1444570719041,"flow_last_seen":1444570720045,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51859,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_tot_l4_data_len":627,"flow_min_l4_data_len":13,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","ndpi": {"proto":"Webex","breed":"Acceptable","category":"VoIP"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":16,"flow_first_seen":1444570718801,"flow_last_seen":1444570739041,"flow_tot_l4_data_len":627,"flow_min_l4_data_len":13,"flow_max_l4_data_len":50,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.229.158","src_port":51772,"dst_port":9000,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":17,"flow_first_seen":1444570638225,"flow_last_seen":1444570642072,"flow_tot_l4_data_len":5797,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3717,"flow_avg_l4_data_len":341,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"216.58.208.40","src_port":43433,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":105,"flow_first_seen":1444570669736,"flow_last_seen":1444570738301,"flow_tot_l4_data_len":15716,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":513,"flow_first_seen":1444570669745,"flow_last_seen":1444570732084,"flow_tot_l4_data_len":326644,"flow_min_l4_data_len":20,"flow_max_l4_data_len":29662,"flow_avg_l4_data_len":636,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51155,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":23,"flow_first_seen":1444570679512,"flow_last_seen":1444570680667,"flow_tot_l4_data_len":5859,"flow_min_l4_data_len":20,"flow_max_l4_data_len":2547,"flow_avg_l4_data_len":254,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55669,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":22,"flow_first_seen":1444570693238,"flow_last_seen":1444570694561,"flow_tot_l4_data_len":5807,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55671,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":11,"flow_first_seen":1444570732086,"flow_last_seen":1444570734115,"flow_tot_l4_data_len":343,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51190,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":22,"flow_first_seen":1444570712008,"flow_last_seen":1444570716597,"flow_tot_l4_data_len":5807,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3927,"flow_avg_l4_data_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.243.0.110","src_port":55687,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":8,"flow_first_seen":1444570640382,"flow_last_seen":1444570699865,"flow_tot_l4_data_len":396,"flow_min_l4_data_len":20,"flow_max_l4_data_len":236,"flow_avg_l4_data_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33511,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":24,"flow_first_seen":1444570738415,"flow_last_seen":1444570742172,"flow_tot_l4_data_len":35072,"flow_min_l4_data_len":20,"flow_max_l4_data_len":14339,"flow_avg_l4_data_len":1461,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51194,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":18,"flow_first_seen":1444570640385,"flow_last_seen":1444570699915,"flow_tot_l4_data_len":1360,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33512,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":5,"flow_first_seen":1444570738419,"flow_last_seen":1444570738426,"flow_tot_l4_data_len":183,"flow_min_l4_data_len":20,"flow_max_l4_data_len":83,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"62.109.224.120","src_port":51195,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":21,"flow_first_seen":1444570699916,"flow_last_seen":1444570700460,"flow_tot_l4_data_len":1816,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":86,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":20,"flow_first_seen":1444570700561,"flow_last_seen":1444570713719,"flow_tot_l4_data_len":1795,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33553,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":18,"flow_first_seen":1444570700563,"flow_last_seen":1444570713710,"flow_tot_l4_data_len":1360,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":13,"flow_first_seen":1444570713719,"flow_last_seen":1444570715293,"flow_tot_l4_data_len":1291,"flow_min_l4_data_len":20,"flow_max_l4_data_len":556,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"80.74.110.68","src_port":33559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":30,"flow_first_seen":1444570699074,"flow_last_seen":1444570740247,"flow_tot_l4_data_len":8548,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":284,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"54.241.32.14","src_port":46211,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":95,"flow_first_seen":1444570624853,"flow_last_seen":1444570630376,"flow_tot_l4_data_len":89006,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17700,"flow_avg_l4_data_len":936,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41346,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":56,"flow_first_seen":1444570627404,"flow_last_seen":1444570630162,"flow_tot_l4_data_len":107792,"flow_min_l4_data_len":20,"flow_max_l4_data_len":17986,"flow_avg_l4_data_len":1924,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41348,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":11,"flow_first_seen":1444570628113,"flow_last_seen":1444570628619,"flow_tot_l4_data_len":639,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41350,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":9,"flow_first_seen":1444570628117,"flow_last_seen":1444570628568,"flow_tot_l4_data_len":599,"flow_min_l4_data_len":20,"flow_max_l4_data_len":247,"flow_avg_l4_data_len":66,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"64.68.105.103","src_port":41351,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1580,"source":"webex.pcap","alias":"nDPId-test"} diff --git a/test/results/websocket.pcap.out b/test/results/websocket.pcap.out index ae4938f68..9adb4fd7b 100644 --- a/test/results/websocket.pcap.out +++ b/test/results/websocket.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"websocket.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"websocket.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1475155931028,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.43.135","dst_ip":"192.168.43.1","src_port":12345,"dst_port":50999,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"websocket.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1475155931,"pkt_ts_usec":28697,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"AFBWwAAIAAwpij2nCABFAABB27JAAEAGhyvAqCuHwKgrATA5xzc8ilRnydSxV1AYAO1IlQAAgRdXZWxjb21lLCAxOTIuMTY4LjQzLjEgIQ=="} 00510{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"websocket.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1475155931028,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.43.135","dst_ip":"192.168.43.1","src_port":12345,"dst_port":50999,"l4_proto":"tcp","ndpi": {"proto":"WebSocket","breed":"Acceptable","category":"Web"}} @@ -7,3 +8,6 @@ 00483{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"websocket.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1475155946,"pkt_ts_usec":903705,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"pkt":"AFBWwAAIAAwpij2nCABFAABc27NAAEAGhw\/AqCuHwKgrATA5xzc8ilSAydSxaVAYAO0tVgAAgTIyMTozMzo1MiAoJzE5Mi4xNjguNDMuMScsIDUwOTk5KSBzYXk6IHRlc3QgbWVzc2FnZQ=="} 00436{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"websocket.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1475156008,"pkt_ts_usec":638608,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"AAwpij2nAFBWwAAICABFAAA9BeZAAEAGXPzAqCsBwKgrh8c3MDnJ1LFpPIpUtFAYP+K7sAAAgY+3zv1X36uRO9juijLVvZI03KuJ"} 00486{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"websocket.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1475156008,"pkt_ts_usec":657690,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"AFBWwAAIAAwpij2nCABFAABf27ZAAEAGhwnAqCuHwKgrATA5xzc8ilS0ydSxflAYAO0H8wAAgTUyMTozNDo1MyAoJzE5Mi4xNjguNDMuMScsIDUwOTk5KSBzYXk6IGhlbGxvIHdlYnNvY2tldA=="} +00505{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":5,"source":"websocket.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1475155946892,"flow_last_seen":1475156008657,"flow_tot_l4_data_len":226,"flow_min_l4_data_len":38,"flow_max_l4_data_len":75,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.43.1","dst_ip":"192.168.43.135","src_port":50999,"dst_port":12345,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5,"source":"websocket.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1475155946892,"flow_last_seen":1475156008657,"flow_tot_l4_data_len":226,"flow_min_l4_data_len":38,"flow_max_l4_data_len":75,"flow_avg_l4_data_len":56,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.43.1","dst_ip":"192.168.43.135","src_port":50999,"dst_port":12345,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":5,"source":"websocket.pcap","alias":"nDPId-test"} diff --git a/test/results/wechat.pcap.out b/test/results/wechat.pcap.out index e819117cb..35f6d2493 100644 --- a/test/results/wechat.pcap.out +++ b/test/results/wechat.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wechat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wechat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1492167337792,"flow_last_seen":0,"flow_tot_l4_data_len":636,"flow_min_l4_data_len":636,"flow_max_l4_data_len":636,"flow_avg_l4_data_len":636,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54084,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 01239{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167337,"pkt_ts_usec":792745,"pkt_caplen":670,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":670,"pkt_l4_len":636,"pkt":"eJKcD6iO8IQvSpdgCABFoAKQLFpAACwG+e7LzZeiwKgBZwG700RsJQvmFiW5B4AYAQBhCAAAAQEICkXRlQMAMKrIjxNPGb1b2gIOFmmrodrIUGWpRD8pBe\/eyANOuHxnf1oEiCDKQxkU6yvgqiltC85O1YOlf4+boaZn\/v7U0TkR+lQ9a8XEdMtbUDNvRkN1lpLANNJe9T6WEXQRZhhQATyvHXIsPxznFQlv1ayF4fN0Lp1Tv+DnMtPovG4l64Fdnf94BKNh3wpUis\/1aaAJUl4N4QYAa2BN+MLHUIjBfzQomk58kbDVZlQvabo4eeiFrJQbG0CRtmIDLIV4UlMABwm2B+L0SD\/lX+vPdRjlbT0hOePKWkrPVp4oa0GnGMtovp\/3dKKj2adHC1yCvZqzc+T4heafDFJJDxNGnnTZtJeXWQW2\/Wn0xAXZa5xeVmiob7mVi7gQwqB4EyVdzoi+MdLqv1I0FdZ7WKuu9o+r6i7T5KxQ7NhUIRC9KEInuscbFfTp5tcTpkg81VRtJhveR07GYTrLSFchnUCEzbFpCOPEOlfHshGkgemcZqUW0JSeBZoVIhGHuP8IElk+zTdckKSFR7XZosRv+JZpXULghhsYEQIcWSnXEwiNwHqD7SkijDTYTSRARplFy3lQ+I9PYai9e3wxDdj38dt3ZjnYHW+Jgcvyxa81TfaFhCzMBo8JWYVcQLLQCzJJ7po8hcjxwSKSvs1BzLjoAmGIOQCY3cD2niwBo4mLwkfrwM7iYYbbTgCByxdl2XUzXKGTmMiV+yqiF1sadTUF0KDk8zQPlxqASeejWTULCaKDKO7zq0WMvrWWgtPS5+WycvqXy24tfwXRN6su4lzlC8cmzA\/wzbACdxOu6m0puRk6CDMzrA=="} 00421{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167337,"pkt_ts_usec":792797,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0B7NAAEAGDZLAqAFny82XotNEAbsWJbkHbCUOQoAQAk6qQAAAAQEICgAwqxZF0ZUD"} @@ -1282,3 +1283,19 @@ 00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":134,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171291,"pkt_ts_usec":761740,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIMrNAAEARgzzAqAFnwKgB\/tELADUANPxl\/4EBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20DbGFuAAABAAE="} 00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"webpush.web.wechat.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":4,"flow_first_seen":1492171250302,"flow_last_seen":1492171253304,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171268600,"flow_tot_l4_data_len":944,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171268600,"flow_tot_l4_data_len":944,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_first_seen":1492171274388,"flow_last_seen":1492171274388,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42856,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00451{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":3,"flow_first_seen":1492171206877,"flow_last_seen":1492171210973,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} +00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171269750,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":45366,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":4,"flow_first_seen":1492171250302,"flow_last_seen":1492171253304,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":2,"flow_first_seen":1492171268754,"flow_last_seen":1492171273759,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43705,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":2,"flow_first_seen":1492171290232,"flow_last_seen":1492171290232,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":41759,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_first_seen":1492171269383,"flow_last_seen":1492171269383,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44063,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":2,"flow_first_seen":1492171178741,"flow_last_seen":1492171183746,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":56367,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":2,"flow_first_seen":1492171268427,"flow_last_seen":1492171273433,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42074,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test"} diff --git a/test/results/weibo.pcap.out b/test/results/weibo.pcap.out index e538e3ddb..f5c0ac0fe 100644 --- a/test/results/weibo.pcap.out +++ b/test/results/weibo.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"weibo.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"weibo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1463089067804,"flow_last_seen":0,"flow_tot_l4_data_len":145,"flow_min_l4_data_len":145,"flow_max_l4_data_len":145,"flow_avg_l4_data_len":145,"midstream":0,"l3_proto":"ip4","src_ip":"216.58.210.14","dst_ip":"192.168.1.105","src_port":443,"dst_port":49361,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00578{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"weibo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463089067,"pkt_ts_usec":804779,"pkt_caplen":179,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":179,"pkt_l4_len":145,"pkt":"eJKcD6iOkDVu60UQCABFAAClAABAADMR2u3YOtIOwKgBaQG7wNEAkSEpAAl3y2T5ujTCSSEU5zJMPfXh7u\/a3oWq2yhhK1m4ny+qR4W2lfILr6Ils4h\/iqKUCkI0zipqePuQ8qDP3gfa2UEwOgxjQY6zEBJhdLLCAKezbAF+wpbNcZnrqI9Vp3iRS5CpzEuDxhuTRv5J009cEtkCA6nVS0D6WXhVs+S9\/EHIHeXl6YD1cbA="} 00813{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"weibo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463089067,"pkt_ts_usec":804822,"pkt_caplen":353,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":353,"pkt_l4_len":319,"pkt":"eJKcD6iOkDVu60UQCABFAAFTAABAADMR2j\/YOtIOwKgBaQG7wNEBPzHaAAoUu93Ovdfsj+VZ99cgMeSVKfCKokSNRuOMv1PGF2DIkukcXrUmGkv\/ArCiq\/KK23NXKqXH3z8FxKfa8OQtN5x73GaADweitAmqYsU072yu9KsRUtnFIEIB5Y5LqWVX6vqXepSvfYCEhodq+tUiz0aSzdffkeHhLztt20iOOpChbjrtXhyjh2xOYPCWGl\/75gN\/zEEb2R9h09zfr5IUCExPcV8JWIdoh2fXU4mq9qytwCU0GOdjsWy12v2HhTBnSYnXaFz8kW\/ToyswW6z6hT26xiqWB5RJW9cvGUU8G6jKCXTHHR5WczEJ7NLt9QErBQKutf8Nh4rVBXW1avPgj1A0tNYSKXAcYt1eYGsw4tjOzS7DHafUDgikSZ+H9BNuGGXb1gwh45909vW3665ubMpNt9lmWoI="} @@ -276,3 +277,69 @@ 00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":441,"source":"weibo.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1463089073789,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47723,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":441,"source":"weibo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463089073,"pkt_ts_usec":789999,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"kDVu60UQeJKcD6iOCABFAAA8F+ZAAEAGKbjAqAFpjM2qP7prAbvY7h2OAAAAAKACchAfhQAAAgQFtAQCCAoAQQpoAAAAAAEDAwc="} 00423{"flow_id":32,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":492,"source":"weibo.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1463089073,"pkt_ts_usec":885851,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iOkDVu60UQCABFAAA0e6lAADgGIFddvIb2wKgBaQBQi+OyanX2+fqAX4AQAqSCEQAAAQEICgN2DmEAQQo9"} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1463089073394,"flow_last_seen":1463089073773,"flow_tot_l4_data_len":540,"flow_min_l4_data_len":20,"flow_max_l4_data_len":448,"flow_avg_l4_data_len":135,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42275,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1463089073537,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42280,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1463089073537,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42280,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1463089073286,"flow_last_seen":1463089073393,"flow_tot_l4_data_len":172,"flow_min_l4_data_len":47,"flow_max_l4_data_len":125,"flow_avg_l4_data_len":86,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":18035,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1463089070757,"flow_last_seen":1463089070841,"flow_tot_l4_data_len":86,"flow_min_l4_data_len":35,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":54988,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1463089071730,"flow_last_seen":1463089071755,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.212.69","src_port":37802,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1463089071730,"flow_last_seen":1463089071755,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.212.69","src_port":37802,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":106,"flow_first_seen":1463089072445,"flow_last_seen":1463089073885,"flow_tot_l4_data_len":73299,"flow_min_l4_data_len":32,"flow_max_l4_data_len":4340,"flow_avg_l4_data_len":691,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35803,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":72,"flow_first_seen":1463089072445,"flow_last_seen":1463089073773,"flow_tot_l4_data_len":51833,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2904,"flow_avg_l4_data_len":719,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35804,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":41,"flow_first_seen":1463089072445,"flow_last_seen":1463089073819,"flow_tot_l4_data_len":21851,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":532,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35805,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":13,"flow_first_seen":1463089073319,"flow_last_seen":1463089073551,"flow_tot_l4_data_len":4259,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":327,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35806,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":53,"flow_first_seen":1463089073321,"flow_last_seen":1463089073852,"flow_tot_l4_data_len":34666,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":654,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35807,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":3,"flow_first_seen":1463089073322,"flow_last_seen":1463089073383,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35808,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":3,"flow_first_seen":1463089073322,"flow_last_seen":1463089073383,"flow_tot_l4_data_len":112,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35808,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":35,"flow_first_seen":1463089073334,"flow_last_seen":1463089073893,"flow_tot_l4_data_len":21171,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1468,"flow_avg_l4_data_len":604,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35809,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":5,"flow_first_seen":1463089073424,"flow_last_seen":1463089073885,"flow_tot_l4_data_len":574,"flow_min_l4_data_len":32,"flow_max_l4_data_len":430,"flow_avg_l4_data_len":114,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35811,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00520{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1463089071994,"flow_last_seen":1463089072138,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"54.225.163.210","src_port":40440,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_first_seen":1463089071994,"flow_last_seen":1463089072138,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"54.225.163.210","src_port":40440,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1463089069330,"flow_last_seen":1463089069374,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.214.78","src_port":58480,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1463089069330,"flow_last_seen":1463089069374,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.214.78","src_port":58480,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1463089070086,"flow_last_seen":1463089070131,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.214.78","src_port":58481,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1463089070086,"flow_last_seen":1463089070131,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.214.78","src_port":58481,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1463089073479,"flow_last_seen":1463089073635,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":20,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"47.89.65.229","src_port":50827,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":3,"flow_first_seen":1463089073537,"flow_last_seen":1463089073759,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"47.89.65.229","src_port":50831,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":3,"flow_first_seen":1463089073537,"flow_last_seen":1463089073759,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"47.89.65.229","src_port":50831,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1463089073764,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47721,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1463089073764,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47721,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00495{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1463089073789,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47723,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1463089073789,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47723,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1463089073287,"flow_last_seen":1463089073488,"flow_tot_l4_data_len":118,"flow_min_l4_data_len":40,"flow_max_l4_data_len":78,"flow_avg_l4_data_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":53466,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1463089073287,"flow_last_seen":1463089073478,"flow_tot_l4_data_len":175,"flow_min_l4_data_len":38,"flow_max_l4_data_len":137,"flow_avg_l4_data_len":87,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":51440,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1463089073760,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52271,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1463089073760,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52271,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1463089073760,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52272,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1463089073760,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52272,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1463089073788,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52274,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1463089073788,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"42.156.184.19","src_port":52274,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1463089072333,"flow_last_seen":1463089072444,"flow_tot_l4_data_len":198,"flow_min_l4_data_len":41,"flow_max_l4_data_len":157,"flow_avg_l4_data_len":99,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":53543,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_first_seen":1463089072885,"flow_last_seen":1463089073423,"flow_tot_l4_data_len":196,"flow_min_l4_data_len":40,"flow_max_l4_data_len":156,"flow_avg_l4_data_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":41352,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1463089073424,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":16804,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1463089072046,"flow_last_seen":1463089072070,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.212.65","src_port":34699,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_first_seen":1463089072046,"flow_last_seen":1463089072070,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.212.65","src_port":34699,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1463089073488,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48352,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1463089073488,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48352,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1463089073488,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48353,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1463089073488,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48353,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1463089073537,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48356,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1463089073537,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.174.1","src_port":48356,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00485{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1463089071551,"flow_last_seen":1463089071612,"flow_tot_l4_data_len":147,"flow_min_l4_data_len":39,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":7148,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1463089073289,"flow_last_seen":1463089073763,"flow_tot_l4_data_len":174,"flow_min_l4_data_len":42,"flow_max_l4_data_len":132,"flow_avg_l4_data_len":87,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":33822,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":9,"flow_first_seen":1463089067804,"flow_last_seen":1463089068491,"flow_tot_l4_data_len":1638,"flow_min_l4_data_len":43,"flow_max_l4_data_len":626,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"216.58.210.14","dst_ip":"192.168.1.105","src_port":443,"dst_port":49361,"l4_proto":"udp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":9,"flow_first_seen":1463089067804,"flow_last_seen":1463089068491,"flow_tot_l4_data_len":1638,"flow_min_l4_data_len":43,"flow_max_l4_data_len":626,"flow_avg_l4_data_len":182,"midstream":0,"l3_proto":"ip4","src_ip":"216.58.210.14","dst_ip":"192.168.1.105","src_port":443,"dst_port":49361,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":9,"flow_first_seen":1463089070841,"flow_last_seen":1463089071891,"flow_tot_l4_data_len":1293,"flow_min_l4_data_len":20,"flow_max_l4_data_len":655,"flow_avg_l4_data_len":143,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"114.134.80.162","src_port":59119,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_first_seen":1463089070841,"flow_last_seen":1463089071198,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"114.134.80.162","src_port":59120,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":3,"flow_first_seen":1463089070841,"flow_last_seen":1463089071198,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"114.134.80.162","src_port":59120,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_first_seen":1463089071008,"flow_last_seen":1463089071348,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"114.134.80.162","src_port":59121,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":3,"flow_first_seen":1463089071008,"flow_last_seen":1463089071348,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"114.134.80.162","src_port":59121,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1463089071046,"flow_last_seen":1463089071094,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.210.206","src_port":35154,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1463089071046,"flow_last_seen":1463089071094,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.210.206","src_port":35154,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":14,"flow_first_seen":1463089070755,"flow_last_seen":1463089072356,"flow_tot_l4_data_len":1698,"flow_min_l4_data_len":33,"flow_max_l4_data_len":399,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.210.227","src_port":53656,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"Google","breed":"Unrated","category":"Web"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":14,"flow_first_seen":1463089070755,"flow_last_seen":1463089072356,"flow_tot_l4_data_len":1698,"flow_min_l4_data_len":33,"flow_max_l4_data_len":399,"flow_avg_l4_data_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"216.58.210.227","src_port":53656,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1463089073479,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":50533,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":79,"flow_first_seen":1463089071613,"flow_last_seen":1463089072438,"flow_tot_l4_data_len":34806,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2904,"flow_avg_l4_data_len":440,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.137","src_port":51698,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00486{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_first_seen":1463089073287,"flow_last_seen":1463089073760,"flow_tot_l4_data_len":166,"flow_min_l4_data_len":43,"flow_max_l4_data_len":123,"flow_avg_l4_data_len":83,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":50640,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00472{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1463089073394,"flow_last_seen":0,"flow_tot_l4_data_len":43,"flow_min_l4_data_len":43,"flow_max_l4_data_len":43,"flow_avg_l4_data_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":11798,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test"} diff --git a/test/results/whatsapp_login_call.pcap.out b/test/results/whatsapp_login_call.pcap.out index a87195cc0..d80207f0f 100644 --- a/test/results/whatsapp_login_call.pcap.out +++ b/test/results/whatsapp_login_call.pcap.out @@ -1,3 +1,4 @@ +00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432582222253,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582222,"pkt_ts_usec":253233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkAPS5Jrv0CABFAAA0DNdAAEAG9U7AqAIEEaxkRsAvA+GIPSCcUlOPyIAQH\/poTQAAAQEICi36Gt0QlQ1l"} 00669{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582222,"pkt_ts_usec":267722,"pkt_caplen":236,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":236,"pkt_l4_len":202,"pkt":"xiwDYGpkAPS5Jrv0CABFAADeU1tAAEAGriDAqAIEEaxkRsAvA+GIPSCcUlOPyIAYIAB\/kgAAAQEICi36GusQlQ1lFwMBACCNqYpymgjJuQNgLA+QJekfsmHWqykdlwnJ8t48lRIpCxcDAQCAv+6eyOO6KHhFdGRnKCRyPqihrwnYLrpV5EXpUrXv8Q2ow7fiZ\/ErfHE9ZAprbeZEb1cjDczzZ9GWtg7wUDK1rjYT+gKbhCMZiNQZ3QlWly2tQPPw5M7rqWdzOWy2ATMXqxCkXOBCTdOBYD70ikDCSIjo2fZ8\/cJDhiGvSnc\/9Rw="} @@ -510,3 +511,40 @@ 01075{"flow_id":62,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1229,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":687697,"pkt_caplen":530,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":530,"pkt_l4_len":496,"pkt":"xiwDYGpkAPS5Jrv0CABFAAIEb8xAAEAGsmjAqAIEEa1CZsA1Abt+ckvSpMYnIVAYQADR\/AAA07qQm4Ep0AfMbjrgKekirE5be9v5Y+Wt1PAp6dI+Z4ARIiX+eLC+79A323Mj0KuVlIUDWrBIBcROtFlN8VfWaN6sa6B4XXFVLwUe0Z6ZpuPy1HV799SBD5vvu55T\/4RCUUJeV7GbDbY6PVaSFFTT\/atC0jn9rxns6y18hbmv204g\/nVtLhL2hXSK9HiYbtGUwLztMxPbS4LvHc9A0b0+bqvvDEt6LkjqI+Lesoe6b62pKL3IKBvorYENnF9qHSxNOwlsPgMzRVlLbyimWNNZrcer1C1CRcGG+V7wbob1Zc+UVhgBegrhOir\/rgKxmBs\/FiTnInvI7cRUb3h\/bi3xfbINMNlah26Uv0uiKT7EWR8k5couZdKk2WeQJlhB1w8YvLDsunijXRN8qDZSMsKf7YZYHjUEAqXOzU5sAtM\/j+dylKKWaW99TJ9g4jbuk9ahXioY6kRV2A4pl\/x\/Xrb2WswFT2Bfy0iDYza1TjQWnW0J5l5uKypI0UPG0FBTQI+k7I9+xQQFSfOk7eagGIZ6Zs9e57jwNDdoJi3JRJJg+B2ZiMgsFQXq+s+nh7MSkUoWNiE5Iy4AvjFRsiVz\/xxUbdH8A05OcaYBow\/2+b462kjuJvVq+zWN4by\/ndM="} 01184{"flow_id":62,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":688132,"pkt_caplen":610,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":610,"pkt_l4_len":576,"pkt":"xiwDYGpkAPS5Jrv0CABFAAJUH0BAAEAGAqXAqAIEEa1CZsA1Abt+ck2upMYnIVAYQACaaAAAFwMDAidAn5TunsQA5kB6eBA6g9VebaQimygge\/hXxshDmXRvwQVxcO663ZsQaekX+f80ePuR+K9BmrVgK40BYDnAvd76Ifg1Hsr2ur8Ya5z\/7qa+b5\/rMR2QCAm46uYlis8Zy0kaEW82czqkG+fl2OAgiTpTqFnur1H24\/0Z3BSCXUJ294H3IU2S9xMMpwsN66IU6b8DiPQuBLRwhQ0mMGkbHqfOeH\/z7QZyHnmy9a9\/cJAbxn+onX9l7QdoUMt5zp09X0vLmEmPoDCaLpEhVsYaeag8jYxc1E5XNObgOXL99cq82NpNcuXbusdHw3T6PDZ7exko+xpxaFKwt3a5wYM8fe2qiUNDr63QUj1ROaNzmC1xkBO+1jW\/7CUW9lpVcwEAoFcFNgN8O33NHJA8vWZBoZ\/DYapcjdQupgM9e6isfgDmZiKATgDeqypQr+xd5\/LxyU\/RaPY9WOrIA8tPoSbI4N5AzqLxsVTHUngrFvnBCp+sgER84VU63qRZ4itrOD3FYJU3stRdg5YQfis\/d+tEZBlyoYJ4ATDZAj\/kcCuYRT77zCSFHuHOB1KTRYG0hb0q7Z2Ba4CvPQRRk6muSXX0kBVMJLBihtC5xn9TlKS5E5Or5xNT0IVCbJPzjDTyhTW9thsz5mXaXay20wG71jZ8jQuNobEb1Fi+sv60gljhkHSNO1\/hEvCWh2DnTZNjBOW5bAa6jz6\/T2KEhvp9xBSsYVBBh4QxUxKpxw=="} 00423{"flow_id":62,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582355,"pkt_ts_usec":822954,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"APS5Jrv0xiwDYGpkCABFAAAo0+EAAO8G4S4RrUJmwKgCBAG7wDWkxichfnJGDVAQC2k7VAAA"} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":10,"flow_first_seen":1432582271840,"flow_last_seen":1432582331780,"flow_tot_l4_data_len":3080,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":17,"flow_first_seen":1432582222253,"flow_last_seen":1432582223191,"flow_tot_l4_data_len":1420,"flow_min_l4_data_len":32,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":83,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","ndpi": {"proto":"IMAPS.Apple","breed":"Safe","category":"Web"}} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":17,"flow_first_seen":1432582222253,"flow_last_seen":1432582223191,"flow_tot_l4_data_len":1420,"flow_min_l4_data_len":32,"flow_max_l4_data_len":202,"flow_avg_l4_data_len":83,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.172.100.70","src_port":49199,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310666,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"173.252.114.1","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310666,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"179.60.192.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1432582284805,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"169.254.166.207","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":3,"flow_first_seen":1432582331561,"flow_last_seen":1432582331825,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.167.142.39","src_port":49197,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} +00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":3,"flow_first_seen":1432582331561,"flow_last_seen":1432582331825,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.167.142.39","src_port":49197,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310665,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.79.192","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":20,"flow_first_seen":1432582296339,"flow_last_seen":1432582310668,"flow_tot_l4_data_len":2313,"flow_min_l4_data_len":30,"flow_max_l4_data_len":297,"flow_avg_l4_data_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.84.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":5,"flow_first_seen":1432582296339,"flow_last_seen":1432582310667,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.74.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":5,"flow_first_seen":1432582296338,"flow_last_seen":1432582310667,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.90.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":5,"flow_first_seen":1432582296337,"flow_last_seen":1432582310664,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.93.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":5,"flow_first_seen":1432582296337,"flow_last_seen":1432582310664,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.73.48","src_port":52794,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":198,"flow_first_seen":1432582303300,"flow_last_seen":1432582311036,"flow_tot_l4_data_len":23686,"flow_min_l4_data_len":31,"flow_max_l4_data_len":518,"flow_avg_l4_data_len":119,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","src_port":52794,"dst_port":9665,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1432582284806,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c42c:3ff:fe60:6a64","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00524{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":180,"flow_first_seen":1432582227643,"flow_last_seen":1432582361929,"flow_tot_l4_data_len":18754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"184.173.179.37","src_port":49202,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":180,"flow_first_seen":1432582227643,"flow_last_seen":1432582361929,"flow_tot_l4_data_len":18754,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":104,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"184.173.179.37","src_port":49202,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":12,"flow_first_seen":1432582303186,"flow_last_seen":1432582310134,"flow_tot_l4_data_len":624,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"1.194.90.191","src_port":52794,"dst_port":51727,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":22,"flow_first_seen":1432582228503,"flow_last_seen":1432582353955,"flow_tot_l4_data_len":5178,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":235,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.110.229.14","src_port":49193,"dst_port":5223,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1432582284806,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":464,"flow_first_seen":1432582258730,"flow_last_seen":1432582268457,"flow_tot_l4_data_len":37144,"flow_min_l4_data_len":30,"flow_max_l4_data_len":491,"flow_avg_l4_data_len":80,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","src_port":51518,"dst_port":9344,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1432582227526,"flow_last_seen":1432582227594,"flow_tot_l4_data_len":262,"flow_min_l4_data_len":45,"flow_max_l4_data_len":217,"flow_avg_l4_data_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"192.168.2.1","src_port":51897,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":24,"flow_first_seen":1432582238792,"flow_last_seen":1432582267974,"flow_tot_l4_data_len":4009,"flow_min_l4_data_len":30,"flow_max_l4_data_len":324,"flow_avg_l4_data_len":167,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.93.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267973,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.79.192","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267973,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.91.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":5,"flow_first_seen":1432582238792,"flow_last_seen":1432582267975,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.73.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267972,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.85.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267971,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.64.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":5,"flow_first_seen":1432582238791,"flow_last_seen":1432582267970,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.70.48","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":5,"flow_first_seen":1432582238790,"flow_last_seen":1432582267969,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"31.13.100.14","src_port":51518,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1432582227595,"flow_last_seen":1432582227624,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":42,"flow_max_l4_data_len":170,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"192.168.2.1","src_port":52190,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":10,"flow_first_seen":1432582267983,"flow_last_seen":1432582311138,"flow_tot_l4_data_len":360,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"91.253.176.65","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":2,"flow_first_seen":1432582284805,"flow_last_seen":1432582285047,"flow_tot_l4_data_len":150,"flow_min_l4_data_len":42,"flow_max_l4_data_len":108,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::da30:62ff:fe56:1c","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":15,"flow_first_seen":1432582258587,"flow_last_seen":1432582267438,"flow_tot_l4_data_len":780,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"1.194.90.191","src_port":51518,"dst_port":60312,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":32,"flow_first_seen":1432582355253,"flow_last_seen":1432582356195,"flow_tot_l4_data_len":8617,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":269,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.173.66.102","src_port":49205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00141{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1253,"source":"whatsapp_login_call.pcap","alias":"nDPId-test"} diff --git a/test/results/whatsapp_login_chat.pcap.out b/test/results/whatsapp_login_chat.pcap.out index 6b39dec27..ba8a2cd96 100644 --- a/test/results/whatsapp_login_chat.pcap.out +++ b/test/results/whatsapp_login_chat.pcap.out @@ -1,3 +1,4 @@ +00396{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432582377898,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00471{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582377,"pkt_ts_usec":898864,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/xiwDYGpkCABFAABI56kAAEARDKvAqAIBwKgC\/+EV4RUANKgAU3BvdFVkcDCYJeGQmjjiDQABAARIlcID1NylhjSgAeWF26p2NNVFJFGe2SE="} 00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432582377898,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}} @@ -70,3 +71,12 @@ 01090{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":92,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582426,"pkt_ts_usec":553706,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"\/\/\/\/\/\/\/\/xiwDYGpkCABFAAISk3sAAEARXw\/AqAIBwKgC\/0RcRFwB\/jsJeyJob3N0X2ludCI6IDMzNzUzNTk1OTMsICJ2ZXJzaW9uIjogWzEsIDhdLCAiZGlzcGxheW5hbWUiOiAiIiwgInBvcnQiOiAxNzUwMCwgIm5hbWVzcGFjZXMiOiBbMTQ4MTkzMzcsIDE3NjA5OTYzLCAyMDY0OTM0OSwgMjg1MjE2MDcsIDU4MzQ0OTk2LCA2MDU5NDk4MywgNjQ0MzYwOTksIDk2ODUzMjI0LCA5OTQ2OTc3MywgMTAxMDQ3OTk2LCAxMDgxNTkxMDIsIDEyNTU0MDU2NiwgMTc2OTY0MzA3LCAyNDM2ODI5ODYsIDI0NzkyNTA4NSwgMjYwNDY1MjYxLCAyNzA0MDQ3NDIsIDI4Mzg2MTQ1NywgNDI0NTQwMTk3LCA0NDgzOTczOTMsIDQ1MTQ3MjY1OCwgNTExNzA2NjQyLCA1NjgzOTU4MzMsIDU5NDI0Njk1NCwgNTk4MDYxMDY2LCA2MTU5ODMzNzksIDcyMDA1ODM2MSwgNzM1MDUxODMwLCA3MzYzNDE1MjgsIDc0MTI1NTYxMywgNzc2MDg3MjQ3LCA3ODA4NzA1ODEsIDc4Mjk4MTk0OSwgNzg1MjY2MTc3LCA4MTg3NTI3MTAsIDg1NTY4MjM5MCwgODg0MTIwMTMyLCA5MDg5MTQ4NjhdfQ=="} 00524{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":92,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1432582426553,"flow_last_seen":0,"flow_tot_l4_data_len":510,"flow_min_l4_data_len":510,"flow_max_l4_data_len":510,"flow_avg_l4_data_len":510,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} 00650{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432582431,"pkt_ts_usec":565397,"pkt_caplen":220,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":220,"pkt_l4_len":186,"pkt":"APS5Jrv0xiwDYGpkCABFAADOJvMAAC8Gqw4RbuUOwKgCBBRnwCnUix1VuGhbLIAZAUnUJAAAAQEICm+JpTEt\/BtwFwMBAHDYSydR01U4MXShqjjP\/e6ozSqHDVuZ8Us7t5fLSxg\/JTSqTU1rbh5BP52nKbmElzpUYdGkXfEnn2PaHKB1t4LzV\/pkQ5JZxi+qRHMWxqelxwlH4daQC2wVBaO6VgWkkLBvXyNAW3gXtTuKympv3KY2FQMBACAIXcm+uxec4nsB2p08pVk5ZiggKezrR8Gc5wbiqdSlnQ=="} +00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":6,"flow_first_seen":1432582399902,"flow_last_seen":1432582425196,"flow_tot_l4_data_len":1848,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1432582426553,"flow_last_seen":0,"flow_tot_l4_data_len":510,"flow_min_l4_data_len":510,"flow_max_l4_data_len":510,"flow_avg_l4_data_len":510,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.1","dst_ip":"192.168.2.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1432582379543,"flow_last_seen":1432582379571,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":42,"flow_max_l4_data_len":170,"flow_avg_l4_data_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"192.168.2.1","src_port":61697,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00515{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":1432582379591,"flow_last_seen":1432582399306,"flow_tot_l4_data_len":1943,"flow_min_l4_data_len":32,"flow_max_l4_data_len":233,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"158.85.58.15","src_port":49206,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} +00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":30,"flow_first_seen":1432582379591,"flow_last_seen":1432582399306,"flow_tot_l4_data_len":1943,"flow_min_l4_data_len":32,"flow_max_l4_data_len":233,"flow_avg_l4_data_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"158.85.58.15","src_port":49206,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":6,"flow_first_seen":1432582411561,"flow_last_seen":1432582431565,"flow_tot_l4_data_len":1891,"flow_min_l4_data_len":186,"flow_max_l4_data_len":341,"flow_avg_l4_data_len":315,"midstream":1,"l3_proto":"ip4","src_ip":"17.110.229.14","dst_ip":"192.168.2.4","src_port":5223,"dst_port":49193,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":44,"flow_first_seen":1432582381179,"flow_last_seen":1432582385071,"flow_tot_l4_data_len":19875,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":451,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.173.66.102","src_port":49205,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":44,"flow_first_seen":1432582381179,"flow_last_seen":1432582385071,"flow_tot_l4_data_len":19875,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":451,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.4","dst_ip":"17.173.66.102","src_port":49205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00139{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":93,"source":"whatsapp_login_chat.pcap","alias":"nDPId-test"} diff --git a/test/results/whatsapp_voice_and_message.pcap.out b/test/results/whatsapp_voice_and_message.pcap.out index 5fb8f2338..9827125df 100644 --- a/test/results/whatsapp_voice_and_message.pcap.out +++ b/test/results/whatsapp_voice_and_message.pcap.out @@ -1,3 +1,4 @@ +00403{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1432820558921,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"184.173.179.46","src_port":35480,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820558,"pkt_ts_usec":921094,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA89o5AAEAGzkgKCAABuK2zLoqYAbsGFK3rAAAAAKACOQj9WQAAAgQFtAQCCAoABFtlAAAAAAEDAwQ="} 00427{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820558,"pkt_ts_usec":982129,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAAJAABAG9Om4rbMuCggAAQG7ipj561IUBhSt7FAS\/\/+tmQAA"} @@ -140,3 +141,20 @@ 00431{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":247,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820694,"pkt_ts_usec":604626,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAHhAABAGvDOeVQXHCggAAQG7yXLRCAziLvf0c1AQ\/\/81LAAA"} 00467{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":248,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820694,"pkt_ts_usec":654950,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"ABoRAAACABoRAAABCABFAABCY4BAAEAGKREKCAABnlUFx8lyAbsu9\/Rz0QgM4lAYOQgVDQAAgAAXtvdkyKnboCess\/qki09xS72kRAR872w="} 00431{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":249,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1432820694,"pkt_ts_usec":655133,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAHlAABAGvDKeVQXHCggAAQG7yXLRCAziLvf0jVAQ\/\/81EgAA"} +00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":27,"flow_first_seen":1432820693796,"flow_last_seen":1432820695137,"flow_tot_l4_data_len":1302,"flow_min_l4_data_len":20,"flow_max_l4_data_len":252,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.5.199","src_port":51570,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsApp","breed":"Acceptable","category":"Chat"}} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":27,"flow_first_seen":1432820693796,"flow_last_seen":1432820695137,"flow_tot_l4_data_len":1302,"flow_min_l4_data_len":20,"flow_max_l4_data_len":252,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.5.199","src_port":51570,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":30,"flow_first_seen":1432820624900,"flow_last_seen":1432820633508,"flow_tot_l4_data_len":3689,"flow_min_l4_data_len":20,"flow_max_l4_data_len":988,"flow_avg_l4_data_len":122,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.58.42","src_port":44819,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"WhatsApp","breed":"Acceptable","category":"Chat"}} +00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":30,"flow_first_seen":1432820624900,"flow_last_seen":1432820633508,"flow_tot_l4_data_len":3689,"flow_min_l4_data_len":20,"flow_max_l4_data_len":988,"flow_avg_l4_data_len":122,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.58.42","src_port":44819,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":62,"flow_first_seen":1432820633802,"flow_last_seen":1432820681629,"flow_tot_l4_data_len":3501,"flow_min_l4_data_len":20,"flow_max_l4_data_len":525,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.192.222.189","src_port":42241,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"WhatsApp","breed":"Acceptable","category":"Chat"}} +00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":62,"flow_first_seen":1432820633802,"flow_last_seen":1432820681629,"flow_tot_l4_data_len":3501,"flow_min_l4_data_len":20,"flow_max_l4_data_len":525,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.192.222.189","src_port":42241,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":5,"flow_first_seen":1432820568947,"flow_last_seen":1432820628171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"173.252.121.1","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":5,"flow_first_seen":1432820569427,"flow_last_seen":1432820629171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"179.60.192.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":5,"flow_first_seen":1432820570876,"flow_last_seen":1432820631171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.93.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":5,"flow_first_seen":1432820570006,"flow_last_seen":1432820630172,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.79.192","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":9,"flow_first_seen":1432820571488,"flow_last_seen":1432820632171,"flow_tot_l4_data_len":878,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":97,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.73.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":5,"flow_first_seen":1432820568346,"flow_last_seen":1432820627171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.64.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":5,"flow_first_seen":1432820567917,"flow_last_seen":1432820626171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.74.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_first_seen":1432820567259,"flow_last_seen":1432820625171,"flow_tot_l4_data_len":506,"flow_min_l4_data_len":52,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":101,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"31.13.84.48","src_port":53620,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":52,"flow_first_seen":1432820681899,"flow_last_seen":1432820691973,"flow_tot_l4_data_len":2843,"flow_min_l4_data_len":20,"flow_max_l4_data_len":274,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.58.109","src_port":49721,"dst_port":5222,"l4_proto":"tcp","ndpi": {"proto":"WhatsApp","breed":"Acceptable","category":"Chat"}} +00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":52,"flow_first_seen":1432820681899,"flow_last_seen":1432820691973,"flow_tot_l4_data_len":2843,"flow_min_l4_data_len":20,"flow_max_l4_data_len":274,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"158.85.58.109","src_port":49721,"dst_port":5222,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00147{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":261,"source":"whatsapp_voice_and_message.pcap","alias":"nDPId-test"} diff --git a/test/results/whatsappfiles.pcap.out b/test/results/whatsappfiles.pcap.out index da47263bd..d6715b9ae 100644 --- a/test/results/whatsappfiles.pcap.out +++ b/test/results/whatsappfiles.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsappfiles.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1519924083411,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00446{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":411187,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"XEl5dU5qkLkxKPrKCABFAABAAABAAEAG5oDAqAIduTzYNcIKAbs8JoRvAAAAALDC\/\/8eywAAAgQFtAEDAwYBAQgKKOUV+QAAAAAEAgAA"} 00440{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":501147,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"kLkxKPrKXEl5dU5qCABFAAA8AABAAFUG0YS5PNg1wKgCHQG7wgonNGFZPCaEcKASbTj4zgAAAgQFggQCCAoJITj5KOUV+QEDAwg="} @@ -35,3 +36,6 @@ 00544{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":303930,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"pkt":"kLkxKPrKXEl5dU5qCABFAACFVtBAAFUGemu5PNg1wKgCHQG7wiLPr208go9DYIAYAHJd7gAAAQEICreGOqco53fWFwMDAEwnn1Ldoj0Cr5\/Im58b20pVNsEUdlvAxt5j+2mE6973guqJvkeaSOw7r5BrbRlq9NgfbBt7cCvCjOmKkI3k1Bgn5\/BcHUaq6GBshCdh"} 00431{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":306082,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIiAbuCj0TRz69tjYAQCAG+5AAAAQEICijneA+3hjqn"} 00486{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":306087,"pkt_caplen":104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":104,"pkt_l4_len":70,"pkt":"XEl5dU5qkLkxKPrKCABFAABaAABAAEAG5mbAqAIduTzYNcIiAbuCj0TRz69tjYAYCAGn0QAAAQEICijneA+3hjqnFwMDACEAAAAAAAAABZSoQs4Gsxi2Tj\/BQp5xrm7kfCitYcqpn3Y="} +00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":310,"flow_first_seen":1519924083411,"flow_last_seen":1519924193429,"flow_tot_l4_data_len":194364,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":626,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":310,"flow_first_seen":1519924240121,"flow_last_seen":1519924247388,"flow_tot_l4_data_len":236771,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1430,"flow_avg_l4_data_len":763,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test"} diff --git a/test/results/wireguard.pcap.out b/test/results/wireguard.pcap.out index 7b72ddf99..9f8602e5c 100644 --- a/test/results/wireguard.pcap.out +++ b/test/results/wireguard.pcap.out @@ -1,3 +1,4 @@ +00386{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wireguard.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wireguard.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1563973554628,"flow_last_seen":0,"flow_tot_l4_data_len":808,"flow_min_l4_data_len":808,"flow_max_l4_data_len":808,"flow_avg_l4_data_len":808,"midstream":0,"l3_proto":"ip4","src_ip":"139.162.192.157","dst_ip":"192.168.0.14","src_port":51820,"dst_port":36116,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01487{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wireguard.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1563973554,"pkt_ts_usec":628757,"pkt_caplen":842,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":842,"pkt_l4_len":808,"pkt":"OCxKuzMdABAY3q0FCABFAAM8FXkAADURYEKLosCdwKgADspsjRQDKLH1BAAAAL5AaY1rAAAAAAAAANUJ2VrXQI01RZfJr8PEwgZEhNNcu6x03VWSZ67dhAHHTWKcRpBFkk8NVHd\/C4D4pz\/puWqoUUxKuxxH6YlcxuxAvZFB0Na5O4CW6jEyMIx3UMKSHboRTInUKfs0ifRWz\/ah3LYVezBxxWAse8HA4hp9J+12MZT8TmyygIwyCCaeEvoUQjFc6leSZrAZpKnPNseLUtXq9seSkA+QHufBd5P\/nAxkid4Fwq057VLJqJcJvFJRIdSNrsUBNHlMd2O226LQDMo6+sXnZNRhM\/0lY6T99lZ2rtutA5g+LROCm\/BZLu+Ww0aOhZ9T5CPKvl1MXzbqDpHjEWohQohUG62HCabsLz2Pl6HJpafmxv\/xXmUvqTxvWO5iYVSI4YH0rzZVN3aVdPUxgXYG+W8rSU+st0bg\/OnAMZWFzotivj2mfqRsGMWV3egRFwhvlfe7Fuv0OvGM3s9ZvinFAlmQZqUDOt74G5zoedU\/69v6LWqjWqMgwmKLQ\/lMwt2MnS6hiTwk\/iqPpTIM8RYnxG13RvjKDr4JXT\/U7OnZL63BA8kKbkL5zeTL+gL4bvPs8T4bLqWJpX+KPgKK5qcCbrRIXtRaFjvffCmBHmxiams\/n7B6m2DssFWcjX1Ev1oBu1UMKN6t2aeneW6ZYl4Q+afpKmmTZbh75sYoA8rPXxM4Q6E\/CvQ8xKFJuG12US4vfj96Tg+HLqjTKQn0aT3tP\/WRrjoWHz5nOKAwY2ssdZ\/sOQ7Z4I975oMYqMkolPHC\/IQyZ00spefKrUv00QdKXcsmU90gzx2i\/XncJUiW6+cRr5y\/xIasdRDvxOeWrnEuyr4eneiO5Pi37MXP8f2E65R6K8EWKkhOt2QxypTL9OYJAB3d80dQUxikTgyJwcF9uQEqgJNA\/GZhO2rBxL\/P3ze0It5qd4umjz9rSz1Tj4x9V7iRrPWik7ncKTUF\/OLBOu3ao3EyUG8u2N+GMLh6DNMnc3AMj260R63yyZIj87BZpn+95duhzSfs8I4u6YbCy54JPpusEK7oluD\/Hy2\/DI77VPA2QYc="} 00588{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"wireguard.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1563973554,"pkt_ts_usec":628780,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"pkt":"OCxKuzMdABAY3q0FCABFAACsFXoAADURYtGLosCdwKgADspsjRQAmIUlBAAAAL5AaY1sAAAAAAAAAApaAsrtXpH1hJEWMIaMon2Jp07DYKtFnos9KJ2dxNXsnPOlMw8teGIqqtQyAhfCvZKfSoj8FKmPC1PCtu8qqniK567s\/wF6cALr5IJXHXdFnmr1I94kKjzDU62XCT24xGedWrUZRek84+e2Fsx1lJJ6NR9cFgw9VnO9J77GX8hL"} @@ -15,3 +16,5 @@ 00526{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"wireguard.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1563973554,"pkt_ts_usec":974260,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"ABAY3q0FOCxKuzMdCABFAAB8LiUAAEARP1bAqAAOi6LAnY0UymwAaB+LBAAAAG2mYV50AAAAAAAAAI9tfKVIx7UlVy1HDhAUrAMjKdLduP+OEpWHLBE394laW3jJ0Lqa7HURy6krpFGEtykTq3N\/a3bbxUi+nKzrcQPN9N7PTqi9qMcJcRZfRaJH"} 00766{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"wireguard.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1563973554,"pkt_ts_usec":988525,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"ABAY3q0FOCxKuzMdCABFAAEsLioAAEARPqHAqAAOi6LAnY0UymwBGACZBAAAAG2mYV51AAAAAAAAALRQvj6tw6QAY\/1JXhRu0\/kpg0ZD7SEgnZpAC+s8jGXziAhKpCTCH\/pk3rDPYn19TKsTuLxc1zmaU017AkbnBsHquJngTkFZUSs4A7OonKFDYfNR8NBpor3e08bbX9kpBvg5hvCfcFuilN1p\/T6Gbi7F27c\/VedFYEwOOSWRAgT933bHaR8+BsGfnNRPXDEqf0GZB2Q3fwNPouZkPRRQL29PIh6Y3f7QwNYfVcFC3cp5UvgzmnSvBJcnCk94OHMYhEzEjIXqW1oc8SvvU7RtsYPY8EWQO0s5T6PvYCWeNPCyv0ncQfWZ3DrNXptDDBcOK8yNpQjgCWPIQcRiWgbLKzw="} 00525{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"wireguard.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1563973555,"pkt_ts_usec":59830,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"OCxKuzMdABAY3q0FCABFAAB8FrAAADURYcuLosCdwKgADspsjRQAaH8xBAAAAL5AaY1zAAAAAAAAAKsmGYGKi6UV\/ABoO1rTU3erm9HJ6ajuCHhNTr+BNzOxxDMpzZpoj4pN4xXAtWKi+3K8fQ4EuV95kwtHAB1+WdN92q42fF3e2HUsuFze7Je7"} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2399,"source":"wireguard.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2399,"flow_first_seen":1563973554628,"flow_last_seen":1563973935842,"flow_tot_l4_data_len":652616,"flow_min_l4_data_len":40,"flow_max_l4_data_len":1370,"flow_avg_l4_data_len":272,"midstream":0,"l3_proto":"ip4","src_ip":"139.162.192.157","dst_ip":"192.168.0.14","src_port":51820,"dst_port":36116,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00131{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2399,"source":"wireguard.pcap","alias":"nDPId-test"} diff --git a/test/results/youtube_quic.pcap.out b/test/results/youtube_quic.pcap.out index 0b9998a55..445ae01e2 100644 --- a/test/results/youtube_quic.pcap.out +++ b/test/results/youtube_quic.pcap.out @@ -1,3 +1,4 @@ +00389{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"youtube_quic.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"youtube_quic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1489363823466,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"216.58.205.66","src_port":54997,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02213{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"youtube_quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1489363823,"pkt_ts_usec":466752,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"gCqojWksxCwDBkn+CABFAAViKp8AAEARAADAqAEH2DrNQtbVAbsFTmyMDZNw4V58RG0IUTAzNQHEx\/Yat8K2lJx\/xfCgAQAEQ0hMTx0AAABQQUQABgEAAFNOSQAjAQAAU1RLAF0BAABWRVIAYQEAAENDUwBxAQAATk9OQ5EBAABNU1BDlQEAAEFFQUSZAQAAVUFJRMgBAABTQ0lE2AEAAFRDSUTcAQAAUERNROABAABTUkJG5AEAAFNNSEzoAQAASUNTTOwBAABDVElN9AEAAE5PTlAUAgAAUFVCUzQCAABNSURTOAIAAFNDTFM8AgAAS0VYU0ACAABYTENUSAIAAENTQ1RIAgAAQ09QVEgCAABDQ1JUYAIAAElSVFRkAgAAQ0VUVggDAABDRkNXDAMAAFNGQ1cQAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tfyKC9MwN17piZVNU\/QkmmE3zDBRwXexEviTXtQHZlZT\/o0M3FJ3WOBZp5lL5RXIaTAX\/iszgW7Ui51EwMzUB6IFgkpIa6H7tgIaiFYKRWMXjbzAwMDAwMDAwAGp0dp4RQa9ev39thoVizX7vQxRkAAAAQ0MyMGJldGEgQ2hyb21lLzU3LjAuMjk4Ny45OCBJbnRlbCBNYWMgT1MgWCAxMF8xMl8za3Zj9RsCsgRL78LWSY4+jwAAAABYNTA5AAAQAAEAAAAeAAAAb+PFWAAAAABoJX9SS1LMMIZlh9cGt32w74KlkbfLCJvYbB6phUnjYtV\/J7+3T+WICkKGmxl0apInEplRSWcqg\/3qI+CqJwNXZAAAAAEAAABDMjU1HvdI4XZwU8Me90jhdnBTwz2t9HxBefiRQAt7kKmuees2jgEAnGVpdpNkhQuOQ0r1tyTPo1k8IEM71wOV+MDwud\/WmN8O\/bZt8M5S76zS6GQgUAsZfJUzhYMLh2DzCj0s2UxZDpdWlDQ\/KBiEO80tVmE+bGp5czdFQGnhi\/134fgolaoUotcrvEChNXZdSQ7ze+ZsVxVgDQIPLJn5KItVO0bNTbdFJlK9ck\/6gUes9AlK+Lowm7raNBTPfJpo34tpsNA3toSRqnAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"youtube_quic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1489363823466,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"216.58.205.66","src_port":54997,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Unrated","category":"Web"},"quic": {"client_requested_server_name":"pagead2.googlesyndication.com","user_agent":"beta Chrome\/57.0.2987.98 Intel Mac OS X 10_12_3"}} @@ -47,3 +48,7 @@ 00452{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":146,"source":"youtube_quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1489363824,"pkt_ts_usec":602842,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"gCqojWksxCwDBkn+CABFAABCri0AAEARAADAqAEH2DrNQtJjAbsALmdsDHhX73QJ\/9nIB1LOOHmObBjHygjU4gg8ut\/ZA4C6iNTIFTt388k="} 00442{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":147,"source":"youtube_quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1489363824,"pkt_ts_usec":636293,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"xCwDBkn+gCqojWksCABFAAA9AABAADcR3IPYOs1CwKgBBwG70mMAKSH+AAf+nADu3vIaZ6KuZBEpmBE1my9pcSDsXentJrwW7yRM"} 01312{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":148,"source":"youtube_quic.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1489363824,"pkt_ts_usec":682420,"pkt_caplen":712,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":712,"pkt_l4_len":678,"pkt":"xCwDBkn+gCqojWksCABFAAK6AABAADcR2gbYOs1CwKgBBwG70mMCpm4xAAjnzUstzirPdOuX3yvGKh35BOQzO7Jm4esyq3UxsYnOLzSmRjd8WgEU55SZFA4kEqDSoKKbbOAy2wwHZspNJJc0FTqn7Mg3asUsu5BZFr4\/HpjEhxvVbso47vMmL4g6wIZVEqmHuajpT+E\/LQ0jWESy6QQUQ\/b+YFX0PAMl3eI\/lHpROKKSsMVVlt1SgM2ibVzxbs2ZrPLZm0l5tDPYmpPTbWagW2in9vP1qwPj3soTeLvM0zqN5mLQZlj9K7gGd6U08E55CEXLEo91Kj8PTecUyDwH4xgQdeB\/AHzV826AqxbgyFkMRDFEa85GrACCjr51el1KFnFEJLLJY31KC7DTQMAPSFpds4k+TWCUm9DvUqPLJpGPFx\/dGD35j5UjgmRu5yba8JKUQEuNbM0qKqdZsO\/sJW\/W6lFP6ASH+NpltGwvvgp4\/pmbLvrZR6\/Z3bm\/4GfbNeHUWt9t0p4Urjw7jAcdB9z39nFpjO+pVm4MyNMM5yduaAdAuTFIPSHeoTi3UbgvMujmAMvSWCTUzycjYVEawxYEN7U+hL9g5j\/FgTtOpb0q9yqMdD96G5RpNV2NbvSaSt1Ni6pxvyST6Ipe5SXB12hycYrhoMoBbh0M1dqe7efCKNdQOnUAT7i6zLWJkNwIM3F4KEJicIlbg63G3B0X9EWHdU5ESsf9K7O5yppvV+Sx3ka+e4oJ4ca6Jl+iY69imGj2QpImkdnW+tsEELR2Bryz3lP3ofLhSrpzIjwQTrMzcY2EGyRn1qXppCSkd1CK6S4CRX0gYxVOGoOD\/r\/G9rlKdDdfxQu5No2I0mIkP\/PBVREDmvYwl8ugvF0O2Pzk1Exfe4xC32kzvjUel9Ovyn5PHa7xhxJk1ZaHhixciHIHwh96qteXRg=="} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":289,"source":"youtube_quic.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":258,"flow_first_seen":1489363823738,"flow_last_seen":1489363826862,"flow_tot_l4_data_len":169723,"flow_min_l4_data_len":39,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":657,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"216.58.198.33","src_port":56074,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":289,"source":"youtube_quic.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":13,"flow_first_seen":1489363823466,"flow_last_seen":1489363824024,"flow_tot_l4_data_len":4037,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":310,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"216.58.205.66","src_port":54997,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":289,"source":"youtube_quic.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":18,"flow_first_seen":1489363824401,"flow_last_seen":1489363824840,"flow_tot_l4_data_len":8053,"flow_min_l4_data_len":35,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":447,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.7","dst_ip":"216.58.205.66","src_port":53859,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00133{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":289,"source":"youtube_quic.pcap","alias":"nDPId-test"} diff --git a/test/results/youtubeupload.pcap.out b/test/results/youtubeupload.pcap.out index 850b1bc0e..8bbc220a3 100644 --- a/test/results/youtubeupload.pcap.out +++ b/test/results/youtubeupload.pcap.out @@ -1,3 +1,4 @@ +00390{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"youtubeupload.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"youtubeupload.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1511102576794,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.27","dst_ip":"172.217.23.111","src_port":51925,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 02205{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"youtubeupload.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1511102576,"pkt_ts_usec":794424,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"XEl5dU5q2MuK4S0uCABFAAViAT5AAIARbUHAqAIbrNkXb8rVAbsFThECDZHSvk7nMdgaUTAzOQFHnN3hyT1jd4lP+l6gAQUUQ0hMTxMAAABQQUQAywMAAFNOSQDdAwAAVkVSAOEDAABDQ1MA8QMAAE1TUEP1AwAAVUFJRCQEAABUQ0lEKAQAAFBETUQsBAAAU01ITDAEAABJQ1NMNAQAAENUSU08BAAATk9OUFwEAABNSURTYAQAAFNDTFNkBAAAQ1NDVGQEAABDT1BUaAQAAElSVFRsBAAAQ0ZDV3AEAABTRkNXdAQAAC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tdXBsb2FkLnlvdXR1YmUuY29tUTAzOQHogWCSkhrofu2AhqIVgpFkAAAAQ2hyb21lLzYyLjAuMzIwMi45NCBXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQAAAAAWDUwOQEAAAAeAAAAc5gRWgAAAABmJfKEu+Ky\/D790R+7T+2\/0X2\/pJXF+QSwhgBhJRTmB2QAAAABAAAANVJUT5jAAAAAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAA"} 00650{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"youtubeupload.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1511102576794,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.27","dst_ip":"172.217.23.111","src_port":51925,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.YouTubeUpload","breed":"Fun","category":"Media"},"quic": {"client_requested_server_name":"upload.youtube.com","user_agent":"Chrome\/62.0.3202.94 Windows NT 10.0; Win64; x64"}} @@ -49,3 +50,7 @@ 00486{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"youtubeupload.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1511102578,"pkt_ts_usec":180527,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"XEl5dU5q2MuK4S0uCABFAABZAWZAAIARciLAqAIbrNkXb\/MYAbsARTzLDAjRAddSQpCnCUIU6saaeRlWNypXMbLqJjFDzm3BL\/QJZQshKHLAuTmSKkuYJgIbLSd6aEzQPz6Vuf3yvA=="} 00444{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"youtubeupload.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1511102578,"pkt_ts_usec":216417,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"2MuK4S0uXEl5dU5qCABFAAA9AABAADkRuqSs2RdvwKgCGwG78xgAKQv\/AAW6kYrY6Rl4Spd2erSFzl\/hFEcXrPb6gVIFYoj0G3eL"} 00439{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"youtubeupload.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1511102578,"pkt_ts_usec":239340,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"2MuK4S0uXEl5dU5qCABFAAA6AABAADkRuqes2RdvwKgCGwG78xgAJjDlAAbriko+\/ZfW2aYS1AzZ5OusG0WkuzV30Av+okTE"} +00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":137,"source":"youtubeupload.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":13,"flow_first_seen":1511102576835,"flow_last_seen":1511102576954,"flow_tot_l4_data_len":4988,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":383,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.27","dst_ip":"172.217.23.111","src_port":57452,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":137,"source":"youtubeupload.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":100,"flow_first_seen":1511102576794,"flow_last_seen":1511102580286,"flow_tot_l4_data_len":103076,"flow_min_l4_data_len":24,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1030,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.27","dst_ip":"172.217.23.111","src_port":51925,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":137,"source":"youtubeupload.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":24,"flow_first_seen":1511102578051,"flow_last_seen":1511102594936,"flow_tot_l4_data_len":14298,"flow_min_l4_data_len":26,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":595,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.27","dst_ip":"172.217.23.111","src_port":62232,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":137,"source":"youtubeupload.pcap","alias":"nDPId-test"} diff --git a/test/results/zabbix.pcap.out b/test/results/zabbix.pcap.out index 32e46de39..173e3c511 100644 --- a/test/results/zabbix.pcap.out +++ b/test/results/zabbix.pcap.out @@ -1,3 +1,4 @@ +00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"zabbix.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"zabbix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1572254070608,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.67.98","dst_ip":"192.168.67.25","src_port":57162,"dst_port":10050,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"zabbix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572254070,"pkt_ts_usec":608539,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"RoQclwmZOjUSPEK7CABFAAA85AdAAEAGTujAqENiwKhDGd9KJ0JwAdHUAAAAAKACchAH+wAAAgQFtAQCCAorwjXTAAAAAAEDAwc="} 00433{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"zabbix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572254070,"pkt_ts_usec":608854,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"OjUSPEK7RoQclwmZCABFAAA8AABAAEAGMvDAqEMZwKhDYidC30pw8XhkcAHR1aAScSDKPwAAAgQFtAQCCAorfUX3K8I10wEDAwc="} @@ -10,3 +11,5 @@ 00421{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"zabbix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572254070,"pkt_ts_usec":613423,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"RoQclwmZOjUSPEK7CABFAAA05ApAAEAGTu3AqENiwKhDGd9KJ0JwAdHscPF4dYAQAOUH8wAAAQEICivCNdUrfUX7"} 00421{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"zabbix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572254070,"pkt_ts_usec":614569,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"RoQclwmZOjUSPEK7CABFAAA05AtAAEAGTuzAqENiwKhDGd9KJ0JwAdHscPF4doARAOUH8wAAAQEICivCNdUrfUX7"} 00423{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"zabbix.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1572254070,"pkt_ts_usec":614852,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"OjUSPEK7RoQclwmZCABFAAA0t4lAAEAGe27AqEMZwKhDYidC30pw8Xh2cAHR7YAQAONpGAAAAQEICit9Rf0rwjXV"} +00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":10,"source":"zabbix.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":10,"flow_first_seen":1572254070608,"flow_last_seen":1572254070614,"flow_tot_l4_data_len":375,"flow_min_l4_data_len":32,"flow_max_l4_data_len":55,"flow_avg_l4_data_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.67.98","dst_ip":"192.168.67.25","src_port":57162,"dst_port":10050,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":10,"source":"zabbix.pcap","alias":"nDPId-test"} diff --git a/test/results/zcash.pcap.out b/test/results/zcash.pcap.out index 089a72942..598e9950b 100644 --- a/test/results/zcash.pcap.out +++ b/test/results/zcash.pcap.out @@ -1,3 +1,4 @@ +00382{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"zcash.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"zcash.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1514196094240,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.92","dst_ip":"178.32.196.217","src_port":55190,"dst_port":9050,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"zcash.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196094,"pkt_ts_usec":240063,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"fmgbW\/gUcIXCQA64CABFAAA8ux1AAEAGRaDAqAJcsiDE2deWI1qAnf85AAAAAKACchAV6gAAAgQFtAQCCApPjruwAAAAAAEDAwc="} 00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"zcash.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196094,"pkt_ts_usec":322725,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"cIXCQA64fmgbW\/gUCABFAAA8AABAADMGDb6yIMTZwKgCXCNa15Yj5r0mgJ3\/OqAScSDZNwAAAgQFtAQCCArshW\/8T467sAEDAwk="} @@ -15,3 +16,5 @@ 00424{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"zcash.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196109,"pkt_ts_usec":400850,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"fmgbW\/gUcIXCQA64CABFAAA0uyRAAEAGRaHAqAJcsiDE2deWI1qAngGsI+a+1IAQAO1WkQAAAQEICk+Oyn\/shX62"} 00670{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"zcash.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196116,"pkt_ts_usec":332032,"pkt_caplen":249,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":249,"pkt_l4_len":215,"pkt":"fmgbW\/gUcIXCQA64CABFAADruyVAAEAGROnAqAJcsiDE2deWI1qAngGsI+a+1IAYAO2rlwAAAQEICk+O0UPshX62eyJtZXRob2QiOiJzdWJtaXQiLCJwYXJhbXMiOnsiaWQiOiI0NzkwNTk1NDY4ODMyMTgiLCJqb2JfaWQiOiI3MjIxMzQxNzQxMjcxMzEiLCJub25jZSI6IjYzMDU4MDAwIiwicmVzdWx0IjoiYzgxMTEzMWE2Yjk3N2M3MmYwYjBmOWNkYzg0ODk3M2NlNGJlOGZiZDI4NmYzNTgzZmRlMGVhZWZhOGY3MDAwMCJ9LCJpZCI6MX0K"} 00509{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"zcash.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1514196116,"pkt_ts_usec":444796,"pkt_caplen":129,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":129,"pkt_l4_len":95,"pkt":"cIXCQA64fmgbW\/gUCABFAABzzTpAADMGQEyyIMTZwKgCXCNa15Yj5r7UgJ4CY4AYADmIgwAAAQEICuyFhZdPjtFDeyJpZCI6MSwianNvbnJwYyI6IjIuMCIsImVycm9yIjpudWxsLCJyZXN1bHQiOnsic3RhdHVzIjoiT0sifX0K"} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":145,"source":"zcash.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":145,"flow_first_seen":1514196094240,"flow_last_seen":1514197248783,"flow_tot_l4_data_len":15714,"flow_min_l4_data_len":32,"flow_max_l4_data_len":335,"flow_avg_l4_data_len":108,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.92","dst_ip":"178.32.196.217","src_port":55190,"dst_port":9050,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00126{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":145,"source":"zcash.pcap","alias":"nDPId-test"} diff --git a/test/results/zoom.pcap.out b/test/results/zoom.pcap.out index bfa2599c2..aeb342de1 100644 --- a/test/results/zoom.pcap.out +++ b/test/results/zoom.pcap.out @@ -1,3 +1,4 @@ +00381{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"zoom.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"zoom.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569520466080,"flow_last_seen":0,"flow_tot_l4_data_len":231,"flow_min_l4_data_len":231,"flow_max_l4_data_len":231,"flow_avg_l4_data_len":231,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"172.217.21.72","src_port":54854,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00692{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520466,"pkt_ts_usec":80774,"pkt_caplen":265,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":265,"pkt_l4_len":231,"pkt":"EBMx8Tl2KDc3AG3ICABFAAD7AABAAEAGtb7AqAF1rNkVSNZGAbt9MLg2pduNV4AYEAjbcQAAAQEICiWcznNwmChtFgMBAMIBAAC+AwE5BEH329R9hgOe6JDNh5Do5\/IyBg\/qLeMPj9mOGNz+swAAEgAvADMANQA5wAnACsATwBRWAAEAAIP\/AQABAAAAAB0AGwAAGHd3dy5nb29nbGV0YWdtYW5hZ2VyLmNvbQAXAAAABQAFAQAAAAAzdAAAABIAAAAQADAALgJoMgVoMi0xNgVoMi0xNQVoMi0xNAhzcGR5LzMuMQZzcGR5LzMIaHR0cC8xLjEACwACAQAACgAKAAgAHQAXABgAGQ=="} 00802{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"zoom.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569520466080,"flow_last_seen":0,"flow_tot_l4_data_len":231,"flow_min_l4_data_len":231,"flow_max_l4_data_len":231,"flow_avg_l4_data_len":231,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"172.217.21.72","src_port":54854,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Google","breed":"Unrated","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"www.googletagmanager.com","ja3":"d78489b860c8bf7838a6ff0b4d131541","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}} @@ -323,3 +324,41 @@ 00466{"flow_id":32,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":689,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520473,"pkt_ts_usec":157959,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":99,"pkt_l4_len":65,"pkt":"EBMx8Tl2KDc3AG3ICABFAABV25wAAEARzxzAqAF1bV6gY+zMImEAQdYuBSIBAPuQCRAAAAAAAAAAAACAyAAGAQAEAuE3edfn7BLaAAAJEAAAAAUAAAC1gcoAAgEABAIBAAAA"} 00411{"flow_id":33,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":693,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520473,"pkt_ts_usec":170187,"pkt_caplen":57,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":57,"pkt_l4_len":23,"pkt":"EBMx8Tl2KDc3AG3ICABFAAArmBYAAEAREs3AqAF1bV6gY\/EjImEAFxFSBQoGAAAAAAAAAAAAAAAA"} 00414{"flow_id":33,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569520473,"pkt_ts_usec":198709,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":23,"pkt":"KDc3AG3IEBMx8Tl2CABFAAArvZdAADURuEttXqBjwKgBdSJh8SMAFxFSBQoGAAAAAAAAAAAAAAAAAAAA"} +00455{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1569520469423,"flow_last_seen":1569520469433,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1569520469036,"flow_last_seen":1569520469072,"flow_tot_l4_data_len":137,"flow_min_l4_data_len":31,"flow_max_l4_data_len":106,"flow_avg_l4_data_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":65394,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00474{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1569520469797,"flow_last_seen":0,"flow_tot_l4_data_len":287,"flow_min_l4_data_len":287,"flow_max_l4_data_len":287,"flow_avg_l4_data_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00441{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1569520469072,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15} +00505{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1569520469081,"flow_last_seen":1569520469116,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"13.225.84.182","src_port":54798,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} +00485{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1569520469081,"flow_last_seen":1569520469116,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"13.225.84.182","src_port":54798,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1569520471147,"flow_last_seen":1569520471188,"flow_tot_l4_data_len":108,"flow_min_l4_data_len":46,"flow_max_l4_data_len":62,"flow_avg_l4_data_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":51185,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1569520466080,"flow_last_seen":1569520472536,"flow_tot_l4_data_len":924,"flow_min_l4_data_len":231,"flow_max_l4_data_len":231,"flow_avg_l4_data_len":231,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"172.217.21.72","src_port":54854,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_first_seen":1569520468399,"flow_last_seen":1569520468399,"flow_tot_l4_data_len":228,"flow_min_l4_data_len":76,"flow_max_l4_data_len":76,"flow_avg_l4_data_len":76,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":8,"flow_first_seen":1569520473084,"flow_last_seen":1569520473198,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":21,"flow_max_l4_data_len":117,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"109.94.160.99","src_port":61731,"dst_port":8801,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":6,"flow_first_seen":1569520469340,"flow_last_seen":1569520469435,"flow_tot_l4_data_len":748,"flow_min_l4_data_len":32,"flow_max_l4_data_len":295,"flow_avg_l4_data_len":124,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"104.199.65.42","src_port":53867,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Google","breed":"Unrated","category":"Web"},"http": {}} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":6,"flow_first_seen":1569520469340,"flow_last_seen":1569520469435,"flow_tot_l4_data_len":748,"flow_min_l4_data_len":32,"flow_max_l4_data_len":295,"flow_avg_l4_data_len":124,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"104.199.65.42","src_port":53867,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":18,"flow_first_seen":1569520468959,"flow_last_seen":1569520469430,"flow_tot_l4_data_len":7695,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"52.202.62.238","src_port":54864,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":30,"flow_first_seen":1569520469950,"flow_last_seen":1569520470454,"flow_tot_l4_data_len":17921,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":597,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"52.202.62.196","src_port":54865,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":33,"flow_first_seen":1569520470022,"flow_last_seen":1569520470628,"flow_tot_l4_data_len":20585,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":623,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"52.202.62.236","src_port":54866,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":6,"flow_first_seen":1569520469221,"flow_last_seen":1569520469399,"flow_tot_l4_data_len":276,"flow_min_l4_data_len":40,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","src_port":23903,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":6,"flow_first_seen":1569520469189,"flow_last_seen":1569520469375,"flow_tot_l4_data_len":276,"flow_min_l4_data_len":40,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.37.14","src_port":23903,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":6,"flow_first_seen":1569520469253,"flow_last_seen":1569520469433,"flow_tot_l4_data_len":276,"flow_min_l4_data_len":40,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"162.255.38.14","src_port":23903,"dst_port":3479,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00471{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1569520466209,"flow_last_seen":0,"flow_tot_l4_data_len":53,"flow_min_l4_data_len":53,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00476{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1569520470666,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":20,"flow_first_seen":1569520466316,"flow_last_seen":1569520471572,"flow_tot_l4_data_len":3585,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1258,"flow_avg_l4_data_len":179,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"167.99.215.164","src_port":54863,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1569520470742,"flow_last_seen":1569520470776,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":44,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":58063,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":29,"flow_first_seen":1569520470742,"flow_last_seen":1569520471166,"flow_tot_l4_data_len":8664,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":298,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"213.19.144.105","src_port":54867,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":30,"flow_first_seen":1569520470755,"flow_last_seen":1569520471166,"flow_tot_l4_data_len":8688,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":289,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"213.19.144.104","src_port":54868,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00482{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1569520468922,"flow_last_seen":1569520468958,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":37,"flow_max_l4_data_len":53,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":64352,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":185,"flow_first_seen":1569520471748,"flow_last_seen":1569520473190,"flow_tot_l4_data_len":185945,"flow_min_l4_data_len":21,"flow_max_l4_data_len":1037,"flow_avg_l4_data_len":1005,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"109.94.160.99","src_port":58327,"dst_port":8801,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":29,"flow_first_seen":1569520470769,"flow_last_seen":1569520471156,"flow_tot_l4_data_len":8670,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":298,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"213.244.140.85","src_port":54869,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":28,"flow_first_seen":1569520470776,"flow_last_seen":1569520471159,"flow_tot_l4_data_len":7582,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":270,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"213.244.140.84","src_port":54870,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1569520470741,"flow_last_seen":1569520470768,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":44,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":62563,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00510{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1569520467811,"flow_last_seen":1569520471399,"flow_tot_l4_data_len":158,"flow_min_l4_data_len":79,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":79,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"62.149.152.153","src_port":54341,"dst_port":993,"l4_proto":"tcp","ndpi": {"proto":"IMAPS","breed":"Safe","category":"Email"}} +00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1569520467811,"flow_last_seen":1569520471399,"flow_tot_l4_data_len":158,"flow_min_l4_data_len":79,"flow_max_l4_data_len":79,"flow_avg_l4_data_len":79,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"62.149.152.153","src_port":54341,"dst_port":993,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":7,"flow_first_seen":1569520471915,"flow_last_seen":1569520473157,"flow_tot_l4_data_len":387,"flow_min_l4_data_len":21,"flow_max_l4_data_len":115,"flow_avg_l4_data_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"109.94.160.99","src_port":60620,"dst_port":8801,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1569520468207,"flow_last_seen":0,"flow_tot_l4_data_len":134,"flow_min_l4_data_len":134,"flow_max_l4_data_len":134,"flow_avg_l4_data_len":134,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"239.255.255.250","src_port":57025,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":16,"flow_first_seen":1569520469341,"flow_last_seen":1569520469413,"flow_tot_l4_data_len":6295,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":393,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"35.186.224.53","src_port":53872,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Unrated","category":"Web"}} +00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":16,"flow_first_seen":1569520469341,"flow_last_seen":1569520469413,"flow_tot_l4_data_len":6295,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":393,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"35.186.224.53","src_port":53872,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":210,"flow_first_seen":1569520471189,"flow_last_seen":1569520473190,"flow_tot_l4_data_len":64504,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1472,"flow_avg_l4_data_len":307,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"109.94.160.99","src_port":54871,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} +00483{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_first_seen":1569520469984,"flow_last_seen":1569520470021,"flow_tot_l4_data_len":92,"flow_min_l4_data_len":38,"flow_max_l4_data_len":54,"flow_avg_l4_data_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.117","dst_ip":"192.168.1.1","src_port":62988,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} +00125{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":700,"source":"zoom.pcap","alias":"nDPId-test"} |