diff options
Diffstat (limited to 'test/results/default/instagram.pcap.out')
| -rw-r--r-- | test/results/default/instagram.pcap.out | 57 |
1 files changed, 33 insertions, 24 deletions
diff --git a/test/results/default/instagram.pcap.out b/test/results/default/instagram.pcap.out index a791b0ca9..1843a3057 100644 --- a/test/results/default/instagram.pcap.out +++ b/test/results/default/instagram.pcap.out @@ -6,6 +6,7 @@ 02392{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_src_last_pkt_time":1436720898386781,"flow_dst_last_pkt_time":1436720898386781,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1431,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1431,"pkt_l4_len":1397,"thread_ts_usec":1436720898386781,"pkt":"ABsv8H60QPMIw47hCABFAAWJa5BAAEAGjI7AqABnHw1dNISQAbuIwY4ypNSTmIAYARMTGgAAAQEICgAD6otaUmp7FwMBBVB9SXVyqGN\/Z0IQOrRWeDqy2ESAojaAx4QQZK8Nvn9P2WG4BrAo87sybB9iQ6L07zu3SJx\/yEENym+6oXOIueLurovz4xM5H+e2VkXRxNwq2D0zbcPaARfl1kqZ5lxozT2KxP5upnv5ZlZknUeHJ9iJUeI933878+9Wa2p3jAkSn4v+PhMZ8tdKr\/DbC4Dao9UoiB0NXUAr3Yz5mLZxqwvhp7T5JBYmrpug0k+c+c5jewd+5zMMLlTOh9zrkFpN\/SPdxljY89SWMG4iWok6qAWd81044WQFB8MMk6d1YEgnl4MTRR4s5nra0RAZ\/18nINKDy\/+7OtbIdykHRTDGdkzNglojGhlbMwXwCoSaU7eaC\/UG3QHuANJheRiTxBbb9LObDO61gFXBkdpo\/nFCQJ5DEAR9LRi5VbgUevhOk8v2CnW3NfU8tU\/NhXT2Fwav0PyuAxlku4R0TFjGrX0lMbSi5TfJsyWyqS9JUaHL9+9Lo2MolHMixycuQJ8OBJfxMjbh4vndGe6E5xjywRDhon5Ivpm51kbX7pr85erPPQ5esyd11\/S2GN1nyosTrQfKPFTMJ2PKe2m7QTQt+uAz\/lbUTHbMP5WXngggI0bC1v64BOTbVZvk5uSBRBJTxfNNwpu5Mu42yT2kpORmWxKLjzXxHI3WY0zq00CLVkZ1W4ZdSNXs14xkPKnh8GETvWNyrC0OkJAC\/senhsF4RXOoqIV\/fvDhI7Lz\/aB3VqgZGkZTiT2tG0nkNbTl36TNhCL0NMIpdEkg3CtkeHnRpYXxlFUaqjl0oiNlqmXrT3txeOlkpgLeE8sil6hQeUXLUDxeB\/KJ3hVWQV57tvquoi3TQ0mdlDPh3nKxwFekfGvexzie5JWVEiecROjBicDHlMGZSqgfGOOL9obBhKFQKyGkKwqvDD0GLpn+uVlqpq4HgYehGmZsXkGfKjhOvgYnCN46aHecrF2yix3uKy9HcGVhEh0jdkP6ZVKeYPjfh1VormnzwC798pJrA6FXeukKkQhENaxtIfjtfZqrhxgkGn44Wi6ohn6pe\/FHHmbNcPgV6V8fsqp75GNTcdW4payqjcXiRcbHyE8T1\/Qx4baiJDp6KLsZS4gAneRh+ALhxukKM03jbRUClXAh8oRiLl0u+SOlflfwh8goOCkzbht0yzBBd5s+YE\/rKLvLODamT6vRSajD988ioyLCTi6O7PjCpIz0x86CPfl59RFLMWfW1DDNxLLiQpG5QmdGA\/0xKZPtgucNxJfMg8zisuAsBotSOZNTt7iyYW\/IMjbjZfUDk2XnW0FMevjvN1dNSzxncEScDgEwhOZR\/bPFjnmrDfWVV5x9BRHI5MP8wUwSlhypizc+qxTGIgicImjYGkhAIz+xcFmXadM0YNZEvMZaj9aBOHMX1Oble6EYxmSHOrpQKqfzbWeMlvwrQYuci0kLy\/\/bshVduwlDBy5JYqDunQnZyDGNhNVfyaH+ng8KQ6sBqINnITFXfAnCkwXV\/HK1iUkb7QzoqBn3gpftCp83hNH0foudA8Gdf6kurlWwgMEOXi5BfTqlD4DwASXt9A68u1P9Zz8s0alrX2UlusB6fvL9Q9Js6MLwiQyj+bjdEcQ3Uplwrw6qLdouhHzsdgkMnVdwc2l5wv8KPOcXqmQvqjndZFz1nXaAVhwsFoo1zwY3LiNiYjhwWSYaeCHLdPVBHtAjW1OZFou+zyYe9X36AFhBBqrW+04QrWGvIhn1jD27wWhOa1bAC4ScjrpH0lKPe5njeedOXaKkZFE++EHilCzyFRBq6mDF3sb10u4yUIsQcfD4LLSh"} 01048{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720898386781,"flow_dst_last_pkt_time":1436720898386781,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1365,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":1365,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720898386781,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00542{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_src_last_pkt_time":1436720898386781,"flow_dst_last_pkt_time":1436720898475679,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720898475679,"pkt":"QPMIw47hABsv8H60CABFAAA05iNAAFUGAlAfDV00wKgAZwG7hJCk1JOYiMGTh4AQAE5t9QAAAQEIClpSq0YAA+qL"} +00931{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":3,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720898386781,"flow_dst_last_pkt_time":1436720898475679,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1365,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":1365,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720898475679,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00555{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1436720898354402,"flow_dst_last_pkt_time":1436720898499269,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1436720898499269,"pkt":"QPMIw47hABsv8H60CABFAAA8AABAAFIGTqyt\/GsEwKgAZwG73D5XFMWUHoSlo6ASOJBK1AAAAgQFlgQCCAq8TYT0AAPqiAEDAwg="} 00542{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1436720898499483,"flow_dst_last_pkt_time":1436720898499269,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720898499483,"pkt":"ABsv8H60QPMIw47hCABFAAA0TytAAEAGEYnAqABnrfxrBNw+AbsehKWjVxTFlYAQAOXaNgAAAQEICgAD6pe8TYT0"} 01170{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_src_last_pkt_time":1436720898501130,"flow_dst_last_pkt_time":1436720898499269,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":530,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":530,"pkt_l4_len":496,"thread_ts_usec":1436720898501130,"pkt":"ABsv8H60QPMIw47hCABFAAIETyxAAEAGD7jAqABnrfxrBNw+AbsehKWjVxTFlYAYAOUQ3QAAAQEICgAD6pe8TYT0FgMBAcsBAAHHAwFVop8CNJ6Qudiud2vb4pMs1Ustmw2JKPU\/VGUbAAAfqCAvcExfwJCbXHILQOxXqreX44nTobQUpbpO1CIvwxwdmABGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAATgAAAAgAB4AABt0ZWxlZ3JhcGgtYXNoLmluc3RhZ3JhbS5jb20ACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAARACMA0ESu3Am+FRFWL6GFZ5cqeqMrKeBDNApsKnRfHnB5aZ0M+PnsUszH1NK1OcamWdgk3loMTjkeuY8vQf2EKeUIJw0J8WDG8kiJQeedkexy97ZHld7N8L4SURKmoEJD\/aT59gmDPLTPklzVSlv38lUivPzyDaJ4xWo0Y51eIH5hGdTyPxvePHdwmlZHT25nawNC\/q4GMjx1H6cysD5DjhLucBMKfR+thQ8RsDmqWIcBbaeRKiGNOGevr+YgzwaPf99rNe8LLrWBk293Kmn5cEdDLBg="} @@ -15,7 +16,7 @@ 00543{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_src_last_pkt_time":1436720898501130,"flow_dst_last_pkt_time":1436720898646547,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720898646547,"pkt":"QPMIw47hABsv8H60CABFAAA0QOlAAFIGDcut\/GsEwKgAZwG73D5XFMWVHoSnc4AQAD2vaQAAAQEICrxNhYIAA+qX"} 01302{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":10,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":3,"flow_first_seen":1436720898354402,"flow_src_last_pkt_time":1436720898501130,"flow_dst_last_pkt_time":1436720898646669,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":464,"flow_dst_max_l4_payload_len":145,"flow_src_tot_l4_payload_len":464,"flow_dst_tot_l4_payload_len":145,"midstream":0,"thread_ts_usec":1436720898646669,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"173.252.107.4","src_port":56382,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"telegraph-ash.instagram.com","tls": {"version":"TLSv1","ja3":"54ae5fcb0159e2ddf6a50e149221c7c7","ja3s":"acb741bcdffb787c5a52654c78645bdf","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"}}} 01896{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_src_last_pkt_time":1436720900074495,"flow_dst_last_pkt_time":1436720898551576,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1063,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1063,"pkt_l4_len":1029,"thread_ts_usec":1436720900074495,"pkt":"ABsv8H60QPMIw47hCABFAAQZa5JAAEAGjfzAqABnHw1dNISQAbuIwZOHpNSV\/YAYATACCAAAAQEICgAD6zRaUquVFwMBA+DkDUivvS2eBjkT2Urn2+KTbKUSC66\/qxC\/xD+VJohS0ez2+Xkk+lV7Cay4T3qDmms3u0VgM6A5H+3n7TePnJIVLW9eS+znnQVMaWWcj7eNfDCCii6movZtXtYSdlkSdYe+AV3zuKPoRQe5W8+BL8aUzaU2mxJIwHIuhCp\/wOHHZVlWSX4j0W\/HLVFrJ9+SKhoT3ymYn6vBersE+9\/7sKY+2J2IhMFbr+TBY2rnZnSngLvIZzDfQST7NLriH0JokZzVgg3Ff+3n4QivAvWspXgy0oaU2g3aaDd4f2+JfRt8qI3InhGx76jPbTiLxX9qaNV0iJsMs2R9Zbz45LheHPpmkG0V7bDGgEIpOaqiTMwB5vyiMd\/P54jKSzhcXbkTjVX9JupxlspvQCMzw0zD7LT5v7dAePpfjXlY31iS4F3oERk0vcdtXClQ+kXUQjRXrDfn9G+KdjJsBcQpenUtTCuLGDPpVEgTnSXS+lToADvcPr1rkPRhfbj8IUBcJUIcSlUm5rrXzhJko8lPknZB4TnyuXiKwn+lAlEw7TCskEcsZeQDg7bIBvRlAT+vSZ9c\/hnBukQ3DX+eHXRlNu5QwYmyZQpchItAPD2sjwtp\/oacDnxXBTJxsrxKApeuzP\/F7cUhAz3iRYmA+QEhh8k0MFPh1enJh7Kg+utJPgoLoxjJA75oFbTtLOl56uGfhjMFQHnFTdo3E\/LchZ\/qJhKBdosqvqoH0oDg1hr9cOpebAeBh5WDig+m+zUDnjg0RfFKufLkN8F9SJHwXapjQlt6wf1Hic6HUpgV\/iLxA9EMlB3SfwmMyFembYPapDW4zh2E5uvMtAkfyWhX4TjOep0+g9TfyHFxLf12hCwmMJCcMNg5ZrXrXlWtfXpEKK20uuRmxStID9PEDCx0YdLB1sqMlysgu3FFVUuTE3jBH4Jwvk3aPClCUFz90QKRSdGoGgxY7drYTMj6pGovLyduLCALkBZipLVkKctZ1E7Ahw5sKzGcL6KbFjtVL7X8kSt1FcYBkyXAuypyLFY9275D4SQbnyhaKWjTlx\/V1CS7UCPW3JEUwSje6VUwEW5quscLQyd0gztKVxa3hEEgOJwAV6TViRkF7y8ryi3k2JQ0HOzInxyLgtSoxlQqipvdMVM5Q0wtS4uxyXBjW6c2ixJ9VZqnfjNOGz7U8L44QPKln\/uZVp53Pa7zdtLnKiQSc6vzq4nlYDa2P+ZCCh17L5ayDcf87iSrR1Eolw6s9V29UDAylOQWQYmeknlyQuZCXxbBC54zMyAdL0o9OXP25quGIX+qhLqVNGvteb1pX5mGkXMRqWGnow=="} -01982{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":49,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720900498659,"flow_dst_last_pkt_time":1436720900498598,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":2362,"flow_dst_tot_l4_payload_len":17365,"midstream":1,"thread_ts_usec":1436720900498659,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":61,"avg":136248.2,"max":1572479,"stddev":382122.6,"var":146017665024.0,"ent":2.2,"data": [88898,75897,164978,1522736,1572479,340302,390014,2197,2137,122,91,92,92,91,91,61,61,92,92,61,91,91,61,92,92,29907,29999,733,671,702,672]},"pktlen": {"min":52,"avg":668.5,"max":1450,"stddev":663.9,"var":440818.0,"ent":4.2,"data": [1417,52,665,52,1049,52,1450,52,195,52,1450,52,1283,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52]},"bins": {"c_to_s": [14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0],"s_to_c": [2,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,11,0,0,0,0]},"directions": [0,1,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0],"entropies": [7.861261845,5.070539474,7.656534195,5.014835358,7.778872013,5.017560959,7.868881702,5.053297043,6.745593071,5.053297043,7.855556488,5.091758728,7.839184761,5.091758728,7.864506721,5.038780212,7.844711781,5.115703106,7.864735603,5.077241421,7.847777367,5.077241898,7.868622303,5.077241421,7.866432190,5.115703106,7.875942230,5.115703106,7.870041847,5.115703106,7.866209507,5.077241421]}} +02156{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":49,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720900498659,"flow_dst_last_pkt_time":1436720900498598,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":2362,"flow_dst_tot_l4_payload_len":17365,"midstream":1,"thread_ts_usec":1436720900498659,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":61,"avg":136248.2,"max":1572479,"stddev":382122.6,"var":146017665024.0,"ent":2.2,"data": [88898,75897,164978,1522736,1572479,340302,390014,2197,2137,122,91,92,92,91,91,61,61,92,92,61,91,91,61,92,92,29907,29999,733,671,702,672]},"pktlen": {"min":52,"avg":668.5,"max":1450,"stddev":663.9,"var":440818.0,"ent":4.2,"data": [1417,52,665,52,1049,52,1450,52,195,52,1450,52,1283,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52,1450,52]},"bins": {"c_to_s": [14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0],"s_to_c": [2,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,11,0,0,0,0]},"directions": [0,1,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0],"entropies": [7.861261845,5.070539474,7.656534195,5.014835358,7.778872013,5.017560959,7.868881702,5.053297043,6.745593071,5.053297043,7.855556488,5.091758728,7.839184761,5.091758728,7.864506721,5.038780212,7.844711781,5.115703106,7.864735603,5.077241421,7.847777367,5.077241898,7.868622303,5.077241421,7.866432190,5.115703106,7.875942230,5.115703106,7.870041847,5.115703106,7.866209507,5.077241421]},"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00938{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":49,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720900498659,"flow_dst_last_pkt_time":1436720900498598,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":2362,"flow_dst_tot_l4_payload_len":17365,"midstream":1,"thread_ts_usec":1436720900498659,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00781{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":76,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720900684083,"flow_src_last_pkt_time":1436720900684083,"flow_dst_last_pkt_time":1436720900684083,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":260,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720900684083,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38816,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00895{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_src_last_pkt_time":1436720900684083,"flow_dst_last_pkt_time":1436720900684083,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"thread_ts_usec":1436720900684083,"pkt":"ABsv8H60QPMIw47hCABFAAE4wXBAAEAGQn\/AqABnLiFGoJegAFCP9SVkp0jV34AYH+olJAAAAQEICgAD63Ga3vWjR0VUIC9ocGhvdG9zLWFrLXhhcDEvdDUxLjI4ODUtMTUvZTM1LzEwODU5OTk0XzEwMDk0MzM3OTI0MzQ0NDdfMTYyNzY0NjA2Ml9uLmpwZz9zZT03IEhUVFAvMS4xDQpIb3N0OiBwaG90b3MtaC5hay5pbnN0YWdyYW0uY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpVc2VyLUFnZW50OiBJbnN0YWdyYW0gNy4xLjEgQW5kcm9pZCAoMTkvNC40LjI7IDQ4MGRwaTsgMTA4MHgxOTIwOyBzYW1zdW5nOyBHVC1JOTUwNTsgamZsdGU7IHFjb207IGl0X0lUKQ0KDQo="} @@ -30,19 +31,23 @@ 00894{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900692262,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":325,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":325,"pkt_l4_len":291,"thread_ts_usec":1436720900692262,"pkt":"ABsv8H60QPMIw47hCABFAAE3iBFAAEAGg5LAqABnUlUaueJtAFAE8EMOWjfyZYAYD+bdMQAAAQEICgAD63JZ6ogYR0VUIC9ocGhvdG9zLWFrLXhmYTEvdDUxLjI4ODUtMTUvZTM1LzExNDI0NjIzXzE2MDgxNjMxMDk0NTA0MjFfNjYzMzE1ODgzX24uanBnP3NlPTcgSFRUUC8xLjENCkhvc3Q6IHBob3Rvcy1mLmFrLmluc3RhZ3JhbS5jb20NCkNvbm5lY3Rpb246IEtlZXAtQWxpdmUNClVzZXItQWdlbnQ6IEluc3RhZ3JhbSA3LjEuMSBBbmRyb2lkICgxOS80LjQuMjsgNDgwZHBpOyAxMDgweDE5MjA7IHNhbXN1bmc7IEdULUk5NTA1OyBqZmx0ZTsgcWNvbTsgaXRfSVQpDQoNCg=="} 01368{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":79,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720900692262,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900692262,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":259,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":259,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720900692262,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57965,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-f.ak.instagram.com","http": {"url":"photos-f.ak.instagram.com\/hphotos-ak-xfa1\/t51.2885-15\/e35\/11424623_1608163109450421_663315883_n.jpg?se=7","code":0,"content_type":"","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 02453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_src_last_pkt_time":1436720900684083,"flow_dst_last_pkt_time":1436720900716768,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900716768,"pkt":"QPMIw47hABsv8H60CABFAAW+uH1AADkGTewuIUagwKgAZwBQl6CnSNXfj\/UmaIAQAiku5gAAAQEICprfPdsAA+txSFRUUC8xLjEgMjAwIE9LDQpMYXN0LU1vZGlmaWVkOiBTYXQsIDExIEp1bCAyMDE1IDE2OjU3OjA4IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9qcGVnDQpDb250ZW50LUxlbmd0aDogMTUwMDMxDQpDYWNoZS1Db250cm9sOiBuby10cmFuc2Zvcm0sIG1heC1hZ2U9MTIwOTYwMA0KRXhwaXJlczogU3VuLCAyNiBKdWwgMjAxNSAxNzowODoyMCBHTVQNCkRhdGU6IFN1biwgMTIgSnVsIDIwMTUgMTc6MDg6MjAgR01UDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQoNCv\/Y\/+AAEEpGSUYAAQEAAAEAAQAA\/+0AfFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAABfHAIoAFpGQk1EMjMwMDA5NjkwMTAwMDBjMzQ3MDAwMDEzNjQwMDAwNjM4NDAwMDA4MzJiMDEwMDBiODUwMTAwODdkZjAxMDAwZDRhMDIwMDlkYTIwMjAwNzY3MzAzMDAA\/9sAQwAGBgYGBgYLBgYLEAsLCxAVEBAQEBUbFRUVFRUbIBsbGxsbGyAgICAgICAgJycnJycnLS0tLS0zMzMzMzMzMzMz\/9sAQwEICAgNDA0WDAwWNSQeJDU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1\/8IAEQgEDwQPAwEiAAIRAQMRAf\/EABwAAAEFAQEBAAAAAAAAAAAAAAUBAgMEBgAHCP\/EABoBAAMBAQEBAAAAAAAAAAAAAAABAgMEBQb\/2gAMAwEAAhADEAAAANnYrv6OWePnpwvl4Ucr5ZqutmsxzGNFZbBKECWI2oX8gp+rqOdscgJarTJrPTiAtUZEnHz0qOljcEskD1c01Rksi2ko7C10FaSJqLDY0bkkglRK+J01IqIm99eIL6jmheWgjCKVJUTsjcmxJXNVG3K1KNr3irtvMCithKVbraoq9cQKb5mse+vydpRzhEXinDIvFyoIspSDsdW4LfVORbSFGS9z0Q07Vapihe24SRFCV8D5p7U4fInJNSacY9CnDoLekTpOusTppdQVRUWk5Z3S6nSOaiisOZWrWqtSjFjqVjcxzA+ktxbdV5FmYfOO1PR5O6tOVN6dGCvruavqOenPG2AT0hWptvhfNzvglTijkaS2WB9FlYElvdXcE7qNkc6sYnO6nwWWwvB6cwHJ3BI+Pk7LqzU7SQPCRiRBzWw1M8o9Wr7h8yd2Yes0RUdMne6nInZbXUcjq0gpefEOw6FZdhsSpo1\/NNSRGRwz8KussbUKdHc9LXYK7JQkHbZE9CMRrLHVuCy6tIhIp+ajbOxDZOaN8kM6b52TRosiOmpWqktXN4fR9WcyxQQ3Mi1m1NxKzxO57gjldCOau1Guh6KocxG0s90jNuePlRqSaiqL7xrhlZBD1ROCogrq0VC86jwXI66CmfUcy84e5MlIKemSZRcnZWo5lqOCIVpafMuyjnIKtHOmrjanNWmV0at9VUdlavIty0UHfcNVBHhvASbQRlyCBWndG1xZlpvVXVpuTtPpPHelHPmiqjZJuxJVci8tKRVa6m0Lsg1QJNocO+lKMV1BqVN+Km1zbjrI1P1ZzUr6iNEZRL5ZRw56q6yDgmfWQLsg16ZNg3hkHi+ETQdInbdS4duCJorHU42r7hqMKoMQCnCeAuojkF0F8BRBzhkEpcFpK6im5sQ5GRJU57qi78tptbhTpBzLHQKE7qrwsdX4LS1+Ts9Uc1YWugWOruCfoFCwtRydla3CsLCo7DIlTl6FQm6BQnWuoT9DwSpCoS9DwTdA4JVrqE\/QKOx0ChM6u5EjoeCVY+ZIiIA="} +01271{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":80,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720900684083,"flow_src_last_pkt_time":1436720900684083,"flow_dst_last_pkt_time":1436720900716768,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":260,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":1418,"midstream":1,"thread_ts_usec":1436720900716768,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38816,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-h.ak.instagram.com","http": {"url":"photos-h.ak.instagram.com\/hphotos-ak-xap1\/t51.2885-15\/e35\/10859994_1009433792434447_1627646062_n.jpg?se=7","code":200,"content_type":"image\/jpeg","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 00543{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_src_last_pkt_time":1436720900717195,"flow_dst_last_pkt_time":1436720900716768,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720900717195,"pkt":"ABsv8H60QPMIw47hCABFAAA0wXFAAEAGQ4LAqABnLiFGoJegAFCP9SZop0jbaYAQH+o19wAAAQEICgAD63Sa3z3b"} 02453{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_src_last_pkt_time":1436720900717195,"flow_dst_last_pkt_time":1436720900717531,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900717531,"pkt":"QPMIw47hABsv8H60CABFAAW+uH5AADkGTesuIUagwKgAZwBQl6CnSNtpj\/UmaIAQAim7PgAAAQEICprfPdsAA+tx90aIlfAo5VgaFp1RR2lqIF11HkXG1EC0kCNTtiUHtjVp6NcD2pwL3cCqxUOdE4JFh4qboeFOsCpz9Eidh9bgtdXUdh9SVOeSpyd3qyp2GRODmO4I0mRkHS8KHpOY3nKhiq8InOUI+lYNvLwmo5jSORAzTOTbndzUE5Y3MVUQHOi4UqtVNyNQUqN4JEYoPVnA9Y1CTo+HL0aikRnBI6FBzLC4cqxIKVYeHKkfNTLCqbuYgpXQqORYuFN0aJyOi5k\/QKnMtfhWUroFpK\/BZ6vwTrAo5kruCfoHBMkSse6B6UnRqNeZwpejUb0a4ORqg9E5jlaiHonAvciarG9iObyOVEB\/MQUjo+Ke+BQnfVVOZYFFZSuo7HVlCwlfgsNhQJ+hQJuh4UqwuHJ0SBK6HhyrAqUvQ829WtFIsSAPSdHMCWEZAk3CjSXgibY5qBJ1CDp+CJLCBAs6irLb4dPrTAhbPwonSOCDpkCJZOCPnqEXSo1GsqIj6RRxJKgo+m4IVm4cPWECLrHDq9Ogmc\/gj5eEnKo+a9oIqqzlaoIqPQndwKqI25WuS7u4Hcjxo5HDZ0iCZz+R3c5tj0cNiqiSdyiY9HJpzubY16iYqqNjlRCKqg3l4E5UDkXgReUER3A1V4E7nDaj3BE9yA1e4OTkBVagORvA7m8CtRQdzlm4GzRuY+fzmPnKDedwNVeBeRwLy8nZWCdWreQIGTJWcSSvCBbXKqjrKCrrMjIekQUXS81E5yoj5\/AxJHBC93AiOcNjnKNiP4IemUUD5FCLpnjpusvRVS2g6rbyhQ68gUVtNarNnRqBbKBVkkcKDrajqLYcFZbD06nW+Cp1tGVFtqiktvmU1tclVbbeFPraBXS2o6S2lCp1vh1EsqKq6yiKy2ECssjWm8\/gTlUacrQVEUHN5AXmKDuj4HJyC5HINEc0SK1wI5jgc1UG5WonI1OT5U5jXM4lyIoI+JzXOTgfzeTc+HglVqpvcijR\/Km57XqkRzQjZI2oi5yOWK9A5XcNnLwlc6RVC2y0IelUI2zIDOXhN6VSoknalG9yjje6QcPSIDeV4RLIoV2zuCu2eNqDpkag6RrlOVAcqcDnRqN\/R8KZGIiR0KssLWVOV0DRWHQcOZ8KBP0KpyLFwSoxRuRqg7m8hyNUE5VBq9wcjkTR3OY1zkG1H8kxXK3G9rko0e9jGTqnTdZcKi64rdF17kUGklTBssxaZRsnQK\/TsFEkqMj53CRHcLu7hryIDlY8OVFQ5YUHOsHBP0KhYdWULCwNCZYOZOtdUTLW5q6lXk7nU+C6lVgW0r8E\/VlatMhVOboeamWFETpErJei5OTo+adzeByxoEvRcN6c0T+bw17kErmKNeZwpFicNVZzT0YiU6R8OXoXBIsSse+FUS9C8JUYo5OjUJOjVD1Yg5kiQJkjUH9FwSrDyJEajJUa1OToualSNoTJGgSpFwToxoTtjaiz0LSp5KvBbdU5O11N4NjsxuIWzoOBszGolc4UaP4I0laDGyI0jXoCLyh3ciFRWg7uaNVbzT1YiJUjcNyNRp8jHJqyTgjSy0Iem4IUma03noDec0OVeBvLwNRVJbz1G1HoNEeompJwMXnji5eEqORtFRwkVVTaj2AqtUOTkacncm6JUaVWuFy9w15vA\/mID3xKD3R8D+YqciN4bnMQUiNcNea4OTlDuRQaqoHdyg1FUEaqoRUeEbn8NqS8OJX8lGr1HE56hE53A1yqnajtNTq9aYMe6OZzD0rQYj0BiO4TEe1pGvcEaSoNGS8DEe5ETZuZB0zSY1VWRucoRJKgNWZ6cHSPCBZkBrZ1HXbfVFBb0bKiWeFXWVGo+l4IVegJy8JV5B81eEnLzOcxU1RHM5HqhjncNivVEbZWMj6VBRu5zIk="} 02452{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":5,"flow_src_last_pkt_time":1436720900717195,"flow_dst_last_pkt_time":1436720900718233,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900718233,"pkt":"QPMIw47hABsv8H60CABFAAW+uH9AADkGTeouIUagwKgAZwBQl6CnSODzj\/UmaIAQAimlFwAAAQEICprfPdsAA+txXqETncHcrk4+mQIesIEHT8FfpXNQpNwoVkcOFz+Q3nKxj1enGqPBvOcm3n8NjZFFH0rQa2ZE40lRpiyKnF0zx1+n4IW2WhCk7kVuscOB0vBE6XguxYX0KaqxXIqnEajzf00UDbEQRdI0Imytaj53CbzkHySonFzkaXnMQqKjOR7RNdIg2cvBFJyic6LhyLGgSI1oTLC4Jlg4Jljcm5eaDm8gnd3DRHI5VeVNFRRoruBrX8JvPVjHdyfdJGDkRGKrFBWq0Sq3g5vNa5Wc57k4JOYgPdHw5eRFXOic5mbGicvRqJ6xtHO2PhOVqNO5OGronhzmcErWqh6scm7m8NysVConMfyKmi8oPRqDcjZQ7u4EXuDu5Q7k5Pxb2Dw83yd3t1e8B7ODyH2jwD6CRAyaJqNr1CFsjQjZIrmNJETaj2jcicHdyCcyRg1TuaVzERI1itOdGgPRqgqIgPRrgXm8D0jVqRYeCfo0TlWHhWUh5ufo0RL0bhvdG5D0Y4buaoc6N4uVvDVWKHdyNN5EadzHgxVRrmcolRFDu5AXu4E7uBU7gR3cJORAejUZIjeQ7kQHozgkWNW3I1yF5EE90fDfJFIm5rUCbmKNysVHPaqblag5ObwLzkBVY4fc3gkRFBUVU\/m8nkd\/w+n6WR8T9F0wwPu\/jPudZV4bsPTzU0sxBAyaMIekaJqSMBqLwN5UBU5B81eacnICt5RdyKHdyAnc5pnOUTechTeXiUXlBnSNGnKrTeRQ5WKDnRqEroXJy9E4cyxvlv5jm+5iCcsPOZViUbkYhMiNVj3Rcm5UaxF5RdzVBUcwfcqCRzVDkRWnI1yaKx4dycCLzhJyKPkRRL3NHzmOFyt4H8xBvVjwcicDuRRy8x80vM4UvMUcnIqciRqN3NUFcxQVYXBIsTQ+c9WPo+d6xhM+Tc2\/X\/EqGvP70V+a9ppl7XHHa2wpRXoWqjLLQrsnjFG2Tgi5yA1HoyNyoDecwnl5Q5WTDj5eDl5QaiuBvLwmOdwR85WNSRqGc5GN6RAYq8JqrwJzuZ0jVmn81AesDmcrOcu5FDlRUK1yM5U5NUXmI5rhcqKDZE4E6Rg2I9BIj0BF5wNRXCZzkBvO4acvByOQG89ATlQE5yAnLwIj2h3Ko07lEjkUFfGqruThK9jhv5qoVWPGvNaiRGIx6x8h7V4PO83Su+X7d6MmxPMgvSwWmAPRTkCqm3zYTTL3KPMazs4KkdqNzVhu1wbQK1ARtloq7LDGq75OCJX8nG2VGmOVRx9IgmpIg2qqiaj0BF7garnAxZFTh6VWQrLwRK7kR9K1pnP4GdyhHzupNVyIaq8xqu4EXlS7lUbXKgc2XhxOcomq9E07uGjXc5TncCc\/hx8\/hMcqNJznDj56IakrRtbIrUfOUIlfwMWTk42yK1ErnoiVyA1JEBiScxvKiFVVBnPUGuWebqudzlvKo0bI0GKvAiKoeBF8d6d5ns2RZTHZ6a5eP3lkqG58+bOrkZh7XU+UZK8vrKPM63t82pWv02nUCw9j3TNCs2zwVGWUFWSw0IWzNFE56DjV3CbzlBvOcNiOUTVVw289A5r1CPnKJqu4bEfwmc9ompIo4VkRqJZVCFJkCPpOCLpkCNJUaY56qm8qgnLwI7uTTncJirzGc\/hMdyhyPQEc5w42yuFA+ThwpMoQpKgo+lQcfSqETZ0CJZECPpmg1JlRA2djGIkacrImJ24lIRpUQuPmoZKQgZqzkoitxTycjjRz50uO7xSgiHlS8+6B15+eVhjvN9i8fzZqHGPKCgZlX19Fb0GWuI1c9TND3m2+V9f0cn0TW8f6s\/dxUVrfmsJZaFNbLGq\/SInA2djUTZ2jhSVR1+lapj6RzInuQcazNBnPcESyIJnSOCFXuCF8ijg="} 02189{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":110,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_src_packets_processed":6,"flow_dst_packets_processed":26,"flow_first_seen":1436720900684083,"flow_src_last_pkt_time":1436720900734468,"flow_dst_last_pkt_time":1436720900734651,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":36868,"midstream":1,"thread_ts_usec":1436720900734651,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38816,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":30,"avg":3256.5,"max":33112,"stddev":8022.9,"var":64366212.0,"ent":2.9,"data": [32685,33112,763,702,1770,2075,61,30,336,366,672,610,610,611,610,641,610,611,10956,1922,1953,366,305,794,1068,458,457,428,824,4059,488]},"pktlen": {"min":52,"avg":1212.2,"max":1470,"stddev":538.2,"var":289645.8,"ent":4.8,"data": [312,1470,52,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,1470,52,1470,52,1470,52,1470,1470,1470,1470,1470,1470,52,1470]},"bins": {"c_to_s": [5,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,0,0,0]},"directions": [0,1,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,0,1,0,1,0,1,1,1,1,1,1,0,1],"entropies": [5.898158073,7.321296692,5.085056305,7.712381363,7.732598782,7.839711666,7.840396881,7.816926956,7.824441910,7.832503319,7.834330559,7.838201523,7.842141628,7.832640171,7.857853413,7.693085670,7.721205235,7.765996933,7.720492840,5.123517990,7.778287411,5.085056305,7.565217018,5.123517990,7.755377769,7.760787010,7.733772278,7.715420246,7.768604279,7.540043831,5.123517990,7.831338882]},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 02451{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":130,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_src_last_pkt_time":1436720900687959,"flow_dst_last_pkt_time":1436720900744752,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900744752,"pkt":"QPMIw47hABsv8H60CABFAAW+u1hAADkGUttSVRqiwKgAZwBQ4lApkhzMOpIM7IAQAku18QAAAQEIClYLL1sAA+txSFRUUC8xLjEgMjAwIE9LDQpMYXN0LU1vZGlmaWVkOiBTYXQsIDExIEp1bCAyMDE1IDE2OjMyOjE3IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9qcGVnDQpDb250ZW50LUxlbmd0aDogMTEyMjY4DQpEYXRlOiBTdW4sIDEyIEp1bCAyMDE1IDE3OjA4OjIwIEdNVA0KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZQ0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0xMjA5NjAwDQoNCv\/Y\/+AAEEpGSUYAAQEAAAEAAQAA\/+0AbFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAABPHAIoAEpGQk1EMGYwMDA3NWIwMTAwMDBjZDFlMDAwMDUxNmQwMDAwYTY3YjAwMDBkMzhhMDAwMDQ3MTMwMTAwZDU4MDAxMDA4Y2I2MDEwMAD\/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT\/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT\/wgARCAKAAoADASIAAhEBAxEB\/8QAHQAAAAYDAQAAAAAAAAAAAAAAAAECAwUGBAcICf\/EABsBAAIDAQEBAAAAAAAAAAAAAAABAgMEBQYH\/9oADAMBAAIQAxAAAADRJrP1fOIlpAgZgklAaSWREiWQ0hYBBKMG1GQ0mshINSQNKwDZqISVGBpCiEDBAlSiBIUY0GoAhRgEhRMIlm0hLpRTallISS1AgnEASgbEmowbUamIMzBKgaCCgBEs2NLM2INRiSFhiApTEksNJDhobBqHjA10yQHEiSSgCQoARGYJBhCQZgklkCTCgQThDSSzabMzAkuECSUY0gwJJmbEGogIGpiCWaEBSgbNRAk1hiCcJCDUGkGshpCjEkKVJthagbCzEgKMEmYAjNQICzaaWoAhZmxAUYIUZySQsAQcITZqJSxlGVMgDAJCwCUrCEBQYgwoEBQQkzAJBmxKXSBBmbEAGggowSlYBIcQJKloYRrJCQtLEmsASVhiA4kRGYGQUQkk4AQsEwgswbNZNESw2kzUk2awBJdKQg1KQ2ow0ROkNBOpEk1BhBZtEDMASgCCdCMMwuixAcIEBYE2HEjbNYBBOkNAUoSCWTaTCiKSWBthwkkBZAQUGINwDaCjkkhZobDgBCXDE0pYbQThobDiXEicJjalhNIMCSayBCjAEa0ySQ4QJNQYkzMCJYBBrMEEpQIDokIJwkIUoMSToBClAEGtQkEs0YClHRYk1pBIMwbNQYgnSYgLIEBwkICyYhS0tJCxFthwmkKMASVmhAWbEE4TSQsgIGpNBLIRBQaQayBJOAEBwMQFpAkukCQsAg1kwjMMCVgRGahtk4ASFmDYdSCQtbGjUbRJdAkBZDILMTalGxBqU0hLiYmGDXVNCjMaUrANmsIQlZttqUY2w4RFAcShClECQoCSlwmETgBsKNMgZsSTpAgKSIlGYICyESVkBBYBBqJog4E0E4TEB0gQHA00FqGlLhuKTNQINQJJJZgg1KY2ZpImFGNJLDSTWQIWFASXDBBg5BGoAgOEGEajpmg1hCCcIEEswQl5DSTM00EswQFATalGCCUYJJRg2oGCQsxoSswQow0lLgQhSgCDUGkBYEkOEDYdAIJZgk1ESQpQcUhRsSFGCQZgklgEmZg2pZyEBZgglmMiWQkhRgkOBoicSMiWbSDWGJNQBJOAMAKVVMgYiIUahNE4Y2wsNICwNCXUCIlmDRuGk2S1NsLUYIJwRbZrDSAo00GsmINQEkk="} +01265{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":130,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720900687959,"flow_src_last_pkt_time":1436720900687959,"flow_dst_last_pkt_time":1436720900744752,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":253,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":253,"flow_dst_tot_l4_payload_len":1418,"midstream":1,"thread_ts_usec":1436720900744752,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":57936,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-g.ak.instagram.com","http": {"url":"photos-g.ak.instagram.com\/hphotos-ak-xaf1\/t51.2885-15\/e15\/11386524_110257619317430_379513654_n.jpg","code":200,"content_type":"image\/jpeg","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":131,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":3,"flow_src_last_pkt_time":1436720900745027,"flow_dst_last_pkt_time":1436720900744752,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720900745027,"pkt":"ABsv8H60QPMIw47hCABFAAA00CZAAEAGPJfAqABnUlUaouJQAFA6kgzsKZIiVoAQH3QuLQAAAQEICgAD63dWCy9b"} 02398{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":132,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_src_last_pkt_time":1436720900745027,"flow_dst_last_pkt_time":1436720900745912,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1445,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1445,"pkt_l4_len":1411,"thread_ts_usec":1436720900745912,"pkt":"QPMIw47hABsv8H60CABFAAWXu1lAADkGUwFSVRqiwKgAZwBQ4lApkiJWOpIM7IAYAkuj6gAAAQEIClYLL1sAA+txwCbUpLDQ4oGzWTEGpQNmoAgOkCApQICwCAsMQpQBJLAJDhMSFgEhwNIJ4AgnCaSalA2HQDRrNiAsAkzAiAcYgnAjBUF0zbNRMQThAQUQJCzBCXEgkKMGzWAQSwCQsAg1kCDWEIJRggOJBJOkCSWpjZLMEBwhIUoxtmsCSSwBE4AbNwCaUswaDhyGycNDS1Gxs3ACA4QJDhNJNZNJDgYgOBNAWbG1GZFJOAaSdDGFrJpJrNjQdIMEKVnm2azG2ThiaDhDSSjG0azItKUQ0LUAaDgBAcSJIcMbRmYIJwxNhwgbDpDSFgGzWEkKUTCClA0syBIcMEJdDEGoxNhxTEE4AQFqE2a0gk1gGzcISDcKTQFqaJKwCCcMGzcJiFmoEE4ASThsQSyaIKAJQ6AwTUdFiAsxNmsA2Tpg0ToG2SwhAcANhwgQSzBAUpjYcSklLhjQFgSDcA20uG02FhNIWGINSkmwtUk0azTSSzabDhggnSBClkJIcIEGoMSHEiInQCA4TG1GobalhiQoCSSxIQ4DBIWbEBZCQHSElLhg2azBsLAYCjVTYgLAIJ0xNBwA0HANsOAGydIEhZxGTdSxAUoGg8kSFLJiCcMGjcJNsnA0g1KBo1hNClhpAdIEE6YNKWRFBqUNs1gEGs5DZqNiSWEiJahNBZsQFqGhKyBJqWxonTE2bhMSFgEBwMQTyUNm6liQsgSalA2HDDAM1VTQHQJonksSlwIQl5CaTWYmTcA0GshIS8QIJagaDoEhLikNpcNjZOgGwtSGjWbGg4Y2jcMTZuGho3CYg1EJIWoGzUJiDWICDcKQgOKY0ajBtSwJBrMGg6BthwNIJ0NoDhAgnFCaCljaU4BNB1LGw4YJJZg3pOz8qed7XdIcPu8Zs1kNs3CSaNwMbJwDbDoSaDgGg1gTZOAEE6kEmowbNYE0boG0pQBs3ADYWAQHDQ0azY2HACDUYIJ4hIDgE2TxMbDgBs1mCAs5CAsAkLMEJdIEmsgSFhiAsMSFECTWASFhDZrOQlDqQSFmhup53KHI6cB1Lj9meK9Fz4bivpPjGjdNDAcDG0vhJkLDEE4IjZrJiQ4ENk4oTIcAINYBBOAGg6oGTcANhZggOEDZuGNg3TE0pagaJ0waJ4gQTxAg1Gxo3FJNBwSTQfIGg6TG1LMGXFhjSlqY0HCBsOAEGsgbNZEkLBg2HDBAUQFEy+NGXE98350t4T1PDfVNi0JwO3YzUv6z85tOtbIz4f1SU7gvPQxc74vZla5u3lNG29X+h5GKbqezzGg8lCCdMTaXSGgnSBBOhDYWYIDhCbDxA2azG2Mo4vFNS5Jk81tGOTptMm6AbDjwYpPvhhjNbZjmo5JlTgE2bhA2bhMQawCUPBjYWGIJ0gQHCBAcIEBwgQagNJOEDYcFF6MfaNG5u6L6CzOWvBeuhIakes\/P38PyNV2t9W+b9J86dJ8S\/M\/cc47L4v661R6l5P7E8jaJ9h+hnlD6YRPNPc\/F2f6Hk97njZntfJIJxTTIdIGydNNoLNDYcIEksxNm4Abmou35tTNco168h6OTHS59fk83u9AWOmzj\/F645g6OaGVZ5zTTr+b7RyOTr4okuwovJo5Ix+otgM4UivQvhft8usk8XTyMqcJjZuk0lLpg0ToYglqY0l42NhYTbJwwZN1IICyQg3ApN2emZPmO\/wBkat11BeM9PdbvA3HDr4X9KPNfsDdh8+PQjyra7GH3A5e833+Vu6p6C8zyth6icYaVJPsK\/cCLi6HivS+3NtXrHza7T9N5\/aYWrv8AEZJ5TGkPAGQ8EMm6QNG+liCcWhq3Va2ZdOpd0ah3b889l1HFVPLtyTk="} 00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":5,"flow_src_last_pkt_time":1436720900746004,"flow_dst_last_pkt_time":1436720900745912,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720900746004,"pkt":"ABsv8H60QPMIw47hCABFAAA00CdAAEAGPJbAqABnUlUaouJQAFA6kgzsKZInuYAQH6EuLQAAAQEICgAD63dWCy9b"} 02179{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":161,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":1436720900687959,"flow_src_last_pkt_time":1436720900865663,"flow_dst_last_pkt_time":1436720900865785,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":253,"flow_dst_tot_l4_payload_len":22769,"midstream":1,"thread_ts_usec":1436720900865785,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":57936,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":30,"avg":11468.7,"max":111969,"stddev":29722.3,"var":883413632.0,"ent":2.3,"data": [56793,57068,1160,977,610,610,428,397,457,457,672,702,1281,1282,1160,1160,488,457,428,458,111480,31,111969,336,1343,61,30,1038,885,793,519]},"pktlen": {"min":52,"avg":771.4,"max":1470,"stddev":697.7,"var":486813.2,"ent":4.3,"data": [305,1470,52,1431,52,1470,52,1470,52,1470,52,1470,52,172,52,1470,52,1470,52,1470,52,1470,1470,52,52,1470,1470,1470,52,1470,52,1470]},"bins": {"c_to_s": [14,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,15,0,0,0]},"directions": [0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,1,0,0,1,1,1,0,1,0,1],"entropies": [5.838165760,6.902098656,5.046594620,7.571764946,5.046594620,7.804839134,5.046594620,7.765610695,5.046594620,7.812949181,5.085056305,7.799284935,5.032077789,6.483376980,5.046594620,6.923000336,4.993616104,7.515916824,5.008132935,7.819376469,5.046594620,7.844942093,7.811455250,5.123517990,5.085056305,7.765757561,7.802289486,7.797224998,5.123517990,7.813294411,5.123517990,7.806335449]},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 02442{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900872835,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900872835,"pkt":"QPMIw47hABsv8H60CABFAAW+QeVAADkGzDdSVRq5wKgAZwBQ4m1aOHmGBPBEEYAQAktTqQAAAQEIClnq0tYAA+t6pEVxjNbEsTo05BJiqWC+y9Cm00IuBsqQ3OjXYmls3ooNNijoaA4JvaGXA6WBNFUSNxldWicRkqfSvQ+ysT9n0voZ+EyJR6Oy8JFg5mjiK3jhnpErGpjhG8skeRODdCdQ2MDy8miGRvQk1oSZFhVmGQ28jcag3sVEigomNJgo2R5DYnSdEiIuyPaJg2JvQlTQl7HH2PCFhjS9CYo0RCdlSaY2qVbA7SVlukMk60Nrou0FvVb7YyZLsTJUNNjXYcKjL2NNBHY6YRIqyEsm+g1byhIVtLCoTuULeROaIZSg30H1KXibE4I6MNQaNsuwl6EmkRW2hNPKHVGvY2h4LXCptXgsREUx4KkzYc6itsZrGceuCUwiNvZ0NlpU4bHVgOMeBQT+hXsW4NkxniYRKY0LOGPOuJ3wxvNY30XInTbyUHSrYx3BbGhCWhOLAjiZyQZFUJdjY3cIt4ZOkJvIlCy+hRiRG+RuPBllCy6VrIsIWMN5wEbUZGNRwXYxYMsCZvBM0SI+CRpDbsamyBbROyZoo8CJEl6E9mJ2S8EM3LEKN5FGYSlBs8UdkxmA2mpRC0zPZ7xJ9CwL8H7GJMEIRrTFqwKrYnyiJkSFrOodENU0wTGWNK2jlI9lfZlilokuhJLsxJCYIN4hejdRoOrIspMTJA01hjZUKPFINeESqCUMEQXvhWETJONsmi4g1wbPQfoNvgSpYMGCvY9YNIqvA3SQSmRLI4YPo2XNMYImYP1DY4jPgTTw2RtDTZj2bUhs0VbI6JdDjHkaG0not6KSwmmsQgk2Q2d8EY0NThbnDb6LikplbG2dZcC3WN4yZoyEhYNBej0BWx7I90tpJlyN42ZDbInnJ1C1j9i4ezDdGzUCRBRluhyJbIYWhtD6NOhqmcKFroh5EphFtxoj0LHA27N4EuzbHNiablHlZGpBOsMNmxNFXQsIyISmhtLI00bJ7F+j1S+jDRaWi3vmNnZe2dMzFsHjJciezaGpgnsUwLB9OsnZ3niE9jVXaWBDK2XAvaENk6N0ekQ2O9mkVid2JeCeikitCaY2qSMSexWxPhK4FBtCR+iXk7ssgLA2L0SCdTorMmVWF2XC0NTE0Jx1GuCltCJQTg1LLSyaM2UJLoSF6DFF9Mw9kaL7IKmI4MmxmzPiZWtisp9MNxiCdRNs2PYXFI7EHTI1SpITxUMwngXpkyZLmoTeRzsWCnZ+DfRVtifokzCxuYoykLQuIaLckmHw90WsHeOLnJ84eDeStIr0XApBloXsSFOuGxPJSo9D4JV5INNsaqEnFWmLKwNNiDhZETR+8N0hPQnDfQ9jUeRJC3L2abSUYrSyXKQvTLUJ0TMDXTG22NpLA+h7pbgbPbEFhURZQjQj9GNi+DZGcFGLsjYTTQlYRp28M2yQyxotDecoU0R2IEl2iJYG4illoT0E0yNMauOGKUSPA0mRrZpNHQ9mUtCe8LiDqwZ6FGTD0YCawPKG6VPR1B6om0oVtJszsT2oPLg1iChibE3sd6Emqj9QlcmEXhv0J3fFLW0UaJbG7obENhs2LInSGhYWLA09oR2MwU2WaOiiYyFETeCZiGhtrYmeGRtwUYEs5HJsYE8FFhHQyA82YMmWhvJ+luERPJpCaXRrgavgriCd7HBcZJXUMHg9aNwpE0U5guCZyNlQ8sSjo1kSMsTUUFRQbOhYwhtnKP6SOXI1R12JOnuIeq2VMpZgm+hdg0iYglGUXsWqM1gbLTRccdQh6Ku0exnodIIyzBObLeyzRbgl2MPIvcF+DTaqR8HaG7s1kuabRjJ0TpPR2VPJV7KLKyJPRF0V2DRrKEZhaNsjpZo9uNoKHwaJdi0JwbUojVhqtMTJ4I0NdDcP0bBkIaxSOjsCQm08MyRGoPKyP2uPoVQ="} +01258{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":179,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720900692262,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900872835,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":259,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":259,"flow_dst_tot_l4_payload_len":1418,"midstream":1,"thread_ts_usec":1436720900872835,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57965,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-f.ak.instagram.com","http": {"url":"photos-f.ak.instagram.com\/hphotos-ak-xfa1\/t51.2885-15\/e35\/11424623_1608163109450421_663315883_n.jpg?se=7","code":0,"content_type":"","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 02448{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900873323,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900873323,"pkt":"QPMIw47hABsv8H60CABFAAW+QeZAADkGzDZSVRq5wKgAZwBQ4m1aOH8QBPBEEYAQAktstgAAAQEIClnq0tgAA+t6yOoxEtjJYMe0j6G03geIuahaK1oTHsEliMMTZ8IV3w+jNLnJcKpRQYoNH0Q1owU7ElIg1BvY00M1sKh00GrYYaKmxapIfSuhKlliV5Ggz2ZEdUXqEuURYhcRmGdF6HkVYKkoGKmh3bGvRvDFLCRD9sysMedkSiftieCrscIysGDeGZuR52JNFJwy1gdIqmuE8SC43k2NNmXvnK0LZ7Q9kdYKlspkg9CZoqhXWJtbKpgafXBrJWhOsqdlcjGlMIf02UEyYUEoN\/R3BPJjY2bCG2s0iEvRRNQ+jO4xqKDwyI0ohahosjThi9BIrI7gehuDWUCCJLBXotaGI3Qlg0wJ4IVBKoTow2PA\/UqeR2ILqdQ62OGMraO4hekPhuNoceBSE3cCJmskaK+hP2IZK1kxs+D0NwaUQbYMYurNlQeMoTLYsrBUslTyTGB4bJjIpUh1Csyxlol2o3gucCaI7VzLkaJHRLOOI9DqwQy9GXvictCZRvBROF7M75lwMNqMbA1Q7yIm8GJWsFybGm8jbOi8hKnkr2M2jAtIEustYo61E\/YmmP6L0b3whJbGvRDYcGUzATfFIDVQIw2Oobux01kTo0N6FINdmGBYdKOUophoRJtodkbFVo9gsdiVGqholRuBaWjGKEmDKSSFXnjQZrsSagmHGQ2V6YSOqJlWjZkzB3BjS9mOWLBMSDwqGspicFTSY2vRnKTsOEJT6izJU3UzZMYLFNbFHhcKrhEElmjUHgsGw3eFliqL7LktKtGhuCzshGkdcMxokwNDSEy0x5WRazwkNsaY8bLNjG6JXCGsDRGmNiieYQKFSLNMh9GJBBqDcYmQ\/TLYs4Y5okeCCq6KrROsWRPA\/QgqexNDwJeyORUtLVhijncHacZgTImKglDuKPKPiNMVuBBPFGsVisByZlsa7HsdRZxjrKIyEiLkwMS2JuxPlJTJB8H6bZlkrSN1n4byX0J4EzWxRB5yNNiRbIpUIU6KJCXaHjR8G5KJ9CS9nWBuYG8YG6i9HshCfoTL7I9i9svs2S0igzvAmIqQvhrDHLkQf6KrgpKCatLEWjeRJbOsDeINKDg0ui5F0zaibWWN0bpi9BWZoEHKMpILVMCwVlji1gwwlSnhCVWC+iHqDPofxpWqTM0eNJ2xqh8YRjmCGxosC24xO6HlDsYiabHsVY3Q2j8FwXDnhHTop2I0ZBKKmqh+g1MksMLJUzHQ4tCWBioqFxpAlEhOSDo8Dagmn2S4NI9pDj9P0qphlFmxt9ob7Q4fDeWdIS9mSomrgesCHk9xVyISbeBYZYqOnkRY6Qi+xNoTGi3wtcJ8IdEGuiiJs+CUCzHWBIwyehKjUWCjSYQ2xehJQkV4bmCDSE3ajpBI9MbbKsnYhMqSE6SoSmxVZQz7F7Cxw52a0Oi4wa6G80SyNISCZNs1kTWjAjbEjBSIX0JgVNEej4YLk6FUNkLSpOMieS4G8EdEeg2KpGUxUsEchDaYw1FYKjISLZtH5xdj6MjnZrR0KQaPJCYqtCpZNBN3Ym8GJNCRoeRqPAyVRi2Jvp8EoJ4hRsvRtEZTjFNsRZ6Lg1GM+iyL6KpBqRssXcg5w2Ui1l6HGqjFFnaPpYhNtEfI6Fk9p+jWy+h1jWBucKo6btHQ1cIbLY6jKwI1kTtCe6OF7GyQ+luTvB+OCeRZE8Cjzw\/QQ2lsbbGNL0REErSTiKuDRksFTw2JZIJTbY1oaZGzXwTzsbdEiLmog0Ji7YqmN+hroiag0PQeUVDI9mcQw6G101ZROVMQtGQ7eH6WaIbNDwsDsK10NpNDbcMrspisEOJISYYqTRU0RDqgVWGQxaXIsvmpFmWPDA8JDDqHRSQsC9DYnnBYhpbF9KmJvaYk7Ktm8jfrhZcJnL5r4twNjbk="} 01116{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":181,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_src_last_pkt_time":1436720900692262,"flow_dst_last_pkt_time":1436720900874727,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":488,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":488,"pkt_l4_len":454,"thread_ts_usec":1436720900874727,"pkt":"QPMIw47hABsv8H60CABFAAHaQedAADkG0BlSVRq5wKgAZwBQ4m1aOISaBPBEEYAYAkuwowAAAQEIClnq0tgAA+t6gVfQ7MFNkaaY6UYtVjcYmNKZHh44WGONzJU9jypRxkEJuCbYsKLjBseRVBq0NaK7LUkssiaahYoJu5OhE2G8VnWCtcDaZgWDBjonkcI0rmjaVGwhtshvWUKqP0J9kPDImX0N4wKOzJITa4ytjarJ+n6XoT2G7GJjaG84G60N15N6FqouM8BmaKl2XNMXS2Ubzg2yMaEiFguNjpRFmyl6erA8Id6XCsbYno+FsxtFcqMsMbeGNDqVsRclqG5RqsXDeGVklULYtCN5FCwNRWY4brrPqNh4eOMka2SmUN+yvsSNB\/B+ytThN6E7FNsWsJibe0JTZQmhGnGdHwWox4y+K0UTTE+0PQ8ZYyWGFnQ8Dhn0YnGIsQbuifY3WxQIWlU2Jpow0VtDfoT7IHY4ehZwkOSE7ZpJikO+hlOsc\/S4yN3hoUJOy4F7CZXQ\/YSR8HoTI3kftDGRS5LT4LVhlG1pieiVC2J3RFt0bZVodNQbZm0GyCXoXsTNFuRvEP\/EACcQAAICAgEEAgMBAAMAAAAAAAERACEQIDAxQFFhQXFQYIFwgKCw\/9k="} 02467{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":183,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_src_last_pkt_time":1436720900690339,"flow_dst_last_pkt_time":1436720900875825,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900875825,"pkt":"QPMIw47hABsv8H60CABFAAW+G2lAADkG8rJSVRq6wKgAZwBQrVt8zLRbo9aCTYAQAxSDewAAAQEIClRjBa0AA+t+qDhdSVH1chUH1JtbCJY\/b9U\/35z\/AIcB2iAbyHujCEFNZ+I0eU8EOIX\/AEB\/qRwVo9Wlp5znKiVYRroroyxNdVdiE6kdYXRMS3KcwBs+EyuWZYuo52fCGCiRaGhDCm0eStltza5zDLVQe2oxt2qbSrdR5pHTZPJaAK7JTxSrekwfflKFROdJwg5Y1CyNVSaHSVxDS0CVTMOVI9v3UgC122i67XHxCfXa5p2RquKuPMJ1XpUxG6NIvp3blVKRpiVRMtCZ59+YOFU7DcnU6dTOhRpECHZCLSwomfujLIK9xojog5ZGQgQ5VGxza\/YotDtEQRr+RTZe72UhDK0U\/Sg+fuESn9pT0VTtKEFOlWOQYBlU6VNyNOjonUmH0p7LdOTSD6k6C1Oj5p\/wckoMOHKYPO3tlU9WFVKbrygB07fGU4txhOccQn+qSgN0CjqgJbEqm5ow5FksvA7VeZ7f3Tajd904VNW6JjQ5ncntFPTPhDtGVPjVZB91ncoRE8oIyp5N9S4cEODlVJp1JmA5fEBxtqYKqUOqP+\/zSg5U2tcI3K4r1W6whjKbVcNE4l2TyDtij7fIFHV4f3CoGWKuyWKj6ICHjmTYVF4grovG6HUCdTvzon0H6hVh+C1MMIt8ICE07KNwg+cFOZuEeTXFquDtU5vj5onCADRCuEIOGmi9bcI9qe6Hh\/lSnr\/LyBA0QtO6w38TUIwWwCvsgy3VFt7sqxzT7KwyZTqc5blYj3X06flx+dK1UrEqM45DARcbWwqkkymmJC+hEywLVAnRSFLZ0Uh2F02s75QrdN3lqFtZuO1OGwcuGqOAgqpFMWFAx6lcXdgGuiNNzYCtMzGE+FGJWdEJR5BUG9p91xTbqM+Ewy22pp5VKoaLu4\/b5BzCouE52V4uc5eoyu2IHzQgtMrhTPaqXY51NHLYVLteWrXnUbcEx1pUhytVgUIjzlVKH10\/2UhqqcmlOQfGqIDtF7I45NMpzflptJyiG\/dbyiJTaj6ZTiKrbmo5ZHhMMtRKf5RzypychE\/TsrBP6osiBO6jfYoVBq4Jz6ZGNEfUA7KqOaIsRYcFuUx8DCcaZ9QXSpu0cjw7\/pyoI1\/xGLV7rflJtjkMIOwg4rTVSeRlD3WuyIIAXoy5qI\/DENgr4jNzxlPqdUrUhEuZmFfdl26N8xOAjGpXr9KDMp\/b2cg5m4lf8u76E2rRtxKi+mQqYlpb4VNj\/S8YREfJPzBEfKCVMohcObXqr2Vg\/wAoZTxbXnyhp8j25QMIOKL0AdeU2PhcRSg3t3TXfS5FiaY1TvI5B0JrhqnsZU7giFog4OwU4cxkwtBCPLZaoE0nIgeoaJuJatkdORVDu7Toi3xGE7KLogHZdS37K7Ca7OUXI936Koe0CUDyCBTg2qId+6LS11rvzZ\/KZqoJ5brPLTlEqFoVKuOCobMhCqWm1Q6YKtduV+OT5hOoPnKDcL0EYwpFTRQ3Mp0GIELLsnZXv0CudC115sBLwAumQ2Vw7vxLTo5VPwqxxKbWp7ynCfyJwpUrqNIh3yxATdVsqUmqFUZ1GLh3EiDsq7e27wm6IhBQnBQoTGSZPIhVh23eFh7IKLc2ldzcFEbpr9kfPNr\/ACqudEeV550hHepk45Bao6qoMSqTx6XJ4teObhypm39E24i9wQd3SVUI2TsnKnZXYgrJ0TO3ITjPIK5XJpVRvVb77f4WZ5M9QUG4hbcsrbkFK+3INkwoA7TsrTspB9WEa3bnXyu5xl6p1XUk6qXbo5gxgJ\/cwRsi0jVNBQLtxhXSSSnFzk4QMr6UQYley4MfidR2jVVqGpk4b48oVXdZrzsuNbkOCHDuPc7tHvycN\/ywOYTlupwuHbm9bJ3Y8P8AKIuCpnCBwsSgii1WocyEzwuKp4s="} +01258{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":183,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720900690339,"flow_src_last_pkt_time":1436720900690339,"flow_dst_last_pkt_time":1436720900875825,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":259,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":259,"flow_dst_tot_l4_payload_len":1418,"midstream":1,"thread_ts_usec":1436720900875825,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.186","src_port":44379,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-e.ak.instagram.com","http": {"url":"photos-e.ak.instagram.com\/hphotos-ak-xaf1\/t51.2885-15\/e35\/11379148_1449120228745316_607477962_n.jpg?se=7","code":0,"content_type":"","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 00585{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":184,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_src_last_pkt_time":1436720900876192,"flow_dst_last_pkt_time":1436720900875825,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"thread_ts_usec":1436720900876192,"pkt":"ABsv8H60QPMIw47hCABFAABQv9ZAAEAGTLPAqABnUlUauq1bAFCj1oJNfMxlZ\/AQEUsuYQAAAQEICgAD64RUYwVLAQEFGnzMtFt8zLnlfMypR3zMrtF8zJKnfMyYMQ=="} 02463{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_src_last_pkt_time":1436720900876192,"flow_dst_last_pkt_time":1436720900876222,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720900876222,"pkt":"QPMIw47hABsv8H60CABFAAW+G2pAADkG8rFSVRq6wKgAZwBQrVt8zLnlo9aCTYAQAxQelQAAAQEIClRjBa4AA+t+wmOB7XojZOEFU4d2lFkGFHKkJCsYZuTsHm3Jhey0RW63TvKf6OTjLAVvydyoRdlPrt28I6yN0GiJRG6GSmtNyODhOIieZ5BAq6wSU8Q4\/wCGuTvWvIVyOSvpQGVHyXcgVjVMIB7shSwZ2UXNFuZXTYz1IFxwNAnS44EBOy0AaJ2MJ0xahhC44RUwIXqMINL3JjbhDRjb3KdQsb\/U5fDW91d1vsq0OoBwTRUruA15nH5umHKCVS4drBfVT6zP+m1UqhLjKGVVFzCqTpamake6A5DmOWUORMPKEOEKqyxymEYKONFJcjooTX2lHIlFtyiOVNv1LCzvznZHGEfSimntI+Q8g7SU1rIL3\/omvLnkxhPbb2pohybMqqbDaFJQ+QIJxucGqvqHef8ADu0C3RUieQ1+aFogW7q+RbogEHupFXOKuMwu5gKujuJ\/RXGbnHKDSTK9P6pkiCndrjyawplMuHaO3\/dU6nSx6nnwqvE8RpFquJMlUO6iWot6Tem09x9R8cyPnjkxpe60I03NMFWk6JjTeAUWG8hyoNzJ2XEVL3W7DlTNr0w4RVA+pvhD+Y5ThNmYQwih81VvdKYuKZc24II8rVPKEfQE7Dlh4VpBhRAtC15j3W8jlsimaoenm7nSdcM7K2CfCfBGEYHqXUWpk\/MEEzcqoPwvt\/h9oRceYQ1R1+WN1LTAQDZt1VRhBTQW6jBVlzUynY7uVZzBmmJO6dWqPbZAAWSrVUgFTACdUMQOVOk6ppoiaNNue8o1qtYhgwPAVOkyiz3XHeqQqbJaXOwE1zqNOYy70oTfa7f5D+RSc1r7iuvSOqfVayH0DlN4+oPW0FX8FxbO7sd5Q7GFCmTqrIRwm8QAF8Um1i11yo1C8zzBT5tJCpcU66HfIUE4ShqokJ7bXlq1wU1pBgqCCo5HCpulkJ7ZC0VIz3FEciPC3WiItyFh2nMaobrHM8gS0yF8RU30T3ElT8x5zATDhN72keVCtUEa8p\/wzdVlVPX8+Rog8plXBuCkjvaqo\/DvplUWX6uhF4YCyEbGxuqhz2pufUpynQXeOQAbTzpv7pz7lwNOatx+lPOFXcDUyuHb1X9R\/pauv1OJDvp2XF07XyEI5GeTadyZRY5Op2mFEIJ+vzBwtLSjUkQFeV1ESCoQAVq4YaqVry1wv5dbPlNrMdoVPInluiENFxTe64crnJx3CuLkQdeTTYZWqeDcmtAbClAJ0tXa4cmkJ7EDsUeQ+Q\/nFaBUk71FCdl0Q6U9tpj\/AAuOQ1ROU7Y\/JspXuhMKxNYyMlNcxphxWC4+EROQoEKw6hC1uXaomdFJXuUwNA6jk6o5\/Lg6XTpe5VZ8CEQatW0LiIY3oU9tU1cQwP4cPChZCDjojnVMYwnVHpVKcdMJ3Cj7I0Rs5RBhP+aENecKFaVbGq4bdQsrVAJ\/D39yPDvavxWrrVQviaq+Jqqnxf8AWg9jt1IXF+mU33ULTCOE04gp2Cvug+1CHOnwjK1WiIxlCEJahBR\/sinerlTFxtG6fT6TrFpyP5263TJ3VbDpTH26JtTwjTud3mE+nbvP+Fnk\/VE4Hy4RbCAKn6SgQDBTmscfuqTQf0UEbI1WjUK+cBPZoN0GwhrlOKMwE1shCG6aqmLacLiu1qono0jW3OArp1Vj9gqPfw5YVlW4lQqLMZTaLKkk4U1OFIu7mqm9r8NyFxFIDuUGcJ\/OORChUxLlChDkZ2Ru3XDboHygozy+IYHFjsIFrtFDU6k0o0F8MvhAqlHpiQVe7yg8vFrl2hSiEQpWqthuiGcFAW45NwU4IhNWOXq1Wid6luqTrHB\/hVHio7qDV2v3XEGi+hFP\/pG0H7qAKBed3QFazoh+rif2TmuABO\/5R15jygmqqJAKhAwjL05lvKP8LFw="} 00562{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":5,"flow_src_last_pkt_time":1436720900876283,"flow_dst_last_pkt_time":1436720900874727,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_usec":1436720900876283,"pkt":"ABsv8H60QPMIw47hCABFAABAiC1AAEAGhG3AqABnUlUaueJtAFAE8EQRWjhz\/LAQE\/cuUAAAAQEICgAD64RZ6tKHAQEFClo4eYZaOH8Q"} @@ -72,12 +77,14 @@ 01380{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":309,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_src_last_pkt_time":1436720906070589,"flow_dst_last_pkt_time":1436720906070589,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":679,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":679,"pkt_l4_len":645,"thread_ts_usec":1436720906070589,"pkt":"QPMIw47hABsv8H60CABFAAKZYWZAAFUGhKgfDV00wKgAZwG7hI6seG5hv38UHoAYAGuTKQAAAQEICltMYqkAA+18FwMBAmCl7hwsC927JcFSAZYWLzz9PCOE13q\/R1R\/4Ep\/l7+HHbIpOFFcCYs42I3wFOgWiBw3wjx3pJOgTGydZF67jt6\/BKND+v8oyfRpnqlS5YMAWUNymHV7uHWxp+hxonkw6cNC93nRZtrxzkz6LP0NT0kghBPZC1Qj+5R6TJU9O4JNVgnaOk7a2PLjjlpxNviWyDprqQXVx0ggqtiTSBMr7Uc5EfDpzAAkL4Ijs+Gp7u5RRsTL\/vjjpIbFtLB91jbWUmuE049zO8Z0ZXe+NUKtpOUeDZz+3zpQ7uf3ydorfitQX7zdybIk3\/bzSVhOShF3BJrYBLAD2AQ24us0\/KfVGECFrd6OK2BQqjf6ncI9qOXNwiVF\/2inbzY\/Q3OsYRcS7XHEaq0O5REHcT8SzE5VoLX4XXQtBoZwVB5Yrj77GtBQdmGZD6u8UMQpctBx6N9Mr51OWWfdFnAbts6SnZuXGzlYjqJOxS7Vx73Uw8fCkf1IEri8UI1qbM9veDNciQdo3CmVyvU7iM87rUz7C0f+A4f1opsUJ5+EheBr1eGc36Efb4\/Ualnnz3nkJR3hncStDick4US+OxlgvGof266YJgZuAwCGxYg4vW2knDKYz5umzCws7lIHpIdAFNPByVtoUTPTPQS5UKgIEdb95j7F6DccGwtWvRW1Al5LucPJI7zWS2dtNSdT\/Ojj1Rno0QRGwZ45j0In5POotAgCjk30MTwIN5HhcpigFfTCmuPMsYmTn6MoC7DboyOfYCjSc6fhkNqfZ2xyKSzKyqklgdTHeGfRwO+op5ygRsksmKTJ1Q\/4mw=="} 01048{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":309,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720906070589,"flow_src_last_pkt_time":1436720906070589,"flow_dst_last_pkt_time":1436720906070589,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":613,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":613,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":613,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720906070589,"l3_proto":"ip4","src_ip":"31.13.93.52","dst_ip":"192.168.0.103","src_port":443,"dst_port":33934,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":310,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_src_last_pkt_time":1436720906070589,"flow_dst_last_pkt_time":1436720906070741,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720906070741,"pkt":"ABsv8H60QPMIw47hCABFAAA0Ga9AAEAG48TAqABnHw1dNISOAbu\/fxQerHhwxoAQAW09dwAAAQEICgAD7YxbTGKp"} +00931{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":310,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720906070589,"flow_src_last_pkt_time":1436720906070589,"flow_dst_last_pkt_time":1436720906070741,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":613,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":613,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":613,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720906070741,"l3_proto":"ip4","src_ip":"31.13.93.52","dst_ip":"192.168.0.103","src_port":443,"dst_port":33934,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 01848{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":3,"flow_src_last_pkt_time":1436720906070589,"flow_dst_last_pkt_time":1436720908201021,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1015,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1015,"pkt_l4_len":981,"thread_ts_usec":1436720908201021,"pkt":"ABsv8H60QPMIw47hCABFAAPpGbBAAEAG4A7AqABnHw1dNISOAbu\/fxQerHhwxoAYAW1v8wAAAQEICgAD7mFbTGKpFwMBA7AOHMI1ALyiYU3ya6qg+prWQI\/n9ANspqMl7L4ePI46MbeMU\/IIKBcoHTRp\/G5Sihc5nIJHuC2+37mEcl691gW4u\/TM4cTkpTf1jvX2GQ4y6\/txghh7z8FoXfNbqCHIq72qOYxX78zowj+FiMRcWPEmeWcWoH+gdWfhPA\/lkpOWh7PAWcTM6YhVbfKMzFVog0eNO6nAQ6Db4QV49GBIVCzfrXCBVeXZAcW0CL72bBYmhxsuCeKWPO3s6v5st61\/TqBX2wKyuhuh0iYRoQoS\/wYMoppq1iw5UM\/55LosXWjVhX+LnpSLv52m8IfyQkh1vrv+SJ7KjFgIF5haejMGRgEB6k28tUeT6FGaiUo32klBF\/ovhJ\/7PzYE5+p1Zs2WdUsskxD79HTvK6ta+oXXgI8zxnT+FY6f4Y3Qg+b6yTS68sbWyHT6\/PezdvhWfHtL0SSgHp8goibROD\/tT\/ewXwhvrOEixGKhip+cFDAiL8AxMi3V3Lo6cis85J1puKveGyk09JQyFUAk\/2r5Yl++ASyNB2yelevEI5wg+VsEb8Rcm\/QA7noQyfs1T5YOnO8NCBiPmye5eIk\/wZxnX1f+2xdUrgycDikO6k0cQg3utcfRP10t4qmvTrg2ek70WkuE+ATLg2Um1eRaeb81BxGpDBojTreWbcm5dcICJMpu5Jn\/w\/\/OFgLDd8zIcqEDUouT6ZCScciar49BKHurWy8NKFla9SI75KJQz9yq3QZyAG0rJc2lhQMyl9+7b4Ogizx8Jo29kTu8fZJSlg+ABrC1jcExXQD49OmAnZxwfKy6D2pC9Rse0qtqmzV+ovVEbJp+oxkyoXka2nmc36kfQhlZgI7KVixFLMTTlCevMnYrq1xJ\/MKzvCd6IWf+N5EocWD+ilOqptHNEIAOXJmgXODhL5KGWjQb8\/91W1IyUi6q\/ngSGvVRUpY8iujk6L\/C+Bbj\/Dm4AkcumBcragxaghvlWXmc47QSkqomVkZppr19doVE596Z\/iAcdVNMq1wy+2v27UYh5CMr3l5X59P07fb7g36BHbE7SHRjrHyy9CTFMxhEf0YgUq5TdIHDFI5lE\/KxLNZVidU3ki5Un7VFtJrfQka6os1jVOGfB9pUZq5Qsmwf1i\/ygu+C28zlN53MQWP6wHjI3WJZUBr81SukNH57IK2c2EyIu0E+HAgTgoJHe51A\/fUmZ1cYv7+JWrlM8pRHdKg4V83a8+0QRZUGb14qwNk4zB82iOuTyKlfeqGDo1mtsQ=="} 00783{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":312,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720908216981,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908216981,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":949,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908216981,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33935,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 01837{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908216981,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1015,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1015,"pkt_l4_len":981,"thread_ts_usec":1436720908216981,"pkt":"ABsv8H60QPMIw47hCABFAAPpl5BAAEAGYi7AqABnHw1dNISPAbuBQH+NqOzE9YAYAR7+6wAAAQEICgAD7mJbGFWXFwMBA7DGXKcxYYzj4PsFQPMmYQehh8iuvFDU6ChyMypfRInDCFuixSLIKOq63dIUv38njMJN2kVy\/t+T8m9xPVbEGAFdD3PpSc3SZZnBHiv5tCRNZzMhDLWXPkOIN9Lutipqd5IVnEEsBFkO\/fZ2K81T8PYPXOUELo\/sV11FwruvuAKdrrJSJDxsNb8ZavjfuhrjTCNZ8992aq+Ku9jOSU4Xa7Q\/BYCty1PvPxxBeD0eYCG+tOtkysHtjUZlr1d4OQxDr\/61YS0x9iJOXjnMBoobCu17VKBkd2hUXNptzi\/uIUhzamB9Rremxs\/xa5ErUN6bjCfTqClJMKTo2+EPLLC2OrnUwhZPfwAqX4LMjZxrO4OjWeKTq0PJEWrYJt\/hZgR9r16F85siGrf6FK1kTDvb0+vybKakTv5L4R+tKZVBNuaZabfxVkkl5TNMskAuzgaRl4NAmD9vaxsUvWa1r1eavZpU2b4i3TllipunjR4aQEFb47bl0X9Ru9Hl1x54J53nJ+MJknrPmdJbHBa5kRwAqKgaQptXtnMz1WTWV+Q8a53Upaic+O0txvujdC90+KUOiiTbhfTw0gAmNmPQmi2l+V2tphQpp2jEsWxETCl2LSUnlcR9XDLGnBO3KYnN9C0+k2yBKCMObHAcOzwdJWheAOhMNBVSNpFtrfOE6uSTsVbDj23xeCxxC1QAM7YJmxoVRhtdVyIDYYANmHTFeA\/uC6oLDeExrKyQP7kSEfNbdUqTNPu\/MJKIjJDZu1yLmyvi1O\/nGho5EDKw8IVXPxnfKKPvaQH2GtI88pEfGeAEyC\/HE\/tmFwWll7dh2qPp5A3wF8sKJ3O0eDAbcGfPED7oJA+EsxJAhKT6isvErCueBtWMHVSeiLsoME8tf6cS9zzgnk33LczZTQgm29MSHE7ZL2GeiGbzuGwrTGDnk1VDLJRove2wMug8H7\/TzDu7ltmYb22OyZHWPR+qBc0SXnC41HvKpdG4l5lloyRu51PXhn1Z4SBmRKxgHOd10WPpGH9Et\/GeMS7LFYrc7oqcb6G7UCvo5VgI1SuJrJeY0vV2tCM0MyJYykeRmE4\/7F1xpcmuoE1e5ET3+6eiLGpqXUS7VkABwgQafZxjQScCWI5pekzUYOfjX5epPROl\/DzQKTCdpj3Gvhf2XBY54ImjWPLE32kUQllKDfXNIYtYFjXJbjsc4Zka4\/X4kGWgbCWN+dmnakKME8cbt\/+4rEk8PQFIv1W4FPcpki7hccXc0xhFEqm0Sw=="} 01048{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":312,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720908216981,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908216981,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":949,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908216981,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33935,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":314,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_src_last_pkt_time":1436720908250978,"flow_dst_last_pkt_time":1436720908201021,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720908250978,"pkt":"QPMIw47hABsv8H60CABFAAA0YWdAAFUGhwwfDV00wKgAZwG7hI6seHDGv38X04AQAHYJOwAAAQEICltMay8AA+5h"} 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":315,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908259859,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720908259859,"pkt":"QPMIw47hABsv8H60CABFAAA0u1VAAFUGLR4fDV00wKgAZwG7hI+o7MT1gUCDQoAQAFyKzgAAAQEIClsYbBQAA+5i"} +00931{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":315,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720908216981,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908259859,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":949,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908259859,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33935,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 02442{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_src_last_pkt_time":1436720908430543,"flow_dst_last_pkt_time":1436720908201021,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1464,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1464,"pkt_l4_len":1430,"thread_ts_usec":1436720908430543,"pkt":"QPMIw47hABsv8H60CABFAAWqYWhAAFUGgZUfDV00wKgAZwG7hI6seHDGv38X04AQAHYxngAAAQEICltMa90AA+5hFwMBBgARSjwF8KhmW+xanE7Cgv\/HSeKfgB9iJwdyFf7NjjTFJxOJ97KS+l\/PKf9a18l3iaN5nJnghazHfHKEIKPn0HUVm3aObaE37OE9YqPGRma1S+RTM74dXif+0iSSxDn0pj9FkMiEQhhwpKbZTwe6Rma+4mOaI3ffuaHFUQVI8eXrEh+32DbHqMURzga2ro8v5i96gY1ciGkt1ZKxVQHtAE9OT+s6wAs73rZCIoOezZo+1KrVH7lB8hs8iOneE0L\/y6HC8+CcpW696ea\/DwvQ2tYNSWxpHpRJBTogcPPFvz\/JG8q5LoWYz72aAau8oktbMc6sSw0wvxuz+4U931T+em51myJo4clNg6LXF++UJQkliZN3hFE3O0tNGniBKUyvZgZmc0CNjtTLc8\/ZGXdg7xAG9Hjl3VmLLbM5WeOqL8TcK2Oeio8KKXsWMMf7AO+FdYDkljioQ+V5Qz8eH+h4xam36OSGGk5v3\/GNChk4FGOoQa4ijz2zszw+La3NZOKMSqptdUgOYI6FWf7M6sz7tf7JOUwip+aQGPtcm1foaIABYTdjML2VjP6Hcf\/1r70k0Ttw1rBM2IqlKSMaXND\/ec3Tk6NvJuEMY0EkTO0kTRAdNe4OZJcte4lcpscyHxPkJA8sMwRyvrFOKuPqtc2NjwlQ2YY9tFx4sKtOpW6nF3YS3ubg9R3r1ALqOAKY\/5U18nRRWLef9TQiY8FsY7G6xDGexOezRiClEKIbz5gVQJw1mk\/mcShj2MW0Ac8Q0kmGFKCYDV6OQ+geveBLyU8R+uCOvnOb5w+\/aGvsBXAaTSK+j+vi3gI\/HhBqiEFZi5p9\/f7p\/63KWDJj7Vsd2ZjEQvevv8UvW9uvUJhZhGLElPvqAriqFpbe+2mdQBgaaQ88tr1Fuyoa0Zlyyqh0PRvf\/yxvnK0ejXYMInzDkRlKob3hl0ePhIXSMzbF5Dl3m2bVuw55wrv237UgiMxWHEzLXJ1lRUsE1jIqwDYxVBCTuJvvRTB4202iSO4ttzvmtcJJdOlCIyXlaL9KqFDahV7QkiN7WINK+2N+e+MF1io4CBCZ99qYxBObgrwqN1nWX3m95zZSEOYMec+DllH8BIz3ITrdJeTFQPDq4g\/PLibA8xb09JTUNkBP9+U2uCDbLGlhoBhzk16Pij5N0+pNGo1aPHnFJ80gLAso2DjQoNRFL48qTAyFGpm8IxJY64EWb53MpBBQbeOT1fmrEmf1fBnhu4mvqfKzeuVLaGhNx4BlVxMZ+LegQl93Pg20Jfxlv49gWWgAbQfGZNM4rJNEFKqR558JjHh881qe\/l0j9fRye56kq1WM64J9tCLro4yNBiPhBj1+v0BJi8iU7LO6QlXCv7Ij1sPoibxCA6cU1JKDIW3h9Y8BuWhQe2fpDs+s2IrH1HGTu7dy9+BL6QUEpi3NT6Bvk3D\/TJN+gYMqXRvHeFoURMw9Ts93HcCIlWEiqbAial\/D\/xIqTsIeCek+QG\/5qCErLGThsJn935F9SpY1jGa8zSvM6FTdO2luwW9DMl41Wy3+ZsHBaekN9lTeMrL80eoGTeY+XCBiQfXUZFcQCy7Z8W44QiJsAvZCBU8\/wBFjVN9twIjHZZaS8zwalMD\/UNlmECLxDGj5M\/hKOspYOly6Sp5vumu0Snr8il2oI+s2vbxw8HlhThk9mwJoQuiy1qxxXui8kJh1oQvS3v1wlirdDTLVG12LB2POxFe0j4Pz3yBl8nkDNEY2g8UrpwkU0q7\/lEIpg9ypV4C2FKuxS9bRiUgypJamzPSI4Gp0\/DdFoAUDR8WleXzgmUB9tD8BDCsNQJU1Ad5xy6EWbn4B04HbwiUJpzYi39J2Bmm408sEuoF2"} 02442{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":3,"flow_src_last_pkt_time":1436720908216981,"flow_dst_last_pkt_time":1436720908432069,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1464,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1464,"pkt_l4_len":1430,"thread_ts_usec":1436720908432069,"pkt":"QPMIw47hABsv8H60CABFAAWqu1ZAAFUGJ6cfDV00wKgAZwG7hI+o7MT1gUCDQoAQAFzmhwAAAQEIClsYbL0AA+5iFwMBBgCkPdU4R6wGSIS3keHeixTLTI9zV+il0PpZ8q91YamIsd4IZ1iA9S2D6W\/nJ4T6403w2+fJe+hdEKNsk0963CdXOEXDNkQKpXOBBE+0Y\/4Fle8ueshRyGFFEoc6PtZpKpwayy+TKxEJ4pFJyX2oGMWjaZzaOyD59AskeV\/YOll+Xm0S27uMjZKkLBkCxDNPTNhB8fh\/syM9nxdE4huEu1SgtsgSRap7+5OfSJa0vJji4Lac5HIGGpVuCAdsaWkkirxUeGhBT5KqUaH3z34YK2q9OCFDjG6zQx+K5wB6\/1tRpCV4T0Wdq9iazWqTK9fhu3Q8m7M+n+OlMsKGxDIEQhTmUFv6EsILdWY4XaXzsNt68ilI12u8FIErHj5xADP5BSss+D\/PqbyyYfj1siM7kMLTpiPXuCUljd29w+P7wtJOUzlqcHwFv60jtkmE5R7DR9LN47rlhx2ZgEX8b9nsvGl\/Z1KSCJ1m3XV6f0806axX94l9imfNEVAHweCX3kOlfFNWODbpNzNbLbpVtPn7xKRA5Y140DajcNQvyREJ7DrHWIxbEPKUq+SIMaNEJqDkl0rYnPqvJYuixcmcTK6joyocw7sF+MmuWuJzAwYoGvQacoqaNqOp0iEPlyz8x6cTF7HbzVKHlLYHsfsKMGz98miVsnjvci5f7S+qZN8wJt+ycMpErrmm5SYVwnyDiARUnY01FjBiu7oXosmSU8r8tl1Y7oQcefwWQmUMJwEVoICnXk5o\/1P1fTAJawMxQor10OxDf\/BV8+4BnkZNbktKhC4u6rpy4t9mTFTFoJnekuOgtsyuYF1D1pTovQynkNog8sbNDLg6lOVy2sSjtN38M5BrjfWP6NvWf5rAbsDm9Qvw2VUkrLm+vXfuLJeKqhTOHspJB2ZVScw6fgqCCRgXV4hbT47jXkZHPFeUj3xtv5oznldP1XEp\/Y0YyZnWCMaWATZlGVUiSYeiFbrcd70L0WujcTQSesgJzHbOqeptYMiDDVIYXi5utFDZis9FPZA2ul\/lArmvEL\/urLFDKdnXMnNjyIIqJtwWZlcpDAHOfD2KyMM51NtnpD3NXBz6ngCZNoi3DrWeJbaK2NX4FFrr9nkmfuHb0MCV8zapTpFVeDqmiCnEMr1A22q06nZsJij0BS+jpAlud6+DjOPKWljFzy06Xn15YGW3Dm07Vi1rGNQXnlLIYZbH\/Lf9VbK8rn+tf2U4X+kmR\/seSiHTIiCrfQRY82NcG+s2JE\/3RNuUUsdP3+A8UZATxsKmMNb9p9jduLcV5NSz3qcz\/E+TORnhzC5qM5iDlSbThKZAPEgvS54QGz00rdEYWdvIwL1jLd2l2yP9aEoOWrH+sNsRBCU97PG1IRhRS5jctVYyDntPEBlAbqGj6sdT5C6POfN9JdpaIsZmGaMmnU0z4bjokazZ5F6F501SFGcsFKmgoCdZLCQyyA\/CkkbqEF1LeEPM1KkE88DAsVjRhjRCz9D6VKRt8PZdtywXXp7E7yF8+4SN\/2h5CqHv4N+v+ejLyvCd2t1L4BFuJ7BTwaB6NicxBq3cWSEeADsWxC4xODPl+fmk90gThIrGh3\/E3G\/K8LjJkXPwBqDPoSCAh\/lyvY4cI9USKSjdTboTHfChgT73IzMJk4MESnvGhexHkwWw4ndKaJ88XZfXiGJCI\/GHCwJX7Zu\/IG7bV7st4TnImk\/Ds\/xEG7y3JgmTAc9wIRPfDmTaMW0XI0vpt5j1BnCLq+es4TBuh9vggrd8U5G3S+2hj2u1HQPo3wjRAM4dNo6in8nnmD4n\/\/G9yrHWQwizkMQMUhZbY0jDslavyFSGnWc0JVIhfEzkCZm+lGdYxoDPUYKjjFRFeJ8o"} 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":326,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_src_last_pkt_time":1436720908432130,"flow_dst_last_pkt_time":1436720908432069,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720908432130,"pkt":"ABsv8H60QPMIw47hCABFAAA0l5FAAEAGZeLAqABnHw1dNISPAbuBQINCqOzKa4AQAUs9dwAAAQEICgAD7nhbGGy9"} @@ -90,6 +97,7 @@ 01831{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_src_last_pkt_time":1436720908466005,"flow_dst_last_pkt_time":1436720908466005,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1015,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1015,"pkt_l4_len":981,"thread_ts_usec":1436720908466005,"pkt":"ABsv8H60QPMIw47hCABFAAPpXL5AAEAGnQDAqABnHw1dNIPjAbuhtt+gEOOOT4AYCqMt2AAAAQEICgAD7nvwIEj8FwMBA7DXpbZuuL+a3+A25sPf3KC8vtrovZX7fcip20iH4gbDYKHRurDuUNBuKdxbaf8w5NnTQml9NHFuaiFV9xaPTEtRbbFB9QgL8vlHsxgX1jfO9ZT6YB1lbKI1n65g8AZltFoEnCsmCE1IOxVyjBVZQT7po2puEnrF+kDYe4098KgZgFIZStFzMtmo9XOmOfNP+iRYctfjIeGJz8jQ1lFBvHEsbbQIygOCYn9oDm7CXWwj2LvemnGFKWnWYwKY2HgH6zrHi9xUd7CDCihcewk3nTPbbyiC\/Oifk2F1KjvO+B1lmqoGqUOYx21p5F3Yy7giHbLKSW+ti05sAV0fAKz7Z8+aVWuucvLaUbW+dSKFEZubeujNKIbXr7vCkpaZCatjRYZUgGNtsk2NBSXDlVMA\/v3I+TpoH8L5Ft2TQGs+aL8gJ2KVF6O2+ZYxZ96KcyiQmukk5fWpPjyBq7B0lhl8\/l+87aNWAB+03OvN8FhYV+S\/gv75JF3N388CBkyP4ME8FRt4W55y8LCj1tqiL9fodHUaE6F0ridmX8h0+Dsd82vVVQdbomtwYWVDLtEOA4gG2jJjDPllVf5J8xmFGHsA6M\/TDTHEfu8LTRQc1d6jnJGUH9Eeq7GjZHoFXfcfkpY9BGbqJWKidAdwRrWxc1XI2wcOmTiqvy3W0kHXHGHBqtUOPHt80fdZz3Php0HqhVjapNrBUUzl1zXCtqo+\/D90yVXLpIbqbzqp1UOs3uY9nrVZKeWZAphdT0b38N153F9QCQaE1j\/B3yRInHVxnxDr8\/wXaBQutJGt+fT8YapiNjDh2B5Fe\/VzJjaUK9\/s\/F4+YAkFfcLJJgpkyZ1FyjpKFDmEKLJS\/hWon3VkTkSPBJyUnbR06ETQWOqnwWcQKPcsS14LaHbhuVhKdt2tBBxQtcd0OoPW2aLOEDh9uAs1wndQ8cDwLHeWOSYDiwyq7hmF978JHTDY5T9UPy1BfhkIGr1397oeYW8tQLiHwwHKS6l11zZwAq8rb2bsBNkrNvLFUBdxAJWO7YtLy1slqNoFAyDdp7eKwmaP317WVsHGvyiwNdASVNzu1pbccCR6AgqCnTrbOntDjyNK4u2jrQuFCeBAMKVe19ptimavwWdWcfiYh6zgKaavEskV4nXhC01pvDJfX\/uuk2wAy46ocrpdos3RqXm7EpLF72d506O+IxXSSlwIplmFgawKqTtoIASL2SkYHX0Y3wKxf+vCHqdiD1nEkmvwUYQ8dkrjuTHBA1bDvg=="} 01048{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":343,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720908466005,"flow_src_last_pkt_time":1436720908466005,"flow_dst_last_pkt_time":1436720908466005,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":949,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908466005,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33763,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_src_last_pkt_time":1436720908466005,"flow_dst_last_pkt_time":1436720908518251,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720908518251,"pkt":"QPMIw47hABsv8H60CABFAAA0kN9AAFUGV5QfDV00wKgAZwG7g+MQ445PobbjVYAQANn+UgAAAQEICvAgscMAA+57"} +00931{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":344,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720908466005,"flow_src_last_pkt_time":1436720908466005,"flow_dst_last_pkt_time":1436720908518251,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":949,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908518251,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33763,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00777{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":345,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720908521089,"flow_src_last_pkt_time":1436720908521089,"flow_dst_last_pkt_time":1436720908521089,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720908521089,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38817,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_src_last_pkt_time":1436720908521089,"flow_dst_last_pkt_time":1436720908521089,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720908521089,"pkt":"ABsv8H60QPMIw47hCABFAAA0\/y1AAEAGBcbAqABnLiFGoJehAFBl4Bu99+Pb34ARFTc19wAAAQEICgAD7oGa3vT1"} 01986{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":346,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_src_packets_processed":13,"flow_dst_packets_processed":19,"flow_first_seen":1436720901182283,"flow_src_last_pkt_time":1436720908522279,"flow_dst_last_pkt_time":1436720901200136,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":26795,"midstream":1,"thread_ts_usec":1436720908522279,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"77.67.29.17","src_port":33976,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":31,"avg":237350.0,"max":7321503,"stddev":1293384.0,"var":1672842313728.0,"ent":0.1,"data": [183,854,1526,2655,488,367,335,397,1495,519,1160,1800,61,31,2258,92,3204,427,3571,1038,549,367,1953,885,885,671,3632,61,4699,183,7321503]},"pktlen": {"min":52,"avg":889.3,"max":1470,"stddev":693.1,"var":480370.2,"ent":4.4,"data": [52,52,1470,1470,52,1470,1470,1470,1470,52,52,1470,1470,1470,1470,52,52,1470,1470,52,1470,1470,1470,52,1470,52,1470,1470,1323,52,52,52]},"bins": {"c_to_s": [13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,18,0,0,0]},"directions": [0,0,1,1,0,1,1,1,1,0,0,1,1,1,1,0,0,1,1,0,1,1,1,0,1,0,1,1,1,0,0,0],"entropies": [5.046594620,5.046594620,7.807667255,7.804625511,5.046594620,7.835396767,7.830054760,7.827408791,7.815585136,4.955154419,5.085056305,7.818941593,7.842073441,7.811964035,7.825482368,5.085056305,5.046594620,7.838124752,7.812465668,5.046594620,7.832524300,7.839126110,7.830482006,5.085056305,7.832290173,5.046594620,7.787267685,7.789937973,7.772590160,5.123517990,5.123517990,5.085056305]}} @@ -169,6 +177,7 @@ 00888{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":466,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_src_last_pkt_time":1436720942580781,"flow_dst_last_pkt_time":1436720942580781,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"thread_ts_usec":1436720942580781,"pkt":"ABsv8H60QPMIw47hCABFAAEzOUlAAEAG0nXAqABnUlUaouLFAFD1YMTERbSUBYAYD2PW+wAAAQEICgAD+89WC83JR0VUIC9ocGhvdG9zLWFrLXhmYTEvdDUxLjI4ODUtMTUvZTM1LzExMzc5Mjg0XzE2NTE0MTY3OTg0MDgyMTRfMTUyNTY0MTQ2Nl9uLmpwZyBIVFRQLzEuMQ0KSG9zdDogcGhvdG9zLWcuYWsuaW5zdGFncmFtLmNvbQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KVXNlci1BZ2VudDogSW5zdGFncmFtIDcuMS4xIEFuZHJvaWQgKDE5LzQuNC4yOyA0ODBkcGk7IDEwODB4MTkyMDsgc2Ftc3VuZzsgR1QtSTk1MDU7IGpmbHRlOyBxY29tOyBpdF9JVCkNCg0K"} 01366{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":466,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720942580781,"flow_src_last_pkt_time":1436720942580781,"flow_dst_last_pkt_time":1436720942580781,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":255,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":255,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":255,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720942580781,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":58053,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-g.ak.instagram.com","http": {"url":"photos-g.ak.instagram.com\/hphotos-ak-xfa1\/t51.2885-15\/e35\/11379284_1651416798408214_1525641466_n.jpg","code":0,"content_type":"","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 02465{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":467,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_src_last_pkt_time":1436720942530885,"flow_dst_last_pkt_time":1436720942592195,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720942592195,"pkt":"QPMIw47hABsv8H60CABFAAW+MAFAADkG3jJSVRqiwKgAZwBQ4sRSEEyML7VmbIAQAggFiAAAAQEIClYL0tgAA\/vKSFRUUC8xLjEgMjAwIE9LDQpMYXN0LU1vZGlmaWVkOiBUaHUsIDA5IEp1bCAyMDE1IDIxOjI4OjQ3IEdNVA0KQ29udGVudC1UeXBlOiBpbWFnZS9qcGVnDQpDb250ZW50LUxlbmd0aDogMTE3NzgwDQpEYXRlOiBTdW4sIDEyIEp1bCAyMDE1IDE3OjA5OjAyIEdNVA0KQ29ubmVjdGlvbjoga2VlcC1hbGl2ZQ0KQ2FjaGUtQ29udHJvbDogbWF4LWFnZT0xMjA5NjAwDQoNCv\/Y\/+AAEEpGSUYAAQEAAAEAAQAA\/+0AfFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAABfHAIoAFpGQk1EMjMwMDA5NjkwMTAwMDA4NzQ5MDAwMDFlNjAwMDAwZmE3MzAwMDA2M2U0MDAwMGEyMzYwMTAwZTk2MDAxMDAxMmNjMDEwMDdkMTQwMjAwZGE1ZjAyMDAA\/9sAQwAHBwcHBwcMBwcMEQwMDBEXERERERceFxcXFxceJB4eHh4eHiQkJCQkJCQkKysrKysrMjIyMjI4ODg4ODg4ODg4\/9sAQwEJCQkODQ4ZDQ0ZOyghKDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7\/8IAEQgEOAQ4AwEiAAIRAQMRAf\/EABwAAAEFAQEBAAAAAAAAAAAAAAQAAQIDBQYHCP\/EABoBAAMBAQEBAAAAAAAAAAAAAAABAgMEBQb\/2gAMAwEAAhADEAAAAO9N4sXTDu15V0zXWqS6eeKmgreaCCmgg7uEVJBFpoIqbJxUnCLu4QeTiZpSHB3cGdOqZ3QRk7jdJJupIE7IbunTdJ01OMhpJ0O7ON3aSOfwekxeD0uW5b1DncnTsA9NJjtugMD53fqZhIgWgSaAtbEsWQtyzLPTnJhkzlli0uis5Bw7O7irEdfDm7Q3o5VwFjvEUYqlhUYWiOMp6HN4L9xoRfHbOtZDzdIqnt5UkurlUXoRcsXKR16897uavZ1aZJAySBM7AzpAoyQRQgyWmsrLZ1OZUcAMdHNE+Pr4jXWjcf5Yn6n5BjRjQdkY2Ci0j2KtwOa\/UpM3ThJRs3xi0n0mLpwZpOEVJkou7MSd02Z3ZFpOEHkgZ06GTuOLuhNJONJONnSQ6khpJwSdxp0k3SkN0kh3Zxu7STU1Wnghs\/P2jYmxyVZaPV5dg9EEcFEMbREli20VTekwDSyB3KDNbYk3lNtwDNIYAe3by0E+sjys0+hryZgbUO7JtFhyPAtU9x0fnXT5Pe0s8iDQmLcK2RFHXhU6XTyJnQ28l6vzLNitasqL77zvTx19X0ci6zQXnPPdfP7MvnHFT+lsL59dHsm\/89emZV6Rwnnza5jdZxo6r1zovBcxn0zk+Fuz0rN88YOj54WAHVCQZESpRo6asDUEg+pcTzW\/zOv0wrwT2tqjD9I4GWD0GFZpn3V3jttz7jDCvpQgFzWGnoul5+tsu35+PE65+hGeTZlT7uR8ydJvn72\/jvpsaaqz69ctVZ2lpLKT0oqTAk8hxUkhJOCdONJONpJwUoyTdncE6dNSUk25Pb4401KwD+XrjwXoWViQow+4a5bP6vJ0nnR9YKwCs6sKb6awPu58RHXNxxs1uwH0ZoswO2Gbbm0i2IA2jMsDvRdUaULFs2KwzolWtLXv2s7q0nGSLJCq2zNhzG32cRjcZ5mHvkvmnpYZ\/G44avfLzN1IbE7nlky\/T\/MstLZrG1W\/PSfZOu5d\/ArvpDw\/t5uJCKz6NPKChFXSGiq1p59mmZDDhAbKIjC40UhbGFKqLSdOLO4MkkfQh1cJjj+O9GqqPQOf5vU87txCsYGo7vZ879onVefdz8yDmjOv7+Tz\/pFy8v0="} +01273{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":467,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720942530885,"flow_src_last_pkt_time":1436720942530885,"flow_dst_last_pkt_time":1436720942592195,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":260,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":1418,"midstream":1,"thread_ts_usec":1436720942592195,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":58052,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"photos-g.ak.instagram.com","http": {"url":"photos-g.ak.instagram.com\/hphotos-ak-xaf1\/t51.2885-15\/e35\/11417349_1610424452559638_1559096152_n.jpg?se=7","code":200,"content_type":"image\/jpeg","user_agent":"Instagram 7.1.1 Android (19\/4.4.2; 480dpi; 1080x1920; samsung; GT-I9505; jflte; qcom; it_IT)"}}} 02473{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":468,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_src_last_pkt_time":1436720942530885,"flow_dst_last_pkt_time":1436720942592409,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720942592409,"pkt":"QPMIw47hABsv8H60CABFAAW+MAJAADkG3jFSVRqiwKgAZwBQ4sRSEFIWL7VmbIAQAghpXgAAAQEIClYL0tgAA\/vKkxiut5qB26Ow9Pj8+yfWMCa4DUGy+Ho3+c5jmKfpvReNdKH0EH5lbcbz+eZjXvWt849W37RLwLcqfYn89ApepLzJrn01eX8qj3x\/Byg9vl4hMftksS8eq4V9yQ9dg87nd3j8t6NPn9HZ78M8\/m15\/SI4iV0+Hr5YZdJFWiriRaANGqKgC2yBU5D1y9AGO5LwC+hZAOnTCa0b8GSfSXc3ZK6AUI8M2\/RlL0N3AaXqkYlae70WFvXE\/MysjfHhicTX059\/nyudDYrqom8O\/SwbXeAYWCl2HDbeHOmh0nFvU+hbHnPQ5vucrmudw17ngsyPVk8VHSYNOA4HAkiaZ9LkB4VlFV6oQoQoqHF7YpwjYwQuo3UsJOh\/RGPbfOPDFikaxDY4DU5OkkXmo2bPofj3YqtI3A2tMe8H5Nt8O55y1B5\/7N5\/Hj7N63x3O1z+g38A6wXb+eEc9NDyaVW6IJldX6R5B6ZmuRoJAaDtPubZt\/FrO\/ofNxI07nn+e9Kt8ed1WPUA43vniOOoe+MdtjoYlp8vJuziWF9ZSfTEwvQuT1MrucEnl3NmPfozec2Q8b4rocvm7XZ0ZulcvKtUOGRAQ4+gnWZDVgPNWhEKtHOpze6ZyDRXdX8BKT0GfAkRXbz40uX19WJqIDO0OmFTszkplJub3z+cPQ\/JvQ6z862sGNz1mVnCXPSY4Ty9OzHqpGSzpKihVIIPNmVKcRNOqLCYDILVVeEY398LgV1vOVI9RE0wT4QEQJpSDAaZU3nNoOD251yCtoLfS5daqb9QCMzcp43dzem6ufhS6Oew6aI6IVlfacgTJtbFeleWXZh0ue8o8\/FVehcsDozfPVyqd2beAaLdw7AEWuPBsy\/NtRo7nK6amwzE7wely5\/Li6bHG7EM3mel42aI9A86edPRMPG0Ly9C4IXGVdSXyWneZ42VsFYuj6kTogdbNyRn62pnUvPuruzMr3A+oweXcoviYt9jgW6815zm+k8\/tAB\/OBUuybA1gvm903GUlLnZS6ZF4KFr24FYdVfxNcHoN\/nFir0ejjdiS\/RN6WHm6VtwnvhPbN\/CPbfkffMXtuX3qjh3relJQiEoMQKEpOyKasJqDId1NjV21hXC6QDvdJEJVO1s\/Q\/zN6OTm8v3oOGonI9l57alQUrkXYpZMcsGthFgcg05VXIYrOJRhIhUfQ\/A63I8zG3eKzunHr8oC2NDAbQaOkGxtKX2WhycdMdrn93jLkKuKz3vZ9JmVLTQZa3BEZ0bqBxVlISUosM18C1LstzjfR8zjgcXvgyeor56XydIvT6GCMTACyMtUrgCKhlE19BSC9tDF2gkO5dOOJom5fPt2VnLbnJsVlaDDEPHHuS8fSny7ebZ3qPK2w9TgzU+rEx8ulpAaNFzDbyos643zk7Ou5p5O+X0FYusqEnp3Q6dbPtiuk0uU14ejc98q24cupIjGzSHlDhtF575ZOO+XSVH4SnEqKawNGGtZiJmIRtjEC5UnTQtnUn51xEfWfPtM8B7b2wbSKwHWlcGMSfEWVosImWLXNObHxqcs3YBBYOiCN6LkB4epBLK0KLAqqCHVFoZN\/S\/La3Ded0EcjPZ3z3AN\/GxrIy9iG8YgvWH1PnkuwzLWQPtqlhubqs540iAhZVVsNHpgy+LaCMldVgpipyGjRNCQdSLo8zK5\/dN6RMPzzXjRmF7eCA9vW05aci1898xYkdUwXtNbK2ik7MtyrTKySLWrnk2azz+9hky9fQzRuXXXQYOOm8sLU6Mz+T6DMig+c38yaBw+rLTxauj59VjG6rUoWWXRciQb8rJMP0s6wZdhrOeI1OpspY+oXQgyBjtBm3CyFWZNgavivsvzz15cAGTDTH0Hz\/1jzPKsrUpltBIzz0jO0ZWIpZqARY="} 02449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":469,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_src_last_pkt_time":1436720942530885,"flow_dst_last_pkt_time":1436720942592836,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1475,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1475,"pkt_l4_len":1441,"thread_ts_usec":1436720942592836,"pkt":"QPMIw47hABsv8H60CABFAAW1MANAADkG3jlSVRqiwKgAZwBQ4sRSEFegL7VmbIAYAghY7AAAAQEIClYL0tgAA\/vKFZnZQVzAORUAGgshD0XzLWitnF1RZbOyYY2jBkEBNPfpsFJ0MwR2xokUKk0tMRGX0+ULNnYEnYNfWxk6D3Pnej5bi2uly2Ncen4nCl0ap\/OK5M1MDRb7DlaKILxJk6KO5nCIOoyoBpkY9jRFD10QJEggtrzgw9vHZPqSOeaQmWfu3NWXpDBl9HidlS5IM+lPtuAnHOypCaOkFexZHT7LBydbA68EOyVOaEXDt3MTek5gTqq2669g7n1zDNvNkDCrEmtKseNSTYBSGndz5U12mrwxkX2QmVrRYgHVlxXHHdQ8nCZnqOBpPPaGYE10z8zTjp1dODtoPolFm2VzLWuvhh7CQ+d0DQ\/mTmvrb5j68el4rvfO3ErssfSdGGU7RtVUETBMSsTXDoR0ccOsnWCEkM2mmLLqL7UZ5pQoVi3jJsVTQ0bCMg1achKtXHu0hBtqXF4R52reGKB0XOy4DzjTrg+tLyF0yF6zwPpHnHB0jgGw3igbdGFni7wjMtamXc4sDatJIzzaARw9qDaCA0FQqqA2qulhUQzAuvyZBp10EAKnsZHYxTyR4VGKh+05HoUs\/F7\/AJweK6na2O04b2yas0ZRp8nzvTcx189Mds+Xj7lOXnfSi8tZhprEW9BnVOjl4g93BzWlmQqlLnCmnSCpUQanqYOyM2weaDCc+xm5o8o4\/QSPPSZr0WfBmo2sY\/QZyGb6CEHksu85zDWzoOMtzfeQxD2ip12I19Dl9Gl0Hn\/ew6M\/BfLvWvHLxtnll6qQ7xEVUhkyJZxKZBtGkFONtYYU2QTK5XdKGceTmEkYIsW7m6cm8eP6DA28t5gl5I7Ga9Nn3s24yzz+euNieVoyh8262aPG08u1SXU0u1DJHsPmPq3jfD02ECLpy22zCJZD5NFLpeZU2ZyIWk0TlMDb2kigbQcM0ksYIQNgAKIqCqsi4AC3mFcChWA6IhLWZWTCbW3C5LNbZTWWxOyHa97SPz7mjgB5aWjZuLtloZedbrNj9J0QYvRgY0HTYeTanbA3Ti8UvWeHm5W\/zlJ7IS2iyu+DkHTHMbnJmknKhOjUDGTUuwxk+uK8+6CX0xFfQqs\/Q0SUBE2QapzteY+UC7i2Tzt\/QRU+OK3xpevZCWkeN+E\/T\/zTtlnHU3b51RJrRCUGDQ63jNGTr+TzaJefIqeipi1g33c1pCQ76nIUynphX2jhVrAdEnzjdTgOZyoDiihs+xqzSzdoEQCkTG0fWNJ8ch7R5FcZhAsMrIQaH9CcPo5HmdA2cQfs+O2NXQqPOhu1jrHGW79doY63YiuQn0uYjLnB7VUs9mj4iWNXQOACU67BuYHIR+fRaB2OUzBDhbACpMmOjWGrDQqGdIv0jy\/1ea1OaD7HHfIM19WDk59BmUpW449ToANFlKssBtUIiHoUAMmTTMhggmgK1CVMdEQOhbV5uQG46KjkQh9gFz2mm8J9gzk+862TSKfQaIPFIx1unVOKmmkSzumKq9UDq2jKh0RTld0qCKkL48+zPly45Cq8nrwBLrzw0LMk8JWC1oOppiCMHsYBow9AGuQ9P83oy+sw+jM+MPr1Mu3kNb0cieXz3teW7WWMfsEROF5R6D5VsFtZfoZlukaLJNthsm9C8pIw063hdPOrMUmy5MpGInR0ejby+\/j7Okz9IysvoimuGs0sreCx82upM9m8J6bPT6Gx\/FHzrtcciK6OGF9C4Xp4RVZXat0cvURi0lypVV6FgYVpxaMAwi9mK2vaGC594zaKZpUWX3MD9B8\/9Biur1wgMN7hTS4fPVdVU1zUtMW0JDTvc5Fu1MeVPVqpUoYNhwecwW0XRAN7a26FZm2oZPS6pPJ7JGci9+k7hvI2JttnFp11LzrKh6R+efjsTZXZnTs="} 00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":470,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":5,"flow_src_last_pkt_time":1436720942593049,"flow_dst_last_pkt_time":1436720942592836,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720942593049,"pkt":"ABsv8H60QPMIw47hCABFAAA0n8lAAEAGbPTAqABnUlUaouLEAFAvtWZsUhBSFoAQFLEuLQAAAQEICgAD+9BWC9LY"} @@ -180,7 +189,7 @@ 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":544,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":4,"flow_src_last_pkt_time":1436720950911439,"flow_dst_last_pkt_time":1436720950911928,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720950911928,"pkt":"ABsv8H60QPMIw47hCABFAAA0TexAAEAGtofAqABnHw1WNONoAFAuGbTPoOMCBoAQH+o2dwAAAQEICgAD\/xATwkKV"} 02449{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":5,"flow_src_last_pkt_time":1436720950911958,"flow_dst_last_pkt_time":1436720950911928,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1464,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1464,"pkt_l4_len":1430,"thread_ts_usec":1436720950911958,"pkt":"QPMIw47hABsv8H60CABFAAWqgMtAAFYGaDIfDVY0wKgAZwBQ42ig4wIGLhm0z4AQADvH9QAAAQEIChPCQpcAA\/8JSTWCXbdhi\/bklqlYPr1iM9Izvrr4yglR4vWX5\/yXmEBCaMvi4PLJnUwwhyIOK8ELrcAhe3GzSmz60YRabuu0pQUaOMvpdVl\/ZtkGT5hxquOG01U4z6H2uOg5ff8FOzIQczpDFvB2iSv3Kbv9elmiql6q2L25fMIrLhriu4N5gJz7jCOAe40PLGZBAg799AuVEVjSV3h4rZWtiqTfJKPV7iJGE6mxB\/wjyRdy0vXpy+6rTpX+\/M2iaXpKktSYj8XDvJ0d9PcZfPBMV29jnMRvKhvYFfsdC7QznG\/yrOX6l58PIMc1kibS8KUGDlwELD4vPvlkDEHf9f0PN5pNl8vrE2JCIiJT7Powe3yH6WBy\/kZYmOivsrgCvX9\/mwNjQ80id7UvnL+E4Sv4M1ezrWBAIMUME8\/JLoEN2hoycl9l9d8Jwp3FD02+oTvd3setD9d+wUdV1Vsv\/zgk0rXc3ogRl96eLblMRX6hTd3vftMx5dVU9I5rxlvXWnU4m7qqupyTMOLVy8iUMMnBLN44YHfAhHQRRyz95WyO85b5AnxSbknm\/FCTVtNc2eFDg+J+3o1juK87G\/GuvivCEVlVVUzV2xJxkCAd29jGSDvZ37CA6+3XTfqgP04XSRR4Ysv1eh9yRjyKhM8ScgZn7EnGSVbWZwIhylJ7Qjj+1wmtYDJU\/AxHp4FSz5BI3ZtnQS23MtrlT\/2BXAfZ8+7i4KY5pRgw71tWiw2m08UsLlWGNM1QVQZ1iKbQWKuvcuzitaxqil+xIuTcf23xIkdPJBcLVbUKo15gyXiX8SN8EUesbkiZ04kWL1RINlDRw5fEi2XxUlnGByo9h028W61nOMtzoSHGMzy\/w2VPLxXKYXuIpttGgQgoLT91rl+e6spFrl\/XC0JF5srWseQd5uLnYSOqSu6\/hONyaeCU8fiBDxXA7+3n31cTLxnwhs5m0fLG7qStNddG4dOGbRg\/GXMxkxMcXvpCmKzll0MFYuDlsgPlrDQVmdIkYUflxcyglMkvx1WIEBEjTaiHeM1uWuzw8WXJKE\/LpCwA4lnHTQeEYcgSfp1DDv3YwdXGDYHXYj8Th0pkq2HM1lOtfi8csVgxlqkn7d8I7oIlOYh7amlccfuewrixVCmKdZEnicaDTVth6hYv\/KRie4zU6Fr30Z5MmdZEIiKSCWlVqOJ93R8J433rWsIN6qL8IazCXYFLTL\/jGKkxOFZfECtiEiEx45Q9lW5s\/61HFkcUEz+YJq0lFPRm3a5fzDEQkZbahhxUhUem9c8aye0fCFYklrjEOrX24n1rFDCe0O0rxmm+x49TTVVnXxefMkUT6xAgR0hkAAnAwW2\/bqKcROvJ3HEliJsdD6a7aHBTETB25bLZ\/4V5tDmj9x3xN8kyW2ukbzMS\/U9xL1ZfCUXrrb8RTo4vTk9PkjmU6+SLrC2lOUSPzeT\/XNbe42IfmyFFMpX\/Vxf6dImT\/YLKhXdk2kXq2yC1t4ovB6ZhTmyvjZ6J8TxWRXvCHRyT4\/PsTLuDg5k\/APOyPPFGUQvBRR8JyK8EV73vWX\/uwji4kOR1qo9z7CNYmxbbtne6jPSfiL6kmhRRUdJYjy89e1dhDWtpuovLm4K6kzVT3BmdMLmwgAOjBzhqb5Z5Z7ki8X5YnY5PV+9ZOxAI9uvUfIwq+glq3jyZg6atAY6u9F1b60mq+EqV6p\/u9r0Ivd9V31J6KXCdRffa8J5v5sE8v\/NehNONMG5bmENYYCnFb05vVs3+vdVentCMtKjpnVV6CcqJPzYtrQS3Wa1lfEal8TKvI9uydwjNii8XUUw3zEZsH2w6XEVF9VcdZW7gqqTHNiO4dx5jueGkVFZCeQENa2teJymTJ2WsB3h2"} 01973{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":572,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_src_packets_processed":21,"flow_dst_packets_processed":11,"flow_first_seen":1436720950909974,"flow_src_last_pkt_time":1436720950923433,"flow_dst_last_pkt_time":1436720950922975,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1398,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1398,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":29358,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720950923433,"l3_proto":"ip4","src_ip":"31.13.86.52","dst_ip":"192.168.0.103","src_port":80,"dst_port":58216,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":30,"avg":853.5,"max":2198,"stddev":594.0,"var":352792.4,"ent":4.6,"data": [367,1465,1587,519,458,824,1465,61,30,1648,2198,2075,366,213,641,367,1312,1678,488,214,610,641,1037,1679,336,488,915,794,335,977,672]},"pktlen": {"min":52,"avg":969.4,"max":1450,"stddev":664.0,"var":440886.1,"ent":4.5,"data": [1450,52,1450,52,1450,1450,52,1450,1450,1450,52,1450,52,1450,1450,52,1450,1450,52,1450,1450,52,1450,1450,52,1450,1450,52,1450,1450,52,1450]},"bins": {"c_to_s": [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,21,0,0,0,0],"s_to_c": [11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},"directions": [0,1,0,1,0,0,1,0,0,0,1,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0],"entropies": [7.845948219,5.046595097,7.540397644,4.969671726,7.871668816,7.850661755,5.008133411,7.849848747,7.439690590,7.543411732,5.008133411,7.855735302,5.008133411,7.820466042,7.850073814,4.969671726,7.838098049,7.834076881,5.046594620,7.213315964,7.751162052,5.046594620,7.844347477,7.850857258,5.008132935,7.825020313,7.824017048,5.046594620,7.437387466,7.851827145,5.046594620,7.850535870]}} -01066{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":581,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":5,"flow_dst_packets_processed":0,"flow_first_seen":1436720908464754,"flow_src_last_pkt_time":1436720911139558,"flow_dst_last_pkt_time":1436720908464754,"flow_idle_time":140000000,"flow_src_min_l4_payload_len":68,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":68,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":340,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1436720950927431,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"192.168.0.103","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"ICMP","proto_id":"81","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":14,"category":"Network"}} +00941{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":581,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":5,"flow_dst_packets_processed":0,"flow_first_seen":1436720908464754,"flow_src_last_pkt_time":1436720911139558,"flow_dst_last_pkt_time":1436720908464754,"flow_idle_time":140000000,"flow_src_min_l4_payload_len":68,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":68,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":340,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1436720950927431,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"192.168.0.103","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","proto_id":"81","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":14,"category":"Network"}} 00785{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":581,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720952553865,"flow_src_last_pkt_time":1436720952553865,"flow_dst_last_pkt_time":1436720952553865,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1418,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1418,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":1418,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1436720952553865,"l3_proto":"ip4","src_ip":"2.22.236.51","dst_ip":"192.168.0.103","src_port":80,"dst_port":44151,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 02458{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":581,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_src_last_pkt_time":1436720952553865,"flow_dst_last_pkt_time":1436720952553865,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"thread_ts_usec":1436720952553865,"pkt":"QPMIw47hABsv8H60CABFAAW+RXVAADMGTWwCFuwzwKgAZwBQrHcqB5rC6nVWeIAQAeYA6gAAAQEICmBlKDgAA\/+vNN9ULewTHBOFuxeelHDOvSnlSV1MyHTuCPSU99J+Rb8TuXzL6L8kVMT9JeX\/AEeHJMKvc8yfZQDY5nhAsWaIx3cLbY2ubZRDNurbaUASgAZ45AKigq45hruCoLni5pLmg59eiPd\/MiN87txVNMyFgkWsWfkcvPvLq3ncGqOJteWDTNpm8JnDNe\/V0S2KHy+GaSkVk8YYmWOQdL4xuwexnBqduXqVc8IuuI9MY+Zt8cnTPcsfLLIlpNfPzE+aRdsInsLztgb98N0mNzOHWHNTZrWKQPr9F5EE8pK7KRl773oe+7TTr1byuTp17xSTo5toqt17OaKtyATyBsMufY15yTPDfHSZYsAADIDSioIAAAHiqKF1TXzn1tX21U6idxttVoiynCqd8u3uesClb\/XTWQXOtPYUXP50lMJRzX9QM7C64zEeROD4ZaaRjli0mWIjfY1adjPenj65KGzqNXJTVghI+6I9UuSYsusH3FlxFno1c9JW3qbWRHfo32lBRAAGeChkqKC5IoYXnRl6Z3L5dCnLn26mSNOSOlqcea5o+UReR652+3d2\/Dab0zb9PXGqPSSLVDbNYRN6MtmpYbJEJLFdJ2RaURdiZY5h0OrU5h7IeY888nVsXnwm4oxv7JWfA68vLc8ehxYrmuOvDGouaBzaCTVP8+zXrnlnrxCWO9ezKKfpVjom7FpO6KTzNl60JdWhqz19c1yubV3UpRimqVV2W9Iuz4HPYBS04ZbGvOuvLXvjiZYsyxAFADSAAAIAHiqKCLcMvDzel9taKZLs5gp0t2Sh58L9ypUAXrhU0aeiss785JfFQgziXCyntnoKqRxzXlrlhljpCKihlu1P7THj6681RUYywmYQzKyhFbllawrlLFUK21TYahBMm4bB0c\/Q0qorQAApkAqZAqooYd7fNpcf2zJkmmfqN4IOKohvY2dlqWGThFbWF\/iVS78WnnJ2uDHuZI98fVGcac2Zm9mcm1UZY5ht7uDaF69Ec7stO3DjzT4G5waWu1vkbTUs3N04NR5d+uk9NE0xVVXqfWMDHPBz3TyJ2pj1SeiHvpcNbNaNfVk2d++zGVKltAVHjbncFMYehMEedktrQOr+f0lWrmtUm+5kDyFpIAAACABpAAAEADxUAvSVxiQ0ufh6dafDwdvPJvem8y03645umpEvJ0dXO8bOVZrlo6+6HRHb0ou72TKnrj5KPN7\/AOgKGio1hlhcLnqyF3+tvLXsSbkfin2t4tioTO4NYFQ\/cjnql8XXv1hza9+0Ud7jZRwM7yzJxDp5um5UBpRFBRFDJUAyXHIMLhp62c7n0OsJjy0iGfHrFKd3PzhU8hjD\/pFzODc\/Y6udSW9S1xmy97TUsc6rydtdS82Etsi8jjdrKKSuKgmeOTOnu4nJHsh6YHzk6+ZUwTisdkMdqJMzvOrXOshOkK636OrSLZYJJHZcArm2apudeK4tWc27cstemRx+TikdR37SEPju+kLssw2Gc1wOvJ2hIdaYk1zq07Iu2KUuuldIaeHl165wzJM2tQDAAEFA0ACABgAIKiLtm1f2FaZdGxIrg19HJLzj8n4Ypnc+B3T5H9i6KUpcY+86xxUVeVESMl8UPe1Kc82\/VTk3j\/1J5ak58ckqUUUN\/rfyR6eHcXir2n4sx0h9l1nO6iWmGyLxxNiNJu0g3Ybk0hqbHRqCIdPN0XOQitAAKqALljkCrjkGF2Uncud2zD5hCufWAuzR3tSLQmaqnX6OSXbK53hgkuOsgpG7qQpZRqSR+oidlVpZdTrxXdIxxKXxG1ojMpizEzxzZ0OrW7I9gvrG+cnXo1beEccjsojNZyrk6C5qrW4NVKD9vH1VFwxWVxccbqS2Yg5iCSbQN4k01rSK6ZNFZW1N6VuWn84="} 00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":582,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_src_last_pkt_time":1436720952553865,"flow_dst_last_pkt_time":1436720952553987,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1436720952553987,"pkt":"ABsv8H60QPMIw47hCABFAAA0quZAAEAG4ITAqABnAhbsM6x3AFDqdVZ4KgegTIAQAtavfwAAAQEICgAD\/7RgZSg4"} @@ -201,7 +210,7 @@ 00979{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":0,"flow_first_seen":1436720906017091,"flow_src_last_pkt_time":1436720906024293,"flow_dst_last_pkt_time":1436720906017091,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":103,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":103,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":412,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1436720952611635,"l3_proto":"ip4","src_ip":"192.168.0.106","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Dropbox","proto_id":"121","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":13,"category":"Cloud"}} 00978{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720906022462,"flow_src_last_pkt_time":1436720906022462,"flow_dst_last_pkt_time":1436720906022462,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":103,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":103,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":103,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1436720952611635,"l3_proto":"ip4","src_ip":"192.168.0.106","dst_ip":"192.168.0.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Dropbox","proto_id":"121","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":13,"category":"Cloud"}} 00780{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720906025422,"flow_src_last_pkt_time":1436720906025422,"flow_dst_last_pkt_time":1436720906025422,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":24,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":24,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":24,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1436720952611635,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.0.255","src_port":520,"dst_port":520,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5} -00645{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":635,"packets-processed":633,"total-skipped-flows":0,"total-l4-payload-len":408166,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":24,"total-detection-updates":13,"total-updates":4,"current-active-flows":32,"total-active-flows":32,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":204,"global_ts_usec":1568796253770116} +00645{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":635,"packets-processed":633,"total-skipped-flows":0,"total-l4-payload-len":408166,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":24,"total-detection-updates":22,"total-updates":4,"current-active-flows":32,"total-active-flows":32,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":213,"global_ts_usec":1568796253770116} 00776{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1568796253770116,"flow_src_last_pkt_time":1568796253770116,"flow_dst_last_pkt_time":1568796253770116,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796253770116,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49355,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00563{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":635,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_src_last_pkt_time":1568796253770116,"flow_dst_last_pkt_time":1568796253770116,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"thread_ts_usec":1568796253770116,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGAr7AqAIRHw1WNMDLAbuZigajAAAAALAC\/\/8cPAAAAgQFtAEDAwYBAQgKDXByoQAAAAAEAgAA"} 00557{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":636,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_src_last_pkt_time":1568796253770116,"flow_dst_last_pkt_time":1568796253782515,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1568796253782515,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAFQGLsIfDVY0wKgCEQG7wMv1rwrBmYoGpKASbHB3qgAAAgQFeAQCCAo6Lg6wDXByoQEDAwg="} @@ -234,40 +243,40 @@ 01254{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":668,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":4,"flow_first_seen":1568796254514906,"flow_src_last_pkt_time":1568796254529128,"flow_dst_last_pkt_time":1568796254539971,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":597,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":1016,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796254539971,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49357,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"scontent-mxp1-1.cdninstagram.com","tls": {"version":"TLSv1.3 (Fizz)","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}}} 01253{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":672,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":4,"flow_first_seen":1568796254515573,"flow_src_last_pkt_time":1568796254531371,"flow_dst_last_pkt_time":1568796254543357,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":529,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":948,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796254543357,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49358,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"scontent-mxp1-1.cdninstagram.com","tls": {"version":"TLSv1.3 (Fizz)","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}}} 01253{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":678,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":4,"flow_first_seen":1568796254524506,"flow_src_last_pkt_time":1568796254539348,"flow_dst_last_pkt_time":1568796254551766,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":513,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":932,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796254551766,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49359,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"scontent-mxp1-1.cdninstagram.com","tls": {"version":"TLSv1.3 (Fizz)","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}}} -00783{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720901262544,"flow_src_last_pkt_time":1436720901262544,"flow_dst_last_pkt_time":1436720901262544,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":258,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":258,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":258,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.153","src_port":37350,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00789{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":6,"flow_first_seen":1436720908576723,"flow_src_last_pkt_time":1436720908733491,"flow_dst_last_pkt_time":1436720908662568,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":226,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":360,"flow_dst_tot_l4_payload_len":4267,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.154","src_port":41181,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00789{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":6,"flow_first_seen":1436720908577363,"flow_src_last_pkt_time":1436720908737520,"flow_dst_last_pkt_time":1436720908665956,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":226,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":360,"flow_dst_tot_l4_payload_len":4267,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.154","src_port":41182,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +01102{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720901262544,"flow_src_last_pkt_time":1436720901262544,"flow_dst_last_pkt_time":1436720901262544,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":258,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":258,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":258,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.153","src_port":37350,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01114{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":6,"flow_first_seen":1436720908576723,"flow_src_last_pkt_time":1436720908733491,"flow_dst_last_pkt_time":1436720908662568,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":226,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":360,"flow_dst_tot_l4_payload_len":4267,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.154","src_port":41181,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01114{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":6,"flow_first_seen":1436720908577363,"flow_src_last_pkt_time":1436720908737520,"flow_dst_last_pkt_time":1436720908665956,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":226,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":360,"flow_dst_tot_l4_payload_len":4267,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.154","src_port":41182,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00988{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":4,"flow_state":"finished","flow_src_packets_processed":24,"flow_dst_packets_processed":34,"flow_first_seen":1436720900687959,"flow_src_last_pkt_time":1436720901200319,"flow_dst_last_pkt_time":1436720901200197,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":253,"flow_dst_tot_l4_payload_len":46139,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":57936,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00972{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720908533449,"flow_src_last_pkt_time":1436720908533449,"flow_dst_last_pkt_time":1436720908579988,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":47,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":47,"flow_dst_max_l4_payload_len":167,"flow_src_tot_l4_payload_len":47,"flow_dst_tot_l4_payload_len":167,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"8.8.8.8","src_port":26540,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Instagram","proto_id":"5.211","proto_by_ip":"Google","proto_by_ip_id":126,"encrypted":0,"breed":"Fun","category_id":14,"category":"Network"}} -00787{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":3,"flow_first_seen":1436720900692262,"flow_src_last_pkt_time":1436720900876405,"flow_dst_last_pkt_time":1436720900874727,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":259,"flow_dst_tot_l4_payload_len":3258,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57965,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +00981{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":3,"flow_first_seen":1436720900692262,"flow_src_last_pkt_time":1436720900876405,"flow_dst_last_pkt_time":1436720900874727,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":259,"flow_dst_tot_l4_payload_len":3258,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57965,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00954{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":1,"flow_first_seen":1436720908531495,"flow_src_last_pkt_time":1436720908567842,"flow_dst_last_pkt_time":1436720908567720,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57966,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00777{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":1,"flow_first_seen":1436720908531495,"flow_src_last_pkt_time":1436720908567842,"flow_dst_last_pkt_time":1436720908567720,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.185","src_port":57966,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -01080{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_src_packets_processed":2,"flow_dst_packets_processed":0,"flow_first_seen":1436720952561555,"flow_src_last_pkt_time":1436720952561891,"flow_dst_last_pkt_time":1436720952561555,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":37,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":37,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.159","src_port":58690,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} +00955{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_src_packets_processed":2,"flow_dst_packets_processed":0,"flow_first_seen":1436720952561555,"flow_src_last_pkt_time":1436720952561891,"flow_dst_last_pkt_time":1436720952561555,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":37,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":37,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.159","src_port":58690,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00961{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_src_packets_processed":14,"flow_dst_packets_processed":20,"flow_first_seen":1436720901182283,"flow_src_last_pkt_time":1436720908544038,"flow_dst_last_pkt_time":1436720908543916,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":26795,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"77.67.29.17","src_port":33976,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00784{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_src_packets_processed":14,"flow_dst_packets_processed":20,"flow_first_seen":1436720901182283,"flow_src_last_pkt_time":1436720908544038,"flow_dst_last_pkt_time":1436720908543916,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":26795,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"77.67.29.17","src_port":33976,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00972{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720908523744,"flow_src_last_pkt_time":1436720908523744,"flow_dst_last_pkt_time":1436720908570222,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":47,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":47,"flow_dst_max_l4_payload_len":263,"flow_src_tot_l4_payload_len":47,"flow_dst_tot_l4_payload_len":263,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"8.8.8.8","src_port":51219,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Instagram","proto_id":"5.211","proto_by_ip":"Google","proto_by_ip_id":126,"encrypted":0,"breed":"Fun","category_id":14,"category":"Network"}} 00989{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":37,"flow_dst_packets_processed":38,"flow_first_seen":1436720942530885,"flow_src_last_pkt_time":1436720942620332,"flow_dst_last_pkt_time":1436720942621370,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":52029,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":58052,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -00784{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720942580781,"flow_src_last_pkt_time":1436720942580781,"flow_dst_last_pkt_time":1436720942580781,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":255,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":255,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":255,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":58053,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -01064{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":5,"flow_dst_packets_processed":0,"flow_first_seen":1436720908464754,"flow_src_last_pkt_time":1436720911139558,"flow_dst_last_pkt_time":1436720908464754,"flow_idle_time":140000000,"flow_src_min_l4_payload_len":68,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":68,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":340,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"192.168.0.103","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"ICMP","proto_id":"81","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":14,"category":"Network"}} +01103{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720942580781,"flow_src_last_pkt_time":1436720942580781,"flow_dst_last_pkt_time":1436720942580781,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":255,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":255,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":255,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.162","src_port":58053,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +00939{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":5,"flow_dst_packets_processed":0,"flow_first_seen":1436720908464754,"flow_src_last_pkt_time":1436720911139558,"flow_dst_last_pkt_time":1436720908464754,"flow_idle_time":140000000,"flow_src_min_l4_payload_len":68,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":68,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":340,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"192.168.0.103","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"ICMP","proto_id":"81","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":14,"category":"Network"}} 00977{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":0,"flow_first_seen":1436720906017091,"flow_src_last_pkt_time":1436720906024293,"flow_dst_last_pkt_time":1436720906017091,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":103,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":103,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":412,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.106","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Dropbox","proto_id":"121","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":13,"category":"Cloud"}} -00790{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_src_packets_processed":10,"flow_dst_packets_processed":9,"flow_first_seen":1436720908581361,"flow_src_last_pkt_time":1436720908735963,"flow_dst_last_pkt_time":1436720908769563,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":309,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":701,"flow_dst_tot_l4_payload_len":7369,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.136","src_port":60908,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +01115{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_src_packets_processed":10,"flow_dst_packets_processed":9,"flow_first_seen":1436720908581361,"flow_src_last_pkt_time":1436720908735963,"flow_dst_last_pkt_time":1436720908769563,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":309,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":701,"flow_dst_tot_l4_payload_len":7369,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.136","src_port":60908,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00968{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_src_packets_processed":26,"flow_dst_packets_processed":14,"flow_first_seen":1436720950909974,"flow_src_last_pkt_time":1436720950927186,"flow_dst_last_pkt_time":1436720950927431,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1398,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1398,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":36348,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"31.13.86.52","dst_ip":"192.168.0.103","src_port":80,"dst_port":58216,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00789{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_src_packets_processed":26,"flow_dst_packets_processed":14,"flow_first_seen":1436720950909974,"flow_src_last_pkt_time":1436720950927186,"flow_dst_last_pkt_time":1436720950927431,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1398,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1398,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":36348,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"31.13.86.52","dst_ip":"192.168.0.103","src_port":80,"dst_port":58216,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00790{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_src_packets_processed":10,"flow_dst_packets_processed":7,"flow_first_seen":1436720908572816,"flow_src_last_pkt_time":1436720908746828,"flow_dst_last_pkt_time":1436720908741762,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":450,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":877,"flow_dst_tot_l4_payload_len":4354,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.174","src_port":44558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +01115{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_src_packets_processed":10,"flow_dst_packets_processed":7,"flow_first_seen":1436720908572816,"flow_src_last_pkt_time":1436720908746828,"flow_dst_last_pkt_time":1436720908741762,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":450,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":877,"flow_dst_tot_l4_payload_len":4354,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.174","src_port":44558,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00954{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720952611482,"flow_src_last_pkt_time":1436720952611482,"flow_dst_last_pkt_time":1436720952611635,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"46.33.70.150","dst_ip":"192.168.0.103","src_port":80,"dst_port":40855,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00778{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720952611482,"flow_src_last_pkt_time":1436720952611482,"flow_dst_last_pkt_time":1436720952611635,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"46.33.70.150","dst_ip":"192.168.0.103","src_port":80,"dst_port":40855,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00988{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":39,"flow_first_seen":1436720900684083,"flow_src_last_pkt_time":1436720900750001,"flow_dst_last_pkt_time":1436720900744508,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":260,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":260,"flow_dst_tot_l4_payload_len":55302,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38816,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00954{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":1,"flow_first_seen":1436720908521089,"flow_src_last_pkt_time":1436720908542604,"flow_dst_last_pkt_time":1436720908542421,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38817,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00777{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":1,"flow_first_seen":1436720908521089,"flow_src_last_pkt_time":1436720908542604,"flow_dst_last_pkt_time":1436720908542421,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"46.33.70.160","src_port":38817,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00976{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720906022462,"flow_src_last_pkt_time":1436720906022462,"flow_dst_last_pkt_time":1436720906022462,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":103,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":103,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":103,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.106","dst_ip":"192.168.0.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Dropbox","proto_id":"121","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":13,"category":"Cloud"}} -00775{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720952563081,"flow_src_last_pkt_time":1436720952563081,"flow_dst_last_pkt_time":1436720952563081,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":43,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":43,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":43,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"8.8.8.8","src_port":27124,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5} +01089{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720952563081,"flow_src_last_pkt_time":1436720952563081,"flow_dst_last_pkt_time":1436720952563081,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":43,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":43,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":43,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"8.8.8.8","src_port":27124,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"DNS.Instagram","proto_id":"5.211","proto_by_ip":"Google","proto_by_ip_id":126,"encrypted":0,"breed":"Fun","category_id":14,"category":"Network"}} 01119{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":8,"flow_first_seen":1436720898354402,"flow_src_last_pkt_time":1436720899158632,"flow_dst_last_pkt_time":1436720899122651,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":464,"flow_dst_max_l4_payload_len":165,"flow_src_tot_l4_payload_len":981,"flow_dst_tot_l4_payload_len":528,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"173.252.107.4","src_port":56382,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"7": {"risk":"Obsolete TLS (v1.1 or older)","severity":"High","risk_score": {"total":310,"client":275,"server":35}}},"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -00788{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":5,"flow_dst_packets_processed":6,"flow_first_seen":1436720908466005,"flow_src_last_pkt_time":1436720908723359,"flow_dst_last_pkt_time":1436720910950960,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":3722,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33763,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +00962{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":5,"flow_dst_packets_processed":6,"flow_first_seen":1436720908466005,"flow_src_last_pkt_time":1436720908723359,"flow_dst_last_pkt_time":1436720910950960,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":3722,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33763,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00965{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":25,"flow_dst_packets_processed":24,"flow_first_seen":1436720952553865,"flow_src_last_pkt_time":1436720952593324,"flow_dst_last_pkt_time":1436720952591005,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1418,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1418,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":35450,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"2.22.236.51","dst_ip":"192.168.0.103","src_port":80,"dst_port":44151,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00789{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":25,"flow_dst_packets_processed":24,"flow_first_seen":1436720952553865,"flow_src_last_pkt_time":1436720952593324,"flow_dst_last_pkt_time":1436720952591005,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":1418,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1418,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":35450,"flow_dst_tot_l4_payload_len":0,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"2.22.236.51","dst_ip":"192.168.0.103","src_port":80,"dst_port":44151,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} 00987{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"finished","flow_src_packets_processed":41,"flow_dst_packets_processed":40,"flow_first_seen":1436720900690339,"flow_src_last_pkt_time":1436720908566530,"flow_dst_last_pkt_time":1436720908566347,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":259,"flow_dst_max_l4_payload_len":1418,"flow_src_tot_l4_payload_len":518,"flow_dst_tot_l4_payload_len":47384,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"82.85.26.186","src_port":44379,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Instagram","proto_id":"7.211","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -00788{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":6,"flow_first_seen":1436720906070589,"flow_src_last_pkt_time":1436720908431856,"flow_dst_last_pkt_time":1436720908431917,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1398,"flow_dst_max_l4_payload_len":949,"flow_src_tot_l4_payload_len":4303,"flow_dst_tot_l4_payload_len":949,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"31.13.93.52","dst_ip":"192.168.0.103","src_port":443,"dst_port":33934,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00788{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":5,"flow_dst_packets_processed":5,"flow_first_seen":1436720908216981,"flow_src_last_pkt_time":1436720908432710,"flow_dst_last_pkt_time":1436720908432649,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":3690,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33935,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +00962{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":6,"flow_first_seen":1436720906070589,"flow_src_last_pkt_time":1436720908431856,"flow_dst_last_pkt_time":1436720908431917,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1398,"flow_dst_max_l4_payload_len":949,"flow_src_tot_l4_payload_len":4303,"flow_dst_tot_l4_payload_len":949,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"31.13.93.52","dst_ip":"192.168.0.103","src_port":443,"dst_port":33934,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} +00962{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":5,"flow_dst_packets_processed":5,"flow_first_seen":1436720908216981,"flow_src_last_pkt_time":1436720908432710,"flow_dst_last_pkt_time":1436720908432649,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":949,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":949,"flow_dst_tot_l4_payload_len":3690,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33935,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00970{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":34,"flow_dst_packets_processed":34,"flow_first_seen":1436720898386781,"flow_src_last_pkt_time":1436720908442842,"flow_dst_last_pkt_time":1436720908442750,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1365,"flow_dst_max_l4_payload_len":1398,"flow_src_tot_l4_payload_len":3311,"flow_dst_tot_l4_payload_len":37889,"midstream":1,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"31.13.93.52","src_port":33936,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}} 00972{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1436720908524019,"flow_src_last_pkt_time":1436720908524019,"flow_dst_last_pkt_time":1436720908575624,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":47,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":47,"flow_dst_max_l4_payload_len":167,"flow_src_tot_l4_payload_len":47,"flow_dst_tot_l4_payload_len":167,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.103","dst_ip":"8.8.8.8","src_port":33603,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Instagram","proto_id":"5.211","proto_by_ip":"Google","proto_by_ip_id":126,"encrypted":0,"breed":"Fun","category_id":14,"category":"Network"}} 00865{"flow_event_id":9,"flow_event_name":"not-detected","thread_id":0,"packet_id":705,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1436720906025422,"flow_src_last_pkt_time":1436720906025422,"flow_dst_last_pkt_time":1436720906025422,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":24,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":24,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":24,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1568796254728873,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"192.168.0.255","src_port":520,"dst_port":520,"l4_proto":"udp","ndpi": {"proto":"Unknown","proto_id":"0","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Unrated"}} @@ -291,13 +300,13 @@ 01253{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":720,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":4,"flow_first_seen":1568796265146962,"flow_src_last_pkt_time":1568796265162734,"flow_dst_last_pkt_time":1568796265175583,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":930,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796265175583,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49360,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"scontent-mxp1-1.cdninstagram.com","tls": {"version":"TLSv1.3 (Fizz)","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}}} 01253{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":721,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":4,"flow_first_seen":1568796265147078,"flow_src_last_pkt_time":1568796265163365,"flow_dst_last_pkt_time":1568796265176036,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":930,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796265176036,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49361,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"scontent-mxp1-1.cdninstagram.com","tls": {"version":"TLSv1.3 (Fizz)","ja3":"44dab16d680ef93487bc16ad23b3ffb1","ja3s":"fcb2d4d0991292272fcb1e464eedfd43","unsafe_cipher":0,"cipher":"TLS_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.3 (Fizz)"}}} 02195{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":735,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_src_packets_processed":15,"flow_dst_packets_processed":17,"flow_first_seen":1568796254514906,"flow_src_last_pkt_time":1568796265194500,"flow_dst_last_pkt_time":1568796265280665,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":597,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":2170,"flow_dst_tot_l4_payload_len":10887,"midstream":0,"thread_ts_usec":1568796265280665,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49357,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":6,"avg":691785.6,"max":10469815,"stddev":2560795.0,"var":6557671096320.0,"ent":1.2,"data": [11096,12433,1241,548,13252,614,103,14204,568,14367,12466,169576,258,200,98,307,55,169,229,6,169709,106,1819,218,113,542,10413415,52212,10469815,9752,75862]},"pktlen": {"min":52,"avg":460.7,"max":1440,"stddev":528.6,"var":279392.3,"ent":4.1,"data": [64,60,52,471,649,52,52,274,52,136,230,52,825,1440,1440,1440,1440,1440,628,1440,86,52,52,52,52,52,52,587,587,52,52,828]},"bins": {"c_to_s": [10,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,2,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [5,1,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0]},"directions": [0,1,0,0,0,1,1,1,0,0,1,0,1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,1,1,1],"entropies": [4.215376377,5.115063667,4.860988617,7.062851906,7.630533695,5.014835358,4.976373672,6.836615562,4.884933949,6.378606796,7.007258415,4.822527409,7.742178440,7.852344990,7.873802185,7.849394321,7.865141869,7.857724190,7.720446110,7.850056171,5.757548332,4.976373672,4.976373672,4.937912464,4.937911987,4.899450779,4.976373672,7.590856075,7.594714642,5.053297043,5.053297043,7.784784317]},"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -00787{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":8,"flow_first_seen":1568796253770116,"flow_src_last_pkt_time":1568796253816628,"flow_dst_last_pkt_time":1568796253816389,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":498,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":784,"flow_dst_tot_l4_payload_len":3925,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49355,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} +00984{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_src_packets_processed":8,"flow_dst_packets_processed":8,"flow_first_seen":1568796253770116,"flow_src_last_pkt_time":1568796253816628,"flow_dst_last_pkt_time":1568796253816389,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":498,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":784,"flow_dst_tot_l4_payload_len":3925,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49355,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00991{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_src_packets_processed":63,"flow_dst_packets_processed":81,"flow_first_seen":1568796254514906,"flow_src_last_pkt_time":1568796268054084,"flow_dst_last_pkt_time":1568796268052355,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":597,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":2170,"flow_dst_tot_l4_payload_len":95612,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49357,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00990{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":35,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":10,"flow_first_seen":1568796254515573,"flow_src_last_pkt_time":1568796254556849,"flow_dst_last_pkt_time":1568796254711721,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":529,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":1032,"flow_dst_tot_l4_payload_len":6726,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49358,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -00787{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":6,"flow_first_seen":1568796254524506,"flow_src_last_pkt_time":1568796254539348,"flow_dst_last_pkt_time":1568796254552721,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":513,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":932,"flow_dst_tot_l4_payload_len":2243,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49359,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00789{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":10,"flow_first_seen":1568796265146962,"flow_src_last_pkt_time":1568796265177487,"flow_dst_last_pkt_time":1568796265178429,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":1014,"flow_dst_tot_l4_payload_len":6430,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49360,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00786{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":4,"flow_first_seen":1568796265147078,"flow_src_last_pkt_time":1568796265178757,"flow_dst_last_pkt_time":1568796265176036,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":1014,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49361,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5} -00647{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":847,"packets-processed":846,"total-skipped-flows":0,"total-l4-payload-len":530270,"total-not-detected-flows":1,"total-guessed-flows":7,"total-detected-flows":30,"total-detection-updates":19,"total-updates":4,"current-active-flows":0,"total-active-flows":38,"total-idle-flows":38,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":300,"global_ts_usec":1568796268054084} +00984{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":36,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":6,"flow_first_seen":1568796254524506,"flow_src_last_pkt_time":1568796254539348,"flow_dst_last_pkt_time":1568796254552721,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":513,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":932,"flow_dst_tot_l4_payload_len":2243,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49359,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +00986{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":10,"flow_first_seen":1568796265146962,"flow_src_last_pkt_time":1568796265177487,"flow_dst_last_pkt_time":1568796265178429,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":1388,"flow_src_tot_l4_payload_len":1014,"flow_dst_tot_l4_payload_len":6430,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49360,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +00983{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","flow_id":38,"flow_state":"info","flow_src_packets_processed":6,"flow_dst_packets_processed":4,"flow_first_seen":1568796265147078,"flow_src_last_pkt_time":1568796265178757,"flow_dst_last_pkt_time":1568796265176036,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":526,"flow_dst_max_l4_payload_len":222,"flow_src_tot_l4_payload_len":1014,"flow_dst_tot_l4_payload_len":222,"midstream":0,"thread_ts_usec":1568796268054084,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"31.13.86.52","src_port":49361,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Instagram","proto_id":"91.211","proto_by_ip":"Facebook","proto_by_ip_id":119,"encrypted":1,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +00647{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":847,"source":"cfgs\/default\/pcap\/instagram.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":847,"packets-processed":846,"total-skipped-flows":0,"total-l4-payload-len":530270,"total-not-detected-flows":1,"total-guessed-flows":7,"total-detected-flows":30,"total-detection-updates":28,"total-updates":4,"current-active-flows":0,"total-active-flows":38,"total-idle-flows":38,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":309,"global_ts_usec":1568796268054084} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 847/846 ~~ skipped flows.............: 0 @@ -306,9 +315,9 @@ ~~ total active/idle flows...: 38/38 ~~ total timeout flows.......: 8 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ total memory allocated....: 11718310 bytes -~~ total memory freed........: 11718310 bytes -~~ total allocations/frees...: 218002/218002 +~~ total memory allocated....: 11718338 bytes +~~ total memory freed........: 11718338 bytes +~~ total allocations/frees...: 218010/218010 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~ json string min len.......: 547 chars ~~ json string max len.......: 2493 chars |