diff options
Diffstat (limited to 'test/results/discord.pcap.out')
| -rw-r--r-- | test/results/discord.pcap.out | 61 |
1 files changed, 55 insertions, 6 deletions
diff --git a/test/results/discord.pcap.out b/test/results/discord.pcap.out index 27c647bf4..43e8abb15 100644 --- a/test/results/discord.pcap.out +++ b/test/results/discord.pcap.out @@ -1,4 +1,4 @@ -00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"discord.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":3265032704,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_usec":0} +00487{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"discord.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":3265032704,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"max-packets-per-flow-to-analyse":32,"global_ts_usec":0} 00719{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":42193200,"flow_src_last_pkt_time":42193200,"flow_dst_last_pkt_time":42193200,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":42193200,"l3_proto":"ip4","src_ip":"10.0.2.15","dst_ip":"162.159.128.233","src_port":42834,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00512{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":42193200,"flow_dst_last_pkt_time":42193200,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":42193200,"pkt":"UlQAEjUCCAAnW\/mGCABFAAA8+ptAAEAGEIkKAAIPop+A6adSAbuGXfMIAAAAAKAC+vDjjQAAAgQFtAQCCAqmenD7AAAAAAEDAwc="} 00494{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"discord.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":42193200,"flow_dst_last_pkt_time":42208691,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_usec":42208691,"pkt":"CAAnW\/mGUlQAEjUCCABFAAAsAYYAAEAGSa+in4DpCgACDwG7p1IAKQQBhl3zCWAS\/\/9B4AAAAgQFtA=="} @@ -54,11 +54,15 @@ 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_src_last_pkt_time":1657223779896000,"flow_dst_last_pkt_time":1657223779924000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223779924000,"pkt":"YDjgxTWgeJS0JASgCABFAABmNrJAADoRQAVCFsStwKgCZMNU1y0AUrJ0AAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1y0="} 00910{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":51,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223779896000,"flow_src_last_pkt_time":1657223779896000,"flow_dst_last_pkt_time":1657223779924000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657223779924000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55085,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00818{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_src_last_pkt_time":1657223779936000,"flow_dst_last_pkt_time":1657223779924000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"thread_ts_usec":1657223779936000,"pkt":"eJS0JASgYDjgxTWgCABFAAELnF8AAH8R1LLAqAJkQhbErdctw1QA9xVukHgbAzgy\/SMAAKzjvt4AAWAE\/IvwT4GlHpxmV52wzS9NTs2xiTllOovuk+hEokzDbMStlOwlGxxPFqx1BFbapQWdeH7w8r8yY1koiot89yAmmKvnVieqF3x6mOJ7fTY6MrXt+h7JX+y7Xkzi0McRuQUSQdbyYNEQXgI4i4iPJerYA5GLBHAOOAytl2CviB2UswPPpY44U2rpjY2DHaqegsmYdkP2ovrfswiIEKdRQgUxdV0RTb8HUf1yEYe04ZsHnwwIoGOghkk7zzFbjxcf6Ul6bVlUoaw6ImCfsjwUxO1OolHvQe9\/lYC9Ys0HAIA="} +00913{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":65,"source":"discord.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657223719868000,"flow_src_last_pkt_time":1657223720042000,"flow_dst_last_pkt_time":1657223720058000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":319,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":777,"flow_dst_tot_l4_payload_len":1768,"midstream":0,"thread_ts_usec":1657223780046000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57955,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00759{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":65,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657223839896000,"flow_src_last_pkt_time":1657223839896000,"flow_dst_last_pkt_time":1657223839896000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657223839896000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52283,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_src_last_pkt_time":1657223839896000,"flow_dst_last_pkt_time":1657223839896000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223839896000,"pkt":"eJS0JASgYDjgxTWgCABFAABmoKwAAH8R0QrAqAJkQhbErcw7w1QAUiEfAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA158="} 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_src_last_pkt_time":1657223839896000,"flow_dst_last_pkt_time":1657223839923000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223839923000,"pkt":"YDjgxTWgeJS0JASgCABFAABmWHVAADoRHkJCFsStwKgCZMNUzDsAUshYAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzDs="} 00910{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":66,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223839896000,"flow_src_last_pkt_time":1657223839896000,"flow_dst_last_pkt_time":1657223839923000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657223839923000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52283,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00892{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":3,"flow_src_last_pkt_time":1657223839933000,"flow_dst_last_pkt_time":1657223839923000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":333,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":333,"pkt_l4_len":299,"thread_ts_usec":1657223839933000,"pkt":"eJS0JASgYDjgxTWgCABFAAE\/oK8AAH8R0C7AqAJkQhbErcw7w1QBK3njkHgfJThe7yMAAKzjvt4AAdPr6lB\/MmLY6r0BoDp6lUyFeuTPGvfdfp7KE9nFuBixePCbH75Tva3BRIf\/8d4MF9NsSgs5XH1m8leA7mXAN0XKA\/DPnsvG8a5e8SvE2aWjVrLHGfJTYO37+p8StN6\/4nr+IYOq4r0HrcSSoYmF0egtxXlIXsfN4GRXxe4amI5fVv3zN820vR7gEJugEogj4LOR2HNSBcf+CjaPl67KaGAwL0tQX28wr8QjHn28zG2tR\/Kqgjtbj36ndy7FRCI9bRa5S6bqT0G557uwh\/Ot\/zbn7KU8BWcZt6nIkEzKBT5rUQrzHStCOspfzFLaKK2yBe8g\/MfAO6mkg9rfS+PXqo6zofJ7XBsxnfhR0JrWqPYQDACA"} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":80,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223779896000,"flow_src_last_pkt_time":1657223780038000,"flow_dst_last_pkt_time":1657223780046000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1494,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223840043000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55085,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00913{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":80,"source":"discord.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657223719868000,"flow_src_last_pkt_time":1657223720042000,"flow_dst_last_pkt_time":1657223720058000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":319,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":777,"flow_dst_tot_l4_payload_len":1768,"midstream":0,"thread_ts_usec":1657223840043000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57955,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":80,"source":"discord.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657223740296000,"flow_src_last_pkt_time":1657223740412000,"flow_dst_last_pkt_time":1657223740422000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":32,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":1026,"flow_src_tot_l4_payload_len":213,"flow_dst_tot_l4_payload_len":7273,"midstream":0,"thread_ts_usec":1657223840043000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"35.214.238.161","src_port":64837,"dst_port":50001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00759{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":80,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657223899895000,"flow_src_last_pkt_time":1657223899895000,"flow_dst_last_pkt_time":1657223899895000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657223899895000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50199,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_src_last_pkt_time":1657223899895000,"flow_dst_last_pkt_time":1657223899895000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223899895000,"pkt":"eJS0JASgYDjgxTWgCABFAABmqN8AAH8RyNfAqAJkQhbErcQXw1QAUhzYAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5Ao="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_src_last_pkt_time":1657223899895000,"flow_dst_last_pkt_time":1657223899922000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223899922000,"pkt":"YDjgxTWgeJS0JASgCABFAABmd4VAADoR\/zFCFsStwKgCZMNUxBcAUtigAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxBc="} @@ -68,7 +72,10 @@ 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223900042000,"pkt":"eJS0JASgYDjgxTWgCABFAABmlIEAAH8R3TXAqAJkQhbEreJkw1QAUoApAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYmw="} 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223900042000,"pkt":"YDjgxTWgeJS0JASgCABFAABmFLBAADoRYgdCFsStwKgCZMNU4mQAUpwGAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4mQ="} 00910{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":96,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223900042000,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657223900042000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57956,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223779896000,"flow_src_last_pkt_time":1657223780038000,"flow_dst_last_pkt_time":1657223780046000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1494,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223900042000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55085,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00913{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657223719868000,"flow_src_last_pkt_time":1657223720042000,"flow_dst_last_pkt_time":1657223720058000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":319,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":777,"flow_dst_tot_l4_payload_len":1768,"midstream":0,"thread_ts_usec":1657223900042000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57955,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223839896000,"flow_src_last_pkt_time":1657223840035000,"flow_dst_last_pkt_time":1657223840043000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":292,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1798,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223900042000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52283,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657223740296000,"flow_src_last_pkt_time":1657223740412000,"flow_dst_last_pkt_time":1657223740422000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":32,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":1026,"flow_src_tot_l4_payload_len":213,"flow_dst_tot_l4_payload_len":7273,"midstream":0,"thread_ts_usec":1657223900042000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"35.214.238.161","src_port":64837,"dst_port":50001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00759{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657223959895000,"flow_src_last_pkt_time":1657223959895000,"flow_dst_last_pkt_time":1657223959895000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657223959895000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":53459,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_src_last_pkt_time":1657223959895000,"flow_dst_last_pkt_time":1657223959895000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223959895000,"pkt":"eJS0JASgYDjgxTWgCABFAABmrgcAAH8Rw6\/AqAJkQhbErdDTw1QAUiv7AAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyCs="} 00594{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_src_last_pkt_time":1657223959895000,"flow_dst_last_pkt_time":1657223959923000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657223959923000,"pkt":"YDjgxTWgeJS0JASgCABFAABmm3FAADoR20VCFsStwKgCZMNU0NMAUr8oAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0NM="} @@ -77,12 +84,18 @@ 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":10,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223779896000,"flow_src_last_pkt_time":1657223780038000,"flow_dst_last_pkt_time":1657223780046000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":253,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1494,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55085,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":8,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657223719868000,"flow_src_last_pkt_time":1657223720042000,"flow_dst_last_pkt_time":1657223720058000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":319,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":777,"flow_dst_tot_l4_payload_len":1768,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57955,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00915{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":9,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657223740296000,"flow_src_last_pkt_time":1657223740412000,"flow_dst_last_pkt_time":1657223740422000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":32,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":1026,"flow_src_tot_l4_payload_len":213,"flow_dst_tot_l4_payload_len":7273,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"35.214.238.161","src_port":64837,"dst_port":50001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00911{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223900042000,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57956,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223899895000,"flow_src_last_pkt_time":1657223900033000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":291,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1761,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50199,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223839896000,"flow_src_last_pkt_time":1657223840035000,"flow_dst_last_pkt_time":1657223840043000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":292,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1798,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657223961720000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52283,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224019895000,"flow_dst_last_pkt_time":1657224019895000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224019895000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_src_last_pkt_time":1657224019895000,"flow_dst_last_pkt_time":1657224019895000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224019895000,"pkt":"eJS0JASgYDjgxTWgCABFAABmsi0AAH8Rv4nAqAJkQhbEre\/7w1QAUm3HAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZzc="} 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_src_last_pkt_time":1657224019895000,"flow_dst_last_pkt_time":1657224019936000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224019936000,"pkt":"YDjgxTWgeJS0JASgCABFAABmu5pAADoRuxxCFsStwKgCZMNU7\/sAUoDYAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7\/s="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224019895000,"flow_dst_last_pkt_time":1657224019936000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224019936000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00898{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_src_last_pkt_time":1657224019952000,"flow_dst_last_pkt_time":1657224019936000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":337,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":337,"pkt_l4_len":303,"thread_ts_usec":1657224019952000,"pkt":"eJS0JASgYDjgxTWgCABFAAFDsjAAAH8RvqnAqAJkQhbEre\/7w1QBLyUNkHgwETjiyOMAAKzjvt4AAdjjIHs+MidsAnsk+ooc8qp6lqwq29Lxwr24zwLoh6wZagVlNfkEQzK2jJw1a1zEJip9L7YItBftnJ6VHZJ2GpELULbyL3fQLqxBPHFXNbGxRkw\/naTxjX7vJS3r8SOg2JNTqJP+DCNLLxgXr4xYzDnLV20NIgPz7hA8F7y7hkdwF8PlhV4oBTdSIv0l6jOsiTyYY+sn9EQWX4Jl+N\/r5fiVGhSg796YJMSoKTv\/gURE5d\/mlP3nGyr2ONPxFc6m3al\/mzGAvcqVFbKSSAqc1lZLNFN+Eeg9ezvX5rozhPoEhdGx2J5rvTpcTfSVXlh9ztVPf3Y5e4RNnqW8ga22yGm3zioi2fWInyqKpRJJdLNzExsxah0AgA=="} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223839896000,"flow_src_last_pkt_time":1657223840035000,"flow_dst_last_pkt_time":1657223840043000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":292,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1798,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657224020155000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52283,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657223959895000,"flow_src_last_pkt_time":1657223961506000,"flow_dst_last_pkt_time":1657223961720000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224020155000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":53459,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00911{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223900042000,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224020155000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57956,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223899895000,"flow_src_last_pkt_time":1657223900033000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":291,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1761,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657224020155000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50199,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224079896000,"flow_src_last_pkt_time":1657224079896000,"flow_dst_last_pkt_time":1657224079896000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224079896000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58322,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_src_last_pkt_time":1657224079896000,"flow_dst_last_pkt_time":1657224079896000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224079896000,"pkt":"eJS0JASgYDjgxTWgCABFAABmtucAAH8Rus\/AqAJkQhbErePSw1QAUmYKAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAex0="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":128,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_src_last_pkt_time":1657224079896000,"flow_dst_last_pkt_time":1657224079936000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224079936000,"pkt":"YDjgxTWgeJS0JASgCABFAABm3GVAADoRmlFCFsStwKgCZMNU49IAUpkqAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA49I="} @@ -90,27 +103,35 @@ 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":129,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":3,"flow_src_last_pkt_time":1657224080036000,"flow_dst_last_pkt_time":1657224079936000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224080036000,"pkt":"eJS0JASgYDjgxTWgCABFAAAktugAAH8RuxDAqAJkQhbErePSw1QAEGegEzfK\/kkAAAA="} 00909{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"finished","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657223900042000,"flow_src_last_pkt_time":1657223900042000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224081830000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57956,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657223899895000,"flow_src_last_pkt_time":1657223900033000,"flow_dst_last_pkt_time":1657223900042000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":291,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1761,"flow_dst_tot_l4_payload_len":1487,"midstream":0,"thread_ts_usec":1657224081830000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50199,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224020155000,"flow_dst_last_pkt_time":1657224020074000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3221,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224081830000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657223959895000,"flow_src_last_pkt_time":1657223961506000,"flow_dst_last_pkt_time":1657223961720000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224081830000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":53459,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224139897000,"flow_src_last_pkt_time":1657224139897000,"flow_dst_last_pkt_time":1657224139897000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224139897000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61392,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":142,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_src_last_pkt_time":1657224139897000,"flow_dst_last_pkt_time":1657224139897000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224139897000,"pkt":"eJS0JASgYDjgxTWgCABFAABmvHgAAH8RtT7AqAJkQhbEre\/Qw1QAUkQDAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkSY="} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":143,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_src_last_pkt_time":1657224139897000,"flow_dst_last_pkt_time":1657224139947000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224139947000,"pkt":"YDjgxTWgeJS0JASgCABFAABm\/t9AADoRd9dCFsStwKgCZMNU79AAUoEuAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA79A="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":143,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224139897000,"flow_src_last_pkt_time":1657224139897000,"flow_dst_last_pkt_time":1657224139947000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224139947000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61392,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00508{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":144,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":3,"flow_src_last_pkt_time":1657224140043000,"flow_dst_last_pkt_time":1657224139947000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224140043000,"pkt":"eJS0JASgYDjgxTWgCABFAAAkvHkAAH8RtX\/AqAJkQhbEre\/Qw1QAEE+iEzfK\/lUAAAA="} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":157,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224020155000,"flow_dst_last_pkt_time":1657224020074000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3221,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224140441000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":157,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657223959895000,"flow_src_last_pkt_time":1657223961506000,"flow_dst_last_pkt_time":1657223961720000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224140441000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":53459,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":157,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224079896000,"flow_src_last_pkt_time":1657224081830000,"flow_dst_last_pkt_time":1657224081824000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":289,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1564,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224140441000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58322,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":157,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224199898000,"flow_src_last_pkt_time":1657224199898000,"flow_dst_last_pkt_time":1657224199898000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224199898000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63362,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":157,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_src_last_pkt_time":1657224199898000,"flow_dst_last_pkt_time":1657224199898000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224199898000,"pkt":"eJS0JASgYDjgxTWgCABFAABmvlkAAH8Rs13AqAJkQhbErfeCw1QAUtaNAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9uk="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":158,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_src_last_pkt_time":1657224199898000,"flow_dst_last_pkt_time":1657224199946000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224199946000,"pkt":"YDjgxTWgeJS0JASgCABFAABmIQdAADoRVbBCFsStwKgCZMNU94IAUnHKAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA94I="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":158,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224199898000,"flow_src_last_pkt_time":1657224199898000,"flow_dst_last_pkt_time":1657224199946000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224199946000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63362,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00902{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":159,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":3,"flow_src_last_pkt_time":1657224199951000,"flow_dst_last_pkt_time":1657224199946000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":340,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":340,"pkt_l4_len":306,"thread_ts_usec":1657224199951000,"pkt":"eJS0JASgYDjgxTWgCABFAAFGvlwAAH8RsnrAqAJkQhbErfeCw1QBMoU0kHg7qTlmnuMAAKzjvt4AARE3waMffiYG3kvB\/DcCXW3AwEKnkXSHY522FSFTWu0tyvVdRwIsDL5MoFlUZHvECC1i3\/Cb618TRuMB0ys6dpm85m9Mefk9gYT3eb1o4cp+Bm1uH10WZthG8ght0briP031xbJIHQfploZd2rZgjxu0Yzazi57qY4yhdnqz90z1joDp6SM\/psYjqFBQagu9JHXKpuTmZ7oQoBOak\/SqQTqgXhl7ALyodrmN7HApLt+CELLnMRVjU5djDX+6VTx9+3Sxwx1D+Sa3xeJzUbik7jeg74WMrFlPo1\/Ck6l8BpfubuDZcf8SeCbyLgmRJwomhqDqTA\/vfUTABRtHp79CtDwvzrWoYL2tEJ5tJhHU2CwVSfmyI0rlbykAgA=="} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":14,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657223959895000,"flow_src_last_pkt_time":1657223961506000,"flow_dst_last_pkt_time":1657223961720000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224200131000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":53459,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224139897000,"flow_src_last_pkt_time":1657224140295000,"flow_dst_last_pkt_time":1657224140441000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224200131000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61392,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224020155000,"flow_dst_last_pkt_time":1657224020074000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3221,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224200131000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224079896000,"flow_src_last_pkt_time":1657224081830000,"flow_dst_last_pkt_time":1657224081824000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":289,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1564,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224200131000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58322,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224259898000,"flow_src_last_pkt_time":1657224259898000,"flow_dst_last_pkt_time":1657224259898000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224259898000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50335,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_src_last_pkt_time":1657224259898000,"flow_dst_last_pkt_time":1657224259898000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224259898000,"pkt":"eJS0JASgYDjgxTWgCABFAABmxEMAAH8RrXPAqAJkQhbErcSfw1QAUhj9AAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA510="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":2,"flow_src_last_pkt_time":1657224259898000,"flow_dst_last_pkt_time":1657224259946000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224259946000,"pkt":"YDjgxTWgeJS0JASgCABFAABmRclAADoRMO5CFsStwKgCZMNUxJ8AUteQAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxJ8="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":173,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224259898000,"flow_src_last_pkt_time":1657224259898000,"flow_dst_last_pkt_time":1657224259946000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224259946000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50335,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":174,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":3,"flow_src_last_pkt_time":1657224260063000,"flow_dst_last_pkt_time":1657224259946000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224260063000,"pkt":"eJS0JASgYDjgxTWgCABFAAAkxEQAAH8RrbTAqAJkQhbErcSfw1QAEGLTEzfK\/m0AAAA="} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224019895000,"flow_src_last_pkt_time":1657224020155000,"flow_dst_last_pkt_time":1657224020074000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3221,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224260473000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61435,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":12,"flow_dst_packets_processed":3,"flow_first_seen":1657224199898000,"flow_src_last_pkt_time":1657224200131000,"flow_dst_last_pkt_time":1657224200128000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2845,"flow_dst_tot_l4_payload_len":363,"midstream":0,"thread_ts_usec":1657224260473000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63362,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224139897000,"flow_src_last_pkt_time":1657224140295000,"flow_dst_last_pkt_time":1657224140441000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224260473000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61392,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224079896000,"flow_src_last_pkt_time":1657224081830000,"flow_dst_last_pkt_time":1657224081824000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":289,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1564,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224260473000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58322,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} -00565{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","packets-captured":187,"packets-processed":186,"total-skipped-flows":0,"total-l4-payload-len":41446,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":19,"total-detection-updates":2,"total-updates":4,"current-active-flows":4,"total-active-flows":19,"total-idle-flows":15,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":113,"global_ts_usec":1657224319898000} +00566{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","packets-captured":187,"packets-processed":186,"total-skipped-flows":0,"total-l4-payload-len":41446,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":19,"total-detection-updates":2,"total-updates":25,"current-active-flows":4,"total-active-flows":19,"total-idle-flows":15,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":134,"global_ts_usec":1657224319898000} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224319898000,"flow_src_last_pkt_time":1657224319898000,"flow_dst_last_pkt_time":1657224319898000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224319898000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62379,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_src_last_pkt_time":1657224319898000,"flow_dst_last_pkt_time":1657224319898000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224319898000,"pkt":"eJS0JASgYDjgxTWgCABFAABmywMAAH8RprPAqAJkQhbErfOrw1QAUprMAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANoI="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":188,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":2,"flow_src_last_pkt_time":1657224319898000,"flow_dst_last_pkt_time":1657224319945000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224319945000,"pkt":"YDjgxTWgeJS0JASgCABFAABmaGhAADoRDk9CFsStwKgCZMNU86sAUnl4AAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA86s="} @@ -118,24 +139,32 @@ 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":189,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":3,"flow_src_last_pkt_time":1657224320071000,"flow_dst_last_pkt_time":1657224319945000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224320071000,"pkt":"eJS0JASgYDjgxTWgCABFAAAkywQAAH8RpvTAqAJkQhbErfOrw1QAECfHEzfK\/nkAAAA="} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224139897000,"flow_src_last_pkt_time":1657224140295000,"flow_dst_last_pkt_time":1657224140441000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224321140000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61392,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224079896000,"flow_src_last_pkt_time":1657224081830000,"flow_dst_last_pkt_time":1657224081824000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":289,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1564,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224321140000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58322,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":12,"flow_dst_packets_processed":3,"flow_first_seen":1657224199898000,"flow_src_last_pkt_time":1657224200131000,"flow_dst_last_pkt_time":1657224200128000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2845,"flow_dst_tot_l4_payload_len":363,"midstream":0,"thread_ts_usec":1657224321140000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63362,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224259898000,"flow_src_last_pkt_time":1657224260238000,"flow_dst_last_pkt_time":1657224260473000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224321140000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50335,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224379899000,"flow_src_last_pkt_time":1657224379899000,"flow_dst_last_pkt_time":1657224379899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224379899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62844,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":202,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_src_last_pkt_time":1657224379899000,"flow_dst_last_pkt_time":1657224379899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224379899000,"pkt":"eJS0JASgYDjgxTWgCABFAABmzYMAAH8RpDPAqAJkQhbErfV8w1QAUt1FAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8jc="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":2,"flow_src_last_pkt_time":1657224379899000,"flow_dst_last_pkt_time":1657224379944000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224379944000,"pkt":"YDjgxTWgeJS0JASgCABFAABmi8xAADoR6upCFsStwKgCZMNU9XwAUnXWAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9Xw="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":203,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224379899000,"flow_src_last_pkt_time":1657224379899000,"flow_dst_last_pkt_time":1657224379944000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224379944000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62844,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00554{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":204,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":3,"flow_src_last_pkt_time":1657224379948000,"flow_dst_last_pkt_time":1657224379944000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"thread_ts_usec":1657224379948000,"pkt":"eJS0JASgYDjgxTWgCABFAABHzYYAAH8RpE\/AqAJkQhbErfV8w1QAM2OTkHhKPTnqdOMAAKzjvt4AAfzA3BWVjPO2z99gWTTf5ZKvN7c+sFyocjgAgA=="} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":217,"source":"discord.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":12,"flow_dst_packets_processed":3,"flow_first_seen":1657224199898000,"flow_src_last_pkt_time":1657224200131000,"flow_dst_last_pkt_time":1657224200128000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":298,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2845,"flow_dst_tot_l4_payload_len":363,"midstream":0,"thread_ts_usec":1657224380154000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63362,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":217,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224319898000,"flow_src_last_pkt_time":1657224321133000,"flow_dst_last_pkt_time":1657224321140000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":288,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1793,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224380154000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62379,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":217,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224259898000,"flow_src_last_pkt_time":1657224260238000,"flow_dst_last_pkt_time":1657224260473000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224380154000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50335,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":217,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224439898000,"flow_dst_last_pkt_time":1657224439898000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224439898000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_src_last_pkt_time":1657224439898000,"flow_dst_last_pkt_time":1657224439898000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224439898000,"pkt":"eJS0JASgYDjgxTWgCABFAABm06kAAH8Rng3AqAJkQhbErenzw1QAUiZTAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtLM="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_src_last_pkt_time":1657224439898000,"flow_dst_last_pkt_time":1657224439926000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224439926000,"pkt":"YDjgxTWgeJS0JASgCABFAABmrEpAADoRymxCFsStwKgCZMNU6fMAUozoAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6fM="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":218,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224439898000,"flow_dst_last_pkt_time":1657224439926000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224439926000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00507{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":219,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":3,"flow_src_last_pkt_time":1657224440085000,"flow_dst_last_pkt_time":1657224439926000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224440085000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk06oAAH8Rnk7AqAJkQhbErenzw1QAEBl\/EzfK\/pEAAAA="} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":232,"source":"discord.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224259898000,"flow_src_last_pkt_time":1657224260238000,"flow_dst_last_pkt_time":1657224260473000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657224441950000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":50335,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":232,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224319898000,"flow_src_last_pkt_time":1657224321133000,"flow_dst_last_pkt_time":1657224321140000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":288,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1793,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224441950000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62379,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00913{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":232,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224379899000,"flow_src_last_pkt_time":1657224380077000,"flow_dst_last_pkt_time":1657224380154000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":168,"flow_dst_tot_l4_payload_len":469,"midstream":0,"thread_ts_usec":1657224441950000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62844,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":232,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224499898000,"flow_src_last_pkt_time":1657224499898000,"flow_dst_last_pkt_time":1657224499898000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224499898000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61985,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_src_last_pkt_time":1657224499898000,"flow_dst_last_pkt_time":1657224499898000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224499898000,"pkt":"eJS0JASgYDjgxTWgCABFAABm2b0AAH8Rl\/nAqAJkQhbErfIhw1QAUsgiAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrY="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_src_last_pkt_time":1657224499898000,"flow_dst_last_pkt_time":1657224499926000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224499926000,"pkt":"YDjgxTWgeJS0JASgCABFAABmzgJAADoRqLRCFsStwKgCZMNU8iEAUnyMAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8iE="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":233,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224499898000,"flow_src_last_pkt_time":1657224499898000,"flow_dst_last_pkt_time":1657224499926000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224499926000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61985,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00874{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":3,"flow_src_last_pkt_time":1657224499931000,"flow_dst_last_pkt_time":1657224499926000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"thread_ts_usec":1657224499931000,"pkt":"eJS0JASgYDjgxTWgCABFAAEz2cAAAH8RlynAqAJkQhbErfIhw1QBH38CkHhWFTpCVSMAAKzjvt4AAatpvW0rTNOV9d\/4pFPygLm\/twfjpYU4oHrAymsGisdSICxpD1CIBA0cEYM1lv4wVaSRkbbZ4xqQMGfkBDzeQu0Q3cI66dwJxpLZ9aOjhau3giaWrXrOqRAkasa069lmCDIxhNLVh8PlqjKjXg1WMD+zs+gGELIJI6oS4cciS5a5SlPBmN\/Hu5fbsNp2QkQJXZwsf6h9BVbJnZSGJ6GFG9bLQuTdcCa\/rAgam66cNzxzHsZ3IqbofMIbb+ABPeRbfD6mDYgfoHsQw+OyjtwkEW7j0\/nii0kP5X+PhAKAGP93MvNj+N2MEIE1ibWo4THI4RB0zVT3Du6\/7AEGF8hxvBMd2qaSRACA"} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":247,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224441950000,"flow_dst_last_pkt_time":1657224441938000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":144,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":286,"flow_dst_tot_l4_payload_len":2382,"midstream":0,"thread_ts_usec":1657224500057000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":247,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224319898000,"flow_src_last_pkt_time":1657224321133000,"flow_dst_last_pkt_time":1657224321140000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":288,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1793,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224500057000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62379,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00913{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":247,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224379899000,"flow_src_last_pkt_time":1657224380077000,"flow_dst_last_pkt_time":1657224380154000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":168,"flow_dst_tot_l4_payload_len":469,"midstream":0,"thread_ts_usec":1657224500057000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62844,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":247,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224559899000,"flow_src_last_pkt_time":1657224559899000,"flow_dst_last_pkt_time":1657224559899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224559899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57764,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":247,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_src_last_pkt_time":1657224559899000,"flow_dst_last_pkt_time":1657224559899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224559899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm39kAAH8Rkd3AqAJkQhbEreGkw1QAUqgOAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO0c="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":248,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_src_last_pkt_time":1657224559899000,"flow_dst_last_pkt_time":1657224559927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224559927000,"pkt":"YDjgxTWgeJS0JASgCABFAABm8X5AADoRhThCFsStwKgCZMNU4aQAUp2GAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4aQ="} @@ -143,12 +172,16 @@ 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":249,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":3,"flow_src_last_pkt_time":1657224560099000,"flow_dst_last_pkt_time":1657224559927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224560099000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk39oAAH8Rkh7AqAJkQhbEreGkw1QAEAnOEzfK\/qkAAAA="} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"finished","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1657224319898000,"flow_src_last_pkt_time":1657224321133000,"flow_dst_last_pkt_time":1657224321140000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":288,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1793,"flow_dst_tot_l4_payload_len":1206,"midstream":0,"thread_ts_usec":1657224562254000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62379,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00911{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":21,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224379899000,"flow_src_last_pkt_time":1657224380077000,"flow_dst_last_pkt_time":1657224380154000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":168,"flow_dst_tot_l4_payload_len":469,"midstream":0,"thread_ts_usec":1657224562254000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62844,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224441950000,"flow_dst_last_pkt_time":1657224441938000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":144,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":286,"flow_dst_tot_l4_payload_len":2382,"midstream":0,"thread_ts_usec":1657224562254000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00917{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224499898000,"flow_src_last_pkt_time":1657224500050000,"flow_dst_last_pkt_time":1657224500057000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":306,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2077,"flow_dst_tot_l4_payload_len":1760,"midstream":0,"thread_ts_usec":1657224562254000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61985,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224619899000,"flow_src_last_pkt_time":1657224619899000,"flow_dst_last_pkt_time":1657224619899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224619899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55432,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":262,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_src_last_pkt_time":1657224619899000,"flow_dst_last_pkt_time":1657224619899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224619899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm56YAAH8RihDAqAJkQhbErdiIw1QAUgOLAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6OY="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":263,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_src_last_pkt_time":1657224619899000,"flow_dst_last_pkt_time":1657224619927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224619927000,"pkt":"YDjgxTWgeJS0JASgCABFAABmD0pAADoRZ21CFsStwKgCZMNU2IgAUq++AAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2Ig="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":263,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224619899000,"flow_src_last_pkt_time":1657224619899000,"flow_dst_last_pkt_time":1657224619927000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224619927000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55432,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00849{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":264,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":3,"flow_src_last_pkt_time":1657224619927000,"flow_dst_last_pkt_time":1657224619927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":303,"pkt_l4_len":269,"thread_ts_usec":1657224619927000,"pkt":"eJS0JASgYDjgxTWgCABFAAEh56gAAH8RiVPAqAJkQhbErdiIw1QBDfp2kHhjnDqaOSMAAKzjvt4AAR9D1q197S4+O1nf2+hiGOND4v5pnY+OaQTJTY\/icfO5EWkQwXP13FMlnzGZ5HBujo2OSZO+xDjF7Us7\/JW69zAPDx2LsAQ6LVk0o6xSAx598UcZHM24iGIUqTL1gtt68zzAVF2ybr9vIWtEXWezNKSbBRLYUwVJirqVQSgE+RvkiJrlAGP7UEzXyA44YBoDxuL6F\/+McoA5lFcUqJ\/6KIhULY5D1TE+nUzuQd+0nrJBR9SRPgzRJl0rSgYWbNNpsPkapbZoJTUW7zbMz7qKX5JJaCFki1ShOcgGW9y35EME\/KsYITFhTXL5sn33XDkBslRgUgCA"} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":277,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224559899000,"flow_src_last_pkt_time":1657224561364000,"flow_dst_last_pkt_time":1657224562254000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":475,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2189,"midstream":0,"thread_ts_usec":1657224620135000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57764,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":277,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224441950000,"flow_dst_last_pkt_time":1657224441938000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":144,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":286,"flow_dst_tot_l4_payload_len":2382,"midstream":0,"thread_ts_usec":1657224620135000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00917{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":277,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224499898000,"flow_src_last_pkt_time":1657224500050000,"flow_dst_last_pkt_time":1657224500057000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":306,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2077,"flow_dst_tot_l4_payload_len":1760,"midstream":0,"thread_ts_usec":1657224620135000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61985,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":277,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224679899000,"flow_src_last_pkt_time":1657224679899000,"flow_dst_last_pkt_time":1657224679899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224679899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61060,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":277,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_src_last_pkt_time":1657224679899000,"flow_dst_last_pkt_time":1657224679899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224679899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm7MgAAH8RhO7AqAJkQhbEre6Ew1QAUov\/AAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASnY="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":278,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_src_last_pkt_time":1657224679899000,"flow_dst_last_pkt_time":1657224679924000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224679924000,"pkt":"YDjgxTWgeJS0JASgCABFAABmMgRAADoRRLNCFsStwKgCZMNU7oQAUoPGAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7oQ="} @@ -156,11 +189,15 @@ 00665{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":279,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":3,"flow_src_last_pkt_time":1657224680090000,"flow_dst_last_pkt_time":1657224679924000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":167,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":167,"pkt_l4_len":133,"thread_ts_usec":1657224680090000,"pkt":"eJS0JASgYDjgxTWgCABFAACZ7MkAAH8RhLrAqAJkQhbEre6Ew1QAhTlPkHhojTrGSSMAAKzjvt4AAd5dDOhcWG4JWYxCu9\/96brmRVQIF1yiE0SrYYsZPEe2zBMNBgqz3RRFRzxm4kg3d3RFqthljoLeYwO6hL4GCmmtfqVLI6S6G7fjt8ecdUJTw1yTmU7PoTKhkNjf7ZvSEL6K4OgJ8grodXRXAIA="} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":22,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1657224439898000,"flow_src_last_pkt_time":1657224441950000,"flow_dst_last_pkt_time":1657224441938000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":144,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":286,"flow_dst_tot_l4_payload_len":2382,"midstream":0,"thread_ts_usec":1657224680269000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59891,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00915{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":23,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224499898000,"flow_src_last_pkt_time":1657224500050000,"flow_dst_last_pkt_time":1657224500057000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":306,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":2077,"flow_dst_tot_l4_payload_len":1760,"midstream":0,"thread_ts_usec":1657224680269000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61985,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224619899000,"flow_src_last_pkt_time":1657224620131000,"flow_dst_last_pkt_time":1657224620135000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":302,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3194,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224680269000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55432,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224559899000,"flow_src_last_pkt_time":1657224561364000,"flow_dst_last_pkt_time":1657224562254000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":475,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2189,"midstream":0,"thread_ts_usec":1657224680269000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57764,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224739899000,"flow_src_last_pkt_time":1657224739899000,"flow_dst_last_pkt_time":1657224739899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224739899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63893,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":292,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_src_last_pkt_time":1657224739899000,"flow_dst_last_pkt_time":1657224739899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224739899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm8hAAAH8Rf6bAqAJkQhbErfmVw1QAUvdYAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1As="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":293,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_src_last_pkt_time":1657224739899000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224739929000,"pkt":"YDjgxTWgeJS0JASgCABFAABmVQlAADoRIa5CFsStwKgCZMNU+ZUAUm2kAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+ZU="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":293,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224739899000,"flow_src_last_pkt_time":1657224739899000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224739929000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63893,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00893{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":294,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":3,"flow_src_last_pkt_time":1657224739932000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":339,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":339,"pkt_l4_len":305,"thread_ts_usec":1657224739932000,"pkt":"eJS0JASgYDjgxTWgCABFAAFF8hIAAH8RfsXAqAJkQhbErfmVw1QBMWXykHhtpDryHSMAAKzjvt4AAedsmC5lwsnrXN6vYwrYaOrXP3wTRA0u2YVmnyvJOHEA9wM+g04rb2mKlrk7qh960eRvUUGAKxWMdigIxgEOu9rYx0ArfWH0ZjUAnHtcbS0bEv2bZVfAufpGWcO6IsGN27YtkN95RP73BgLFqpz3DmiVs52rK4+yVQev1THLNBijkgwv2+gOzN3qhAuCM+fzveauFHKdNSdmKTWGDEMpOdXZuzNtIG+BF45e8u6Lz7AJGkoeKvk+BJNljddJaORcOYMbW0OUi4OCxD8EdsQWIC8\/UAK+HQHMbrLb36XxRxYBVUswrssmcO08c+ruZJDCkZxxUnhAADZBeFP7lw+KF5YKZ+gjVs06o16+PPLUAm00mnAvhomwXACA"} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":307,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224679899000,"flow_src_last_pkt_time":1657224680269000,"flow_dst_last_pkt_time":1657224680139000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":293,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":2527,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224740128000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61060,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":307,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224619899000,"flow_src_last_pkt_time":1657224620131000,"flow_dst_last_pkt_time":1657224620135000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":302,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3194,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224740128000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55432,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":307,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224559899000,"flow_src_last_pkt_time":1657224561364000,"flow_dst_last_pkt_time":1657224562254000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":475,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2189,"midstream":0,"thread_ts_usec":1657224740128000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57764,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":307,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224799899000,"flow_src_last_pkt_time":1657224799899000,"flow_dst_last_pkt_time":1657224799899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224799899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52323,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":307,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_src_last_pkt_time":1657224799899000,"flow_dst_last_pkt_time":1657224799899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224799899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm9ZcAAH8RfB\/AqAJkQhbErcxjw1QAUgxQAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7EY="} @@ -169,25 +206,33 @@ 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":309,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_src_last_pkt_time":1657224800128000,"flow_dst_last_pkt_time":1657224799933000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224800128000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk9ZgAAH8RfGDAqAJkQhbErcxjw1QAEO8OEzfK\/tkAAAA="} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":25,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224619899000,"flow_src_last_pkt_time":1657224620131000,"flow_dst_last_pkt_time":1657224620135000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":302,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3194,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224800795000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":55432,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":24,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224559899000,"flow_src_last_pkt_time":1657224561364000,"flow_dst_last_pkt_time":1657224562254000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":475,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2189,"midstream":0,"thread_ts_usec":1657224800795000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":57764,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224679899000,"flow_src_last_pkt_time":1657224680269000,"flow_dst_last_pkt_time":1657224680139000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":293,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":2527,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224800795000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61060,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"finished","flow_src_packets_processed":14,"flow_dst_packets_processed":1,"flow_first_seen":1657224739899000,"flow_src_last_pkt_time":1657224740128000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":299,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3296,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224800795000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63893,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224859899000,"flow_src_last_pkt_time":1657224859899000,"flow_dst_last_pkt_time":1657224859899000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224859899000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58753,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_src_last_pkt_time":1657224859899000,"flow_dst_last_pkt_time":1657224859899000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224859899000,"pkt":"eJS0JASgYDjgxTWgCABFAABm98QAAH8RefLAqAJkQhbEreWBw1QAUhFZAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzh8="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_src_last_pkt_time":1657224859899000,"flow_dst_last_pkt_time":1657224859927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224859927000,"pkt":"YDjgxTWgeJS0JASgCABFAABmmf5AADoR3LhCFsStwKgCZMNU5YEAUpXMAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5YE="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":323,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224859899000,"flow_src_last_pkt_time":1657224859899000,"flow_dst_last_pkt_time":1657224859927000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224859927000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58753,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":3,"flow_src_last_pkt_time":1657224860136000,"flow_dst_last_pkt_time":1657224859927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224860136000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk98UAAH8RejPAqAJkQhbEreWBw1QAEMnwEzfK\/uUAAAA="} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":13,"flow_dst_packets_processed":2,"flow_first_seen":1657224679899000,"flow_src_last_pkt_time":1657224680269000,"flow_dst_last_pkt_time":1657224680139000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":293,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":2527,"flow_dst_tot_l4_payload_len":82,"midstream":0,"thread_ts_usec":1657224860617000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":61060,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} -00565{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","packets-captured":337,"packets-processed":336,"total-skipped-flows":0,"total-l4-payload-len":67619,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":29,"total-detection-updates":2,"total-updates":7,"current-active-flows":3,"total-active-flows":29,"total-idle-flows":26,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":178,"global_ts_usec":1657224919900000} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"finished","flow_src_packets_processed":14,"flow_dst_packets_processed":1,"flow_first_seen":1657224739899000,"flow_src_last_pkt_time":1657224740128000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":299,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3296,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224860617000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63893,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224799899000,"flow_src_last_pkt_time":1657224800581000,"flow_dst_last_pkt_time":1657224800795000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":301,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2902,"midstream":0,"thread_ts_usec":1657224860617000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52323,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00566{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","packets-captured":337,"packets-processed":336,"total-skipped-flows":0,"total-l4-payload-len":67619,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":29,"total-detection-updates":2,"total-updates":48,"current-active-flows":3,"total-active-flows":29,"total-idle-flows":26,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":219,"global_ts_usec":1657224919900000} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224919900000,"flow_src_last_pkt_time":1657224919900000,"flow_dst_last_pkt_time":1657224919900000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224919900000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":65053,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":337,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_src_last_pkt_time":1657224919900000,"flow_dst_last_pkt_time":1657224919900000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224919900000,"pkt":"eJS0JASgYDjgxTWgCABFAABm+q8AAH8RdwfAqAJkQhbErf4dw1QAUjxpAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAinM="} 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":338,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":2,"flow_src_last_pkt_time":1657224919900000,"flow_dst_last_pkt_time":1657224919927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224919927000,"pkt":"YDjgxTWgeJS0JASgCABFAABmvT9AADoRuXdCFsStwKgCZMNU\/h0AUmSUAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\/h0="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":338,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224919900000,"flow_src_last_pkt_time":1657224919900000,"flow_dst_last_pkt_time":1657224919927000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224919927000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":65053,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":339,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":3,"flow_src_last_pkt_time":1657224920142000,"flow_dst_last_pkt_time":1657224919927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224920142000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk+rAAAH8Rd0jAqAJkQhbErf4dw1QAEKVUEzfK\/vEAAAA="} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":352,"source":"discord.pcap","alias":"nDPId-test","flow_id":27,"flow_state":"finished","flow_src_packets_processed":14,"flow_dst_packets_processed":1,"flow_first_seen":1657224739899000,"flow_src_last_pkt_time":1657224740128000,"flow_dst_last_pkt_time":1657224739929000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":299,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":3296,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224920512000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":63893,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":352,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224799899000,"flow_src_last_pkt_time":1657224800581000,"flow_dst_last_pkt_time":1657224800795000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":301,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2902,"midstream":0,"thread_ts_usec":1657224920512000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52323,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":352,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224859899000,"flow_src_last_pkt_time":1657224860609000,"flow_dst_last_pkt_time":1657224860617000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":263,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":1121,"flow_dst_tot_l4_payload_len":297,"midstream":0,"thread_ts_usec":1657224920512000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58753,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":352,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657224979900000,"flow_src_last_pkt_time":1657224979900000,"flow_dst_last_pkt_time":1657224979900000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657224979900000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":49648,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":352,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_src_last_pkt_time":1657224979900000,"flow_dst_last_pkt_time":1657224979900000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224979900000,"pkt":"eJS0JASgYDjgxTWgCABFAABm\/wcAAH8Rcq\/AqAJkQhbErcHww1QAUrYnAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATOI="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":353,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_src_last_pkt_time":1657224979900000,"flow_dst_last_pkt_time":1657224979927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657224979927000,"pkt":"YDjgxTWgeJS0JASgCABFAABm3epAADoRmMxCFsStwKgCZMNUwfAAUtzuAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwfA="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":353,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657224979900000,"flow_src_last_pkt_time":1657224979900000,"flow_dst_last_pkt_time":1657224979927000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657224979927000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":49648,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00507{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":354,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":3,"flow_src_last_pkt_time":1657224980146000,"flow_dst_last_pkt_time":1657224979927000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657224980146000,"pkt":"eJS0JASgYDjgxTWgCABFAAAk\/wgAAH8RcvDAqAJkQhbErcHww1QAENWBEzfK\/v0AAAA="} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":367,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224919900000,"flow_src_last_pkt_time":1657224920293000,"flow_dst_last_pkt_time":1657224920512000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":406,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2934,"midstream":0,"thread_ts_usec":1657224980595000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":65053,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":367,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224799899000,"flow_src_last_pkt_time":1657224800581000,"flow_dst_last_pkt_time":1657224800795000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":301,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2902,"midstream":0,"thread_ts_usec":1657224980595000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52323,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00914{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":367,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224859899000,"flow_src_last_pkt_time":1657224860609000,"flow_dst_last_pkt_time":1657224860617000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":263,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":1121,"flow_dst_tot_l4_payload_len":297,"midstream":0,"thread_ts_usec":1657224980595000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58753,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":367,"source":"discord.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657225039901000,"flow_src_last_pkt_time":1657225039901000,"flow_dst_last_pkt_time":1657225039901000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657225039901000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":54950,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":367,"source":"discord.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_src_last_pkt_time":1657225039901000,"flow_dst_last_pkt_time":1657225039901000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225039901000,"pkt":"eJS0JASgYDjgxTWgCABFAABmAvMAAH8RbsTAqAJkQhbErdamw1QAUseRAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJsI="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":368,"source":"discord.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":2,"flow_src_last_pkt_time":1657225039901000,"flow_dst_last_pkt_time":1657225039928000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225039928000,"pkt":"YDjgxTWgeJS0JASgCABFAABmAAFAADoRdrZCFsStwKgCZMNU1qYAUrOCAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1qY="} @@ -195,12 +240,16 @@ 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":369,"source":"discord.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":3,"flow_src_last_pkt_time":1657225040150000,"flow_dst_last_pkt_time":1657225039928000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657225040150000,"pkt":"eJS0JASgYDjgxTWgCABFAAAkAvQAAH8RbwXAqAJkQhbErdamw1QAELTLEzfK\/gkBAAA="} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224799899000,"flow_src_last_pkt_time":1657224800581000,"flow_dst_last_pkt_time":1657224800795000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":301,"flow_src_tot_l4_payload_len":134,"flow_dst_tot_l4_payload_len":2902,"midstream":0,"thread_ts_usec":1657225041016000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":52323,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":29,"flow_state":"finished","flow_src_packets_processed":8,"flow_dst_packets_processed":7,"flow_first_seen":1657224859899000,"flow_src_last_pkt_time":1657224860609000,"flow_dst_last_pkt_time":1657224860617000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":263,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":1121,"flow_dst_tot_l4_payload_len":297,"midstream":0,"thread_ts_usec":1657225041016000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":58753,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224919900000,"flow_src_last_pkt_time":1657224920293000,"flow_dst_last_pkt_time":1657224920512000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":406,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2934,"midstream":0,"thread_ts_usec":1657225041016000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":65053,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657224979900000,"flow_src_last_pkt_time":1657224980585000,"flow_dst_last_pkt_time":1657224980595000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":276,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1122,"flow_dst_tot_l4_payload_len":1292,"midstream":0,"thread_ts_usec":1657225041016000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":49648,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657225099902000,"flow_src_last_pkt_time":1657225099902000,"flow_dst_last_pkt_time":1657225099902000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657225099902000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59240,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_src_last_pkt_time":1657225099902000,"flow_dst_last_pkt_time":1657225099902000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225099902000,"pkt":"eJS0JASgYDjgxTWgCABFAABmBsYAAH8RavHAqAJkQhbEredow1QAUk7YAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjrk="} 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_src_last_pkt_time":1657225099902000,"flow_dst_last_pkt_time":1657225099941000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225099941000,"pkt":"YDjgxTWgeJS0JASgCABFAABmIr1AADoRU\/pCFsStwKgCZMNU52gAUpH+AAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA52g="} 00911{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":383,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":1,"flow_first_seen":1657225099902000,"flow_src_last_pkt_time":1657225099902000,"flow_dst_last_pkt_time":1657225099941000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657225099941000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59240,"dst_port":50004,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative","discord": {"client_ip":"84.59.132.100"}}} 00506{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":384,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":3,"flow_src_last_pkt_time":1657225100156000,"flow_dst_last_pkt_time":1657225099941000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":50,"pkt_l4_len":16,"thread_ts_usec":1657225100156000,"pkt":"eJS0JASgYDjgxTWgCABFAAAkBscAAH8RazLAqAJkQhbEredow1QAEJgJEzfK\/hUBAAA="} 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":397,"source":"discord.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657224919900000,"flow_src_last_pkt_time":1657224920293000,"flow_dst_last_pkt_time":1657224920512000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":406,"flow_src_tot_l4_payload_len":110,"flow_dst_tot_l4_payload_len":2934,"midstream":0,"thread_ts_usec":1657225101610000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":65053,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00915{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":397,"source":"discord.pcap","alias":"nDPId-test","flow_id":32,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657225039901000,"flow_src_last_pkt_time":1657225040816000,"flow_dst_last_pkt_time":1657225041016000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2662,"midstream":0,"thread_ts_usec":1657225101610000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":54950,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} +00916{"flow_event_id":4,"flow_event_name":"update","thread_id":0,"packet_id":397,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657224979900000,"flow_src_last_pkt_time":1657224980585000,"flow_dst_last_pkt_time":1657224980595000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":276,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1122,"flow_dst_tot_l4_payload_len":1292,"midstream":0,"thread_ts_usec":1657225101610000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":49648,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00760{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":397,"source":"discord.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1657225159904000,"flow_src_last_pkt_time":1657225159904000,"flow_dst_last_pkt_time":1657225159904000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":74,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":74,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1657225159904000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62481,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":397,"source":"discord.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_src_last_pkt_time":1657225159904000,"flow_dst_last_pkt_time":1657225159904000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225159904000,"pkt":"eJS0JASgYDjgxTWgCABFAABmDKkAAH8RZQ7AqAJkQhbErfQRw1QAUvoVAAEARgAArOMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1tI="} 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":398,"source":"discord.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":2,"flow_src_last_pkt_time":1657225159904000,"flow_dst_last_pkt_time":1657225159930000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"thread_ts_usec":1657225159930000,"pkt":"YDjgxTWgeJS0JASgCABFAABmRMtAADoRMexCFsStwKgCZMNU9BEAUnisAAIARgAArOM4NC41OS4xMzIuMTAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9BE="} @@ -210,7 +259,7 @@ 00913{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":411,"source":"discord.pcap","alias":"nDPId-test","flow_id":33,"flow_state":"finished","flow_src_packets_processed":3,"flow_dst_packets_processed":12,"flow_first_seen":1657225099902000,"flow_src_last_pkt_time":1657225101391000,"flow_dst_last_pkt_time":1657225101610000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":74,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":142,"flow_dst_tot_l4_payload_len":2892,"midstream":0,"thread_ts_usec":1657225160168000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":59240,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00914{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":411,"source":"discord.pcap","alias":"nDPId-test","flow_id":31,"flow_state":"finished","flow_src_packets_processed":7,"flow_dst_packets_processed":8,"flow_first_seen":1657224979900000,"flow_src_last_pkt_time":1657224980585000,"flow_dst_last_pkt_time":1657224980595000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":276,"flow_dst_max_l4_payload_len":281,"flow_src_tot_l4_payload_len":1122,"flow_dst_tot_l4_payload_len":1292,"midstream":0,"thread_ts_usec":1657225160168000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":49648,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} 00912{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":411,"source":"discord.pcap","alias":"nDPId-test","flow_id":34,"flow_state":"finished","flow_src_packets_processed":14,"flow_dst_packets_processed":1,"flow_first_seen":1657225159904000,"flow_src_last_pkt_time":1657225160168000,"flow_dst_last_pkt_time":1657225159930000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":8,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":288,"flow_dst_max_l4_payload_len":74,"flow_src_tot_l4_payload_len":1771,"flow_dst_tot_l4_payload_len":74,"midstream":0,"thread_ts_usec":1657225160168000,"l3_proto":"ip4","src_ip":"192.168.2.100","dst_ip":"66.22.196.173","src_port":62481,"dst_port":50004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"Discord","proto_id":"58","encrypted":1,"breed":"Fun","category_id":15,"category":"Collaborative"}} -00567{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":411,"source":"discord.pcap","alias":"nDPId-test","packets-captured":411,"packets-processed":411,"total-skipped-flows":0,"total-l4-payload-len":80760,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":34,"total-detection-updates":2,"total-updates":8,"current-active-flows":0,"total-active-flows":34,"total-idle-flows":34,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":213,"global_ts_usec":1657225160168000} +00568{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":411,"source":"discord.pcap","alias":"nDPId-test","packets-captured":411,"packets-processed":411,"total-skipped-flows":0,"total-l4-payload-len":80760,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":34,"total-detection-updates":2,"total-updates":57,"current-active-flows":0,"total-active-flows":34,"total-idle-flows":34,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":262,"global_ts_usec":1657225160168000} ~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~ ~~ packets captured/processed: 411/411 ~~ skipped flows.............: 0 @@ -223,6 +272,6 @@ ~~ total memory freed........: 6124064 bytes ~~ total allocations/frees...: 122306/122306 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -~~ json string min len.......: 478 chars +~~ json string min len.......: 492 chars ~~ json string max len.......: 1890 chars -~~ json string avg len.......: 1184 chars +~~ json string avg len.......: 1191 chars |