1 files changed, 7 insertions, 7 deletions
diff --git a/test/results/wa_voice.pcap.out b/test/results/wa_voice.pcap.out
index e4d4a4a67..d417dd2f4 100644
--- a/test/results/wa_voice.pcap.out
+++ b/test/results/wa_voice.pcap.out
@@ -38,18 +38,18 @@
 02305{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455689,"pkt_ts_usec":217298,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"pkt":"kLkxKPrKxiwDYGpkCABFAAWgcQQAAFMGfHqd8BQ1wKgCDBRmwMsu6Csam9EL2oAQAHGDJAAAAQEICh59Q9g0zfN0j00kD7SW47vpxLkGozFihiVHS84IOEIZ4S8w+pvhkI4\/BVPnMsu7keXoL493PG4Jl94mip3ZYMBXk0tzcxBsugkacLva6p+\/l9Ai4U77Xu7ts\/uFMCxxoRjCgcN\/3abOTw7N\/kRx+RhOrYwoq8rRMCqlUvDBqFAj10JdY6DJhmvLJlse2k9rMuixA3LoDW2+YSjX6RE0TOsMgivknvp8OpgqixA9QfIZ29RNEZJHEfRHvv8WUGRGI4DC5QUbOAmvnrpUWSwma3mVGFQT84CFlrEXLA1PMEMSRVDLOunbvTbivqIQkojlxXim7s8ZS07plo6AFOBloQ8gVaqHhZF6Wn4CIYkFuQUNvSDxEOypAKKhj7H4kMiZJ1UQ2Z1fxcys83bOxOj7emx2V3aeoIGT0\/ueprJ5LcJSQMZpEAnaDnQc\/VaEFzRb971FV8zqAkJSYizTV5x+JUvvy9xXIMqn\/3fQbQUmv4v1w3Slrt6EpOUdN8P50D34oF6OYFbUkFztGvx+Shr2reNIJIEbqzscAMhZ2n\/wNndDVNqvuB2sj6lsd07u17prEMI7kSFMn0DTi1FACMEvfe5Mb74VlY\/HNTVinIWOkse32EgSfpXV8cbvDOkZe5ZKJG69923K5xLmUKXpYyIvkR3e7JoSITZuahaMUANfyBSFxEokn67s+ECk\/ssch+u5bfqsg3XvCKFAFnx5tivzoDbhvvAl6INch9X1rAEZNcqHBqiwJPFMMVj39syFXYg8dDE35EtV11JaMuM9FtN5HnKSF4YcmhkWAYGjUNKDcQgs6E4NESJzNqtaW3VxC1mVGieihYnQ6HmR29huWMyF9qLObApw9iuMne4NWo4W0B51AN95npmBmaYCoSYfn7BHgFHCbeoLN7NM5NbbLQ5kTIq93TvZr8e67pIeNREdh0OcCN52mIP4nRNZQjGCVNXsE9odeo1mGqr\/rl5+KrQ9Fgt66Epj918esPteMZ6ztV4ajtwc7YhiTc8EuPiCZ0DbE038c\/5ImCKaqpahBsfMxcUkfridm6dlIJiaPiAAh5+7f7ntavun4Aeuj2ytX5STanePvtyxDY5DKQ0m6f9hs3Hxqdh+oo9Z7+ITcmY6SofZV0f0ej7sl5bIs9O\/C00CyTNx8MQe6eFgNRlolcqu3cJn87m8x08H38tnSMCc9lsuy6L2TE4n4II04VpSQEMolCII0BykjN0hVcPtnS4uZbNoM1dKUe5BHJCEyf7GIRAQcaWVbF00l4X1Yu5UKSH1yu1Obp\/JbUj6ZnkFex7ND8w48lrhUDw1GlTVmz7NuOpUCUDBmT7uMEhSVqRa5LuFo9CYd9NqVKjYECe\/yRfzlPI6SZISdWYrnJJRnwZp0poUQXGqh1PxRg3bQOIbU3aPQcTT2RCPoX5y975\/oAwgg2TgwXxg4+MVnSNPx3gCTFs5rKEG6tDM4Xbedl6ZvM5XFhTMBrR8gylJ4twI+PoHkmduAYJ\/UVs4dj65UpqTL1cHtHWLBf2jbHf\/YrCZNOqmXzvYO40AizTV9byTfAD5L161bjeZqzsDx2o1lW2PKYG5EWF5PWID9lrCAsFRKv4Z7wYt3hImKywE5DnXEMGUI581vp4PffKxbeKo2RCqkRbN1RmtrhJwenM\/hA3eh3E\/xoIbjklGRJGA1z7qu4SA3wwLGY+nY8WK2fss\/TARdobk2Lz2kQ7qC5Vp2ZddP3r0IVPwYZC+Wk5uW8ih0NTcDqxvrTop7lT3Xkt2eiwRqtM4oUK85X8A4+ZllM8ua+hFMrxd+oXnn8x75LXgHrSoF7NZqCgjN0ML7ajRMGVHnkkJQnvnPiHe1oIQYUdjaPOUG1tMaio="}
 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":60,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1561455689728,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
 00456{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455689,"pkt_ts_usec":728258,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"xiwDYGpkkLkxKPrKCABFAABL058AAP8RYqTAqAIMwKgCAdgAADUAN5FDM2kBAAABAAAAAAAADG1lZGlhLW14cDEtMQNjZG4Id2hhdHNhcHADbmV0AAABAAE="}
-00665{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":60,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1561455689728,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WhatsApp","breed":"Acceptable","category":"Chat"},"dns": {"query":"media-mxp1-1.cdn.whatsapp.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
+00674{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":60,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1561455689728,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WhatsAppFiles","breed":"Acceptable","category":"Download"},"dns": {"query":"media-mxp1-1.cdn.whatsapp.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
 00478{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455689,"pkt_ts_usec":761023,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"kLkxKPrKxiwDYGpkCABFAABbphoAAEARTxrAqAIBwKgCDAA12AAAR3hsM2mBgAABAAEAAAAADG1lZGlhLW14cDEtMQNjZG4Id2hhdHNhcHADbmV0AAABAAHADAABAAEAAABFAAQfDVYz"}
-00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":61,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1561455689728,"flow_last_seen":1561455689761,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":110,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WhatsApp","breed":"Acceptable","category":"Chat"},"dns": {"query":"media-mxp1-1.cdn.whatsapp.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"31.13.86.51"}}
+00699{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":61,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1561455689728,"flow_last_seen":1561455689761,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":110,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"192.168.2.1","src_port":55296,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WhatsAppFiles","breed":"Acceptable","category":"Download"},"dns": {"query":"media-mxp1-1.cdn.whatsapp.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"31.13.86.51"}}
 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":64,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1561455689909,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
 00442{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455689,"pkt_ts_usec":909150,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkkLkxKPrKCABFAABAAABAAEAGAsTAqAIMHw1WM8VHAbtOnG1kAAAAALDC\/\/9BlgAAAgQFtAEDAwcBAQgKNM4E3wAAAAAEAgAA"}
 00436{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455689,"pkt_ts_usec":928899,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"kLkxKPrKxiwDYGpkCABFAAA8AAAAAFQGLsgfDVYzwKgCDAG7xUfuAwj8TpxtZaASbHDC9wAAAgQFeAQCCAqHqaVzNM4E3wEDAwg="}
 00424{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":36803,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkkLkxKPrKCABFAAA0AABAAEAGAtDAqAIMHw1WM8VHAbtOnG1l7gMI\/YAQBAZZdQAAAQEICjTOBV2HqaVz"}
 01121{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":39586,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkkLkxKPrKCABFAAI5AABAAEAGAMvAqAIMHw1WM8VHAbtOnG1l7gMI\/YAYBAYvJwAAAQEICjTOBWCHqaVzFgMBAgABAAH8AwNcVCo+6ckxRamHLuTFRhM635aj8rPn5Xsyc8oyNs70zCDheIsHXcZUiMjn0WFeVyeYgqZCpFf+j0FPaajeZJof+QA0EwMTARMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqACdAJwAPQA8ADUAL8AIwBIACgEAAX\/\/AQABAAAAACIAIAAAHW1lZGlhLW14cDEtMS5jZG4ud2hhdHNhcHAubmV0ABcAAAAjAAAADQAYABYEAwgEBAEFAwIDCAUIBQUBCAYGAQIBAAUABQEAAAAAM3QAAAASAAAAEAAwAC4CaDIFaDItMTYFaDItMTUFaDItMTQIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xAAsAAgEAADMAJgAkAB0AIGUBEpxLHOCHLdBePKDwToeE+eWXh1GjpLqsIp7hpBQmAC0AAgEBACsACQgDBAMDAwIDAQAKAAoACAAdABcAGAAZABUAlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
-00846{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":67,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1561455689909,"flow_last_seen":1561455690039,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsApp","breed":"Acceptable","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"media-mxp1-1.cdn.whatsapp.net","ja3":"b92a79ed03c3ff5611abb2305370d3e3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
+00855{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":67,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1561455689909,"flow_last_seen":1561455690039,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download"},"tls": {"version":"TLSv1.2","client_requested_server_name":"media-mxp1-1.cdn.whatsapp.net","ja3":"b92a79ed03c3ff5611abb2305370d3e3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
 00423{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":55150,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"kLkxKPrKxiwDYGpkCABFAAA0CsgAAFQGJAgfDVYzwKgCDAG7xUfuAwj9TpxvaoAQAHFafgAAAQEICoeppfc0zgVg"}
 02313{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":58075,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"pkt":"kLkxKPrKxiwDYGpkCABFAAWgCskAAFQGHpsfDVYzwKgCDAG7xUfuAwj9TpxvaoAQAHGU7wAAAQEICoeppfg0zgVgFgMDAHoCAAB2AwOjzyNHQjOpVvgAif\/8F5WB9m2U0scKnow2LScA2\/aVYiDheIsHXcZUiMjn0WFeVyeYgqZCpFf+j0FPaajeZJof+RMDAAAuACsAAgMEADMAJAAdACA5nxEHCn05\/Ye07pEajb+KCDvivuQkVTABzhNxH4pZLRQDAwABARcDAwP5obHjPldjOIylS0+Xwpe8NgBs43eBM3dIxITUTfptTDNiEB5Eq0rvnM+mOfPCdmgTgQTBzQK8hpmmqbe7NdS62S\/ZuugNetE6eL3lk3qguCRroXHIbV1vyR6JjglAciF4rrgEGkTOFdS1Oh85ZPwfZlJtXJnCnXkOfnwaFTtqIp2vSs887u2XmX5mcidKKal5aNyYWhETi63K9AOOkIQOqicaNIul5dEK6cCF5UMqRtDujk6NZzq7IwbqWADmhPMvnSM7A2l+EOSR0CaMazr82cComYDqc1PUsHe2I1niKsnT0m1bV13AzR+EvM8m0OxMD4lFOtzeiDXkenrkqREyOTi4MlfsrYptn9wRYRV+e63xQXaxh+dVdNVyHXfTD0qsdTX3wHgFwQl3oM6OXEaiyYn+KgXcXwq0ethdNrg08BJH\/8vapxF09PyDshSzAEpTXcEPu+GTbmZnoxjzvnDD18Zw26PohkmdbrlVfCBfPion7RT7C+Kb5UvF05Md5Tyv88FUdj\/VqRuFeEEnHphi\/R49yNc14nHYu4RN+XtOOSCmOwRK\/KBE5LZyV531wsNioyG+mpgfGatM7Tej\/w9lMWDYNl3p48MnFtX4IuCPpJtMt\/7NFVU2KyGybpb+cZXqPqee513o3Bp9uklsEM5Q02zzFMJMLBg8mewlDo+FbF5rjsLV2ebsrguXxpBNl3oHzU5n0lCR1wfayg9+yOdAiAWQ3Oys+AIICdmYtvasLN34LcCjcQD9YHzCzMirdSNF4OcXEtYeyMM5Sy6evWRISUbSiY6nQwyWBkw6bzxYYMb9lWVJNgEdfPpmxhjWDLantpJHGf1ojh8wQGIpRye3GHuhLaMEMVQZ4qbSOgvfn0nY\/CBysFxH7B1Ar3mwKcbisTwK8XJi8AK6+V+r\/\/vPWyG46iraQ7EEr0NABdn16L73zC3c4rUFcGCo3yv6nej46D3DVlZkcihybI8h+tLCp6b1ECWUVmYlINnm0Fxjv\/Rzo1yvYAfLRkl5wor8XK2Fz5nPTdPjLUTFI0X8tPfMr4lQEtr1lsx1uySK500IMrHApEofGX\/hBQdjjXSkQKDb+qcTK7sscfs5Dw5Td9blyzSb6ZftirLtqGt3+4r6Rk7H5mZPRCA0zEuJVUfsoBZY1WnrFNH7JTqWV61uqG1Rg44Yb\/dIwgoql8PDUAeyOTqxTSxsdG5duuR08zKsMhbg9mG2\/yjO7ZaSI9pXuKQqr3PlVwkcZ5\/c+b\/ZY5rbF0DFyRYf+Ya8itNTAp7GZ\/aoxoaK3dQTdA7C6++KMGOuUIeHq6Xpbi\/VSGaTsxQzLetZ0O0VmkUlLT\/RMxfq23QQiWbaeODe9tr3FwMDBe07gSGdhQaI9CSMCNgrecYRo\/+ZQun\/P9l3D4+KLQd\/am5Ukve96RSjpiSxrXHOZDo3MzLFr6eCZenso+tx\/kuRg\/tO6gWleSWfkYD+wyNSXegvt8V\/PxoE9wLtK\/z0QA49nDoK8NElxDHqwqsW7Jct5rqMts\/tuZB4W4+Qwj8h86gLJMpfkBGXRUSFmoixhMPOSOMNmJsNYZA4acZu7dCF\/7UJji6XAk2j1GNbkwpRxJMZ3aXKUN9svBHzCf6Hjdwq6mcXi5kRMkpqnNoBts\/p043tMsLNIewponpI4qPinwhvNic="}
-00893{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":69,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":6,"flow_first_seen":1561455689909,"flow_last_seen":1561455690058,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":1905,"flow_avg_l4_payload_len":317,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsApp","breed":"Acceptable","category":"Chat"},"tls": {"version":"TLSv1.3","client_requested_server_name":"media-mxp1-1.cdn.whatsapp.net","ja3":"b92a79ed03c3ff5611abb2305370d3e3","ja3s":"475c9302dc42b2751db9edcac3b74891","unsafe_cipher":0,"cipher":"TLS_CHACHA20_POLY1305_SHA256","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
+00902{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":69,"source":"wa_voice.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":6,"flow_first_seen":1561455689909,"flow_last_seen":1561455690058,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":1905,"flow_avg_l4_payload_len":317,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.12","dst_ip":"31.13.86.51","src_port":50503,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download"},"tls": {"version":"TLSv1.3","client_requested_server_name":"media-mxp1-1.cdn.whatsapp.net","ja3":"b92a79ed03c3ff5611abb2305370d3e3","ja3s":"475c9302dc42b2751db9edcac3b74891","unsafe_cipher":0,"cipher":"TLS_CHACHA20_POLY1305_SHA256","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
 02324{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":58103,"pkt_caplen":1454,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1454,"pkt_l4_len":1420,"pkt":"kLkxKPrKxiwDYGpkCABFAAWgCsoAAFQGHpofDVYzwKgCDAG7xUfuAw5pTpxvaoAQAHFX\/QAAAQEICoeppfg0zgVgspFXKOJvplc45DT7iGl7Njpc0oTgqks\/uNS1ZxTmPU\/OA5ByiKjgw3vzNjwDnElCorze7ZipusLc9IlzS62vjRQ1ICsULZ3htyVo9kVh7cyjID5Usi1jTmHBqTUwDiE8zgmSu3MR9zmMn0xcZ8U+NhvXnbzdG6qMKlgYTJ4H+HJMPzTo4cABWBWkB8\/nPBVh0qm30TrAKyUqoS5ls8jrMnHRdCiIuEGO0hQFLRR2UaMXtbHVyZin3TzybUi8V29MOuKqS+vna6wGjhfwmUdat89PvcXgB1KuttQzVf7I9U6RpMzHbH0vqemFj\/Lmh+HcIUlgxcfSSqFvNzO0vzsCg2ARyZW2FdS17wr3Ev0GlrKc\/yvBquaOsMeT5\/lqBkWmjxF+6DRKIRBNWcBwasAnIMBog4iqM1OrW9RKHIAxSY6X0d8RC\/5\/vBvGaISxX\/Jt90NwmfUsPLLsvmBUlzoQpGuCPVExNmBJI8oGRigLfQZLaBjvuqm1PWX19xMKzra7JiswFsZQlUnyumGWmU8oXMqSlO51Ybwtk50OoHZKUaHg4hO4a2trUalXPqf08nIkedcneJeUYSCwpq1ovxW2k\/4glOxTjLLZvDhRwNkxLTrnKXgK+\/3mLeTO\/rIT9urW7+yx8GGdgm+PBJVU2Qz+pt8bHdYKh\/ukX+0BomJj\/3wijT3hcmqQy\/0U8SDMRUBmf1eAkrFt\/2YiJRd0Y4rkURIFPsHyu8C\/ZLMFMorEJ50MXKfHKV7cUuMO\/j2eYgQofQbRfhnhx5d2zxsd7uWvsolHCN675HUyIwSeeKf5TiOKWlcKl3Yd4eNIg+K6rCMTShlp\/HoFxnxb1OcnzX\/VGh38eczFKTSUKya0Iln\/NGH5wduacZbQs0fyEUA5sDMcIKlnMqFP+C+z+OZfFpN8a5aTSlwimf785Dwo9yUQY+5IW8WS0+xoCIhZtJ6fImcpp3ATH4Ng+eRWLEGEbhlC9bbh59Wf6WHqSD38PM9by21tKpALia3ssIiGpL52FO6wjunTeA7hDCAKuTk9zNlkNXbyEYNf9kVXov66Ges4GEwfC43qDvFiBr5XYvo+phi1icSx29Crj4G1uYoYPtF\/CIa0VSNqnyzPWNXreWuFWS\/eBki5rrIR5+fI8\/Osuo2Qr+jMf+UQrGdoZG1mcXjpqDwPMLIb\/DsB\/XscnsHVwT64ZhJbqT9cWOkRb0O5rGm3lieuz9U90M7oDH3iNxPPzqeaXIgd\/R1oqIiGMz5CSYJypVtyd5BFwqP7As0h5PHa6HgP+QVuxkQ+vBAaWxsc2UT\/s8zP31s9pqfqCZjtqTfewmTefdrDoS9c3Hh6VCySGlXFknpXxgEFb3CW9uJo9jk4vUWiDvic8oFl02fCs7L12MgSP3iTWPxFMn70Xb6j8MIFuWhRmczYzkg7PUqqoO2nS7vztmLRn5t\/2X+JwzbnETUu616oL2m3s2TI66qrJpeH\/5Sttpp4dcPFRPuGbdcfb5fvHhfaFq5pv2+gW3YXmG7E9bG++YQQ\/dwEDb\/+wB2sNN9SbIOTi1nTzI4S4Vym0AqeRpR27Y6X0WHzgHNr7S+F1Wn3cLReHFmYwNbg\/+nnxMkuJgCn2Aiu\/sI\/5UlITUSYv6iezugS1Pw2\/d9MdQIqd9L9UbbNEAy\/qj6h8t7NZ\/w693yT6Tid5TCcCO1oAN3HJzOhWQCQIwFcCfVpuREc2vjSrS4XAwMBeVLCCyylGbkyr7jZYWgs8CLnAXX6T\/TFTMmVU\/L9xIBnvx+mQhmeANuFYVEfZwfrJ\/Y+J\/GbSOvz1mMH+14iujJAZ9NRphzX7FOGRk2dgKYOZ87CXWaltMvMaO7vmQk="}
 00815{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":58125,"pkt_caplen":349,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":349,"pkt_l4_len":315,"pkt":"kLkxKPrKxiwDYGpkCABFAAFPCssAAFQGIuofDVYzwKgCDAG7xUfuAxPVTpxvaoAYAHFcHAAAAQEICoeppfg0zgVgQ+tPBb7kaYYO+rR6biY\/FBVM+j2A0rn7l59uqzzwyz9IETm4Q4l0DthJst\/l6zOboAPQy9exfAgNfP4EZ\/JbGajAQUBkwZgWHP70oqgcBwGZOYSBtZdU+XnPK1CYTGKoUl\/Yzc05cVrQBp6CrIqx+GBKT+y1i7brTP5WCSjn\/vAJ\/FcB1EuL7kTLeoCNqFHmmSy\/qp\/xoqN4T8\/C9jO+UJF0ToXnckaSMUJB8MnrZLedBkrWQNra3UoTjAL0XqbBCsZHJzlsmm1fHKnLqz12zc2bjAKiYayUlVT+D66uNh0ZY4G5+q9PsIwxKP9+WOWGCQFZk1SIlpakKDWpO8rszSmIytVLOGl04AjQwxLmrghDKqHZj0l2FUMBSQ=="}
 00424{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"wa_voice.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1561455690,"pkt_ts_usec":60632,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkkLkxKPrKCABFAAA0AABAAEAGAtDAqAIMHw1WM8VHAbtOnG9q7gMT1YAQA\/VMDQAAAQEICjTOBXSHqaX4"}
@@ -294,7 +294,7 @@
 ~~ total detected protocols..: 28
 ~~ total active/idle flows...: 30/30
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 3232951 bytes
-~~ total memory freed........: 3232951 bytes
-~~ total allocations/frees...: 34266/34266
+~~ total memory allocated....: 3418430 bytes
+~~ total memory freed........: 3418430 bytes
+~~ total allocations/frees...: 36271/36271
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~