diff options
Diffstat (limited to 'test/results/weibo.pcap.out')
| -rw-r--r-- | test/results/weibo.pcap.out | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/test/results/weibo.pcap.out b/test/results/weibo.pcap.out index e27899ef0..06c1950a0 100644 --- a/test/results/weibo.pcap.out +++ b/test/results/weibo.pcap.out @@ -55,7 +55,7 @@ 00523{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"weibo.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":2,"flow_src_last_pkt_time":1463089072046092,"flow_dst_last_pkt_time":1463089072070732,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1463089072070732,"pkt":"eJKcD6iOkDVu60UQCABFAAA0NhEAADYG4CXYOtRBwKgBaQG7h4sGjBrJ+KmsNoAQAV6y1gAAAQEICiUZAmMAQNzC"} 01146{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":54,"source":"weibo.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":3,"flow_first_seen":1463089071613246,"flow_src_last_pkt_time":1463089071642772,"flow_dst_last_pkt_time":1463089072125117,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":450,"flow_dst_max_l4_payload_len":5,"flow_src_tot_l4_payload_len":450,"flow_dst_tot_l4_payload_len":5,"midstream":0,"thread_ts_usec":1463089072125117,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.137","src_port":51698,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"www.weibo.com","http": {"url":"www.weibo.com\/login.php?lang=en-us","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/50.0.2661.102 Safari\/537.36","detected_os":"Linux x86_64"}}} 00523{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"weibo.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_src_last_pkt_time":1463089071994093,"flow_dst_last_pkt_time":1463089072138578,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1463089072138578,"pkt":"eJKcD6iOkDVu60UQCABFAAA0XohAABsGZHc24aPSwKgBaQG7nfhaPbwDA69SioAQAIjCywAAAQEICgEjLGEAQNyy"} -01354{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":83,"source":"weibo.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089071613246,"flow_src_last_pkt_time":1463089072230888,"flow_dst_last_pkt_time":1463089072285673,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":450,"flow_dst_max_l4_payload_len":2872,"flow_src_tot_l4_payload_len":450,"flow_dst_tot_l4_payload_len":12066,"midstream":0,"thread_ts_usec":1463089072285673,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.137","src_port":51698,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":21,"flow_avg":42248.1,"flow_max":482409,"flow_stddev":112053.9,"c_to_s_min":21,"c_to_s_avg":42469.4,"c_to_s_max":482409,"c_to_s_stddev":115566.9,"s_to_c_min":24,"s_to_c_avg":42026.7,"s_to_c_max":454492,"s_to_c_stddev":108426.7},"pktlen": {"c_to_s_min":66,"c_to_s_avg":103.6,"c_to_s_max":516,"c_to_s_stddev":106.7,"s_to_c_min":66,"s_to_c_avg":820.6,"s_to_c_max":2938,"s_to_c_stddev":832.6}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01354{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":83,"source":"weibo.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089071613246,"flow_src_last_pkt_time":1463089072230888,"flow_dst_last_pkt_time":1463089072285673,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":450,"flow_dst_max_l4_payload_len":2872,"flow_src_tot_l4_payload_len":450,"flow_dst_tot_l4_payload_len":12066,"midstream":0,"thread_ts_usec":1463089072285673,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.137","src_port":51698,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":21,"flow_avg":41615.1,"flow_max":482409,"flow_stddev":113790.6,"c_to_s_min":21,"c_to_s_avg":41176.1,"c_to_s_max":482409,"c_to_s_stddev":119244.9,"s_to_c_min":24,"s_to_c_avg":42026.7,"s_to_c_max":454492,"s_to_c_stddev":108426.7},"pktlen": {"c_to_s_min":66,"c_to_s_avg":103.6,"c_to_s_max":516,"c_to_s_stddev":106.7,"s_to_c_min":66,"s_to_c_avg":820.6,"s_to_c_max":2938,"s_to_c_stddev":832.6}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00753{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":107,"source":"weibo.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089072333305,"flow_src_last_pkt_time":1463089072333305,"flow_dst_last_pkt_time":1463089072333305,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":33,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":33,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":33,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089072333305,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":53543,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"weibo.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_src_last_pkt_time":1463089072333305,"flow_dst_last_pkt_time":1463089072333305,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"thread_ts_usec":1463089072333305,"pkt":"kDVu60UQeJKcD6iOCABFAAA9J7BAAEARj0XAqAFpwKgBAdEnADUAKd+0rc0BAAABAAAAAAAAA2ltZwF0BnNpbmFqcwJjbgAAAQAB"} 01005{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":107,"source":"weibo.pcap","alias":"nDPId-test","flow_id":15,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089072333305,"flow_src_last_pkt_time":1463089072333305,"flow_dst_last_pkt_time":1463089072333305,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":33,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":33,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":33,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089072333305,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":53543,"dst_port":53,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Sina(Weibo)","proto_id":"5.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"img.t.sinajs.cn","dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}} @@ -79,8 +79,8 @@ 00753{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"weibo.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089072885992,"flow_src_last_pkt_time":1463089072885992,"flow_dst_last_pkt_time":1463089072885992,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":32,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":32,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":32,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089072885992,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":41352,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"weibo.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_src_last_pkt_time":1463089072885992,"flow_dst_last_pkt_time":1463089072885992,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1463089072885992,"pkt":"kDVu60UQeJKcD6iOCABFAAA8J\/lAAEARjv3AqAFpwKgBAaGIADUAKAcnK+gBAAABAAAAAAAAAmpzAXQGc2luYWpzAmNuAAABAAE="} 01004{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":175,"source":"weibo.pcap","alias":"nDPId-test","flow_id":19,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089072885992,"flow_src_last_pkt_time":1463089072885992,"flow_dst_last_pkt_time":1463089072885992,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":32,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":32,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":32,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089072885992,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":41352,"dst_port":53,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Sina(Weibo)","proto_id":"5.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"js.t.sinajs.cn","dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}} -01352{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":202,"source":"weibo.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445053,"flow_src_last_pkt_time":1463089073026834,"flow_dst_last_pkt_time":1463089073029617,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":432,"flow_dst_max_l4_payload_len":2872,"flow_src_tot_l4_payload_len":432,"flow_dst_tot_l4_payload_len":20099,"midstream":0,"thread_ts_usec":1463089073029617,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35804,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":38,"flow_avg":39940.4,"flow_max":314329,"flow_stddev":71573.7,"c_to_s_min":38,"c_to_s_avg":43345.6,"c_to_s_max":314329,"c_to_s_stddev":76030.7,"s_to_c_min":59,"s_to_c_avg":36535.2,"s_to_c_max":283150,"s_to_c_stddev":66646.3},"pktlen": {"c_to_s_min":66,"c_to_s_avg":98.8,"c_to_s_max":498,"c_to_s_stddev":103.2,"s_to_c_min":66,"s_to_c_avg":1322.7,"s_to_c_max":2938,"s_to_c_stddev":789.1}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -01357{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":218,"source":"weibo.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445019,"flow_src_last_pkt_time":1463089073075846,"flow_dst_last_pkt_time":1463089073079547,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":420,"flow_dst_max_l4_payload_len":4308,"flow_src_tot_l4_payload_len":420,"flow_dst_tot_l4_payload_len":24521,"midstream":0,"thread_ts_usec":1463089073079547,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35803,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":151,"flow_avg":43033.4,"flow_max":400547,"flow_stddev":92172.9,"c_to_s_min":151,"c_to_s_avg":46408.8,"c_to_s_max":400547,"c_to_s_stddev":96112.0,"s_to_c_min":2804,"s_to_c_avg":39658.0,"s_to_c_max":372448,"s_to_c_stddev":87928.4},"pktlen": {"c_to_s_min":66,"c_to_s_avg":96.5,"c_to_s_max":486,"c_to_s_stddev":100.7,"s_to_c_min":66,"s_to_c_avg":1599.1,"s_to_c_max":4374,"s_to_c_stddev":1251.4}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01352{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":202,"source":"weibo.pcap","alias":"nDPId-test","flow_id":17,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445053,"flow_src_last_pkt_time":1463089073026834,"flow_dst_last_pkt_time":1463089073029617,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":432,"flow_dst_max_l4_payload_len":2872,"flow_src_tot_l4_payload_len":432,"flow_dst_tot_l4_payload_len":20099,"midstream":0,"thread_ts_usec":1463089073029617,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35804,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":38,"flow_avg":37624.0,"flow_max":314329,"flow_stddev":71528.6,"c_to_s_min":38,"c_to_s_avg":38785.4,"c_to_s_max":314329,"c_to_s_stddev":76376.2,"s_to_c_min":59,"s_to_c_avg":36535.2,"s_to_c_max":283150,"s_to_c_stddev":66646.3},"pktlen": {"c_to_s_min":66,"c_to_s_avg":98.8,"c_to_s_max":498,"c_to_s_stddev":103.2,"s_to_c_min":66,"s_to_c_avg":1322.7,"s_to_c_max":2938,"s_to_c_stddev":789.1}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01357{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":218,"source":"weibo.pcap","alias":"nDPId-test","flow_id":16,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445019,"flow_src_last_pkt_time":1463089073075846,"flow_dst_last_pkt_time":1463089073079547,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":420,"flow_dst_max_l4_payload_len":4308,"flow_src_tot_l4_payload_len":420,"flow_dst_tot_l4_payload_len":24521,"midstream":0,"thread_ts_usec":1463089073079547,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35803,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":151,"flow_avg":40817.9,"flow_max":400547,"flow_stddev":92805.4,"c_to_s_min":151,"c_to_s_avg":42055.1,"c_to_s_max":400547,"c_to_s_stddev":97724.5,"s_to_c_min":2804,"s_to_c_avg":39658.0,"s_to_c_max":372448,"s_to_c_stddev":87928.4},"pktlen": {"c_to_s_min":66,"c_to_s_avg":96.5,"c_to_s_max":486,"c_to_s_stddev":100.7,"s_to_c_min":66,"s_to_c_avg":1599.1,"s_to_c_max":4374,"s_to_c_stddev":1251.4}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00753{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":252,"source":"weibo.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089073286278,"flow_src_last_pkt_time":1463089073286278,"flow_dst_last_pkt_time":1463089073286278,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":39,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":39,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":39,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073286278,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":18035,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3} 00543{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"weibo.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_src_last_pkt_time":1463089073286278,"flow_dst_last_pkt_time":1463089073286278,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"thread_ts_usec":1463089073286278,"pkt":"kDVu60UQeJKcD6iOCABFAABDKCFAAEARjs7AqAFpwKgBAUZzADUAL2deWFEBAAABAAAAAAAAAnUxA2ltZwZtb2JpbGUEc2luYQJjbgAAAQAB"} 01011{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":252,"source":"weibo.pcap","alias":"nDPId-test","flow_id":20,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089073286278,"flow_src_last_pkt_time":1463089073286278,"flow_dst_last_pkt_time":1463089073286278,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":39,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":39,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":39,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073286278,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"192.168.1.1","src_port":18035,"dst_port":53,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"DNS.Sina(Weibo)","proto_id":"5.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork","hostname":"u1.img.mobile.sina.cn","dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}} @@ -173,9 +173,9 @@ 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":440,"source":"weibo.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_src_last_pkt_time":1463089073788865,"flow_dst_last_pkt_time":1463089073788865,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1463089073788865,"pkt":"kDVu60UQeJKcD6iOCABFAAA8M4FAAEAGYnrAqAFpKpy4E8wyAbubxznpAAAAAKACchCC5wAAAgQFtAQCCAoAQQpoAAAAAAEDAwc="} 00755{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":441,"source":"weibo.pcap","alias":"nDPId-test","flow_id":44,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089073789999,"flow_src_last_pkt_time":1463089073789999,"flow_dst_last_pkt_time":1463089073789999,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073789999,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"140.205.170.63","src_port":47723,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00536{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":441,"source":"weibo.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_src_last_pkt_time":1463089073789999,"flow_dst_last_pkt_time":1463089073789999,"flow_idle_time":3285032704,"pkt_oversize":false,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1463089073789999,"pkt":"kDVu60UQeJKcD6iOCABFAAA8F+ZAAEAGKbjAqAFpjM2qP7prAbvY7h2OAAAAAKACchAfhQAAAgQFtAQCCAoAQQpoAAAAAAEDAwc="} -01359{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":444,"source":"weibo.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445071,"flow_src_last_pkt_time":1463089073791996,"flow_dst_last_pkt_time":1463089073794639,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":459,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":869,"flow_dst_tot_l4_payload_len":13850,"midstream":0,"thread_ts_usec":1463089073794639,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35805,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":259,"flow_avg":87758.1,"flow_max":438815,"flow_stddev":117531.2,"c_to_s_min":259,"c_to_s_avg":91168.2,"c_to_s_max":375915,"c_to_s_stddev":112564.0,"s_to_c_min":2661,"s_to_c_avg":84348.0,"s_to_c_max":438815,"s_to_c_stddev":122201.7},"pktlen": {"c_to_s_min":66,"c_to_s_avg":123.8,"c_to_s_max":525,"c_to_s_stddev":142.7,"s_to_c_min":66,"s_to_c_avg":932.1,"s_to_c_max":1502,"s_to_c_stddev":568.1}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -01357{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":450,"source":"weibo.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089073321163,"flow_src_last_pkt_time":1463089073801051,"flow_dst_last_pkt_time":1463089073804152,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":484,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":484,"flow_dst_tot_l4_payload_len":18086,"midstream":0,"thread_ts_usec":1463089073804152,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35807,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":142,"flow_avg":41903.0,"flow_max":378020,"flow_stddev":80837.6,"c_to_s_min":142,"c_to_s_avg":53619.2,"c_to_s_max":378020,"c_to_s_stddev":100538.0,"s_to_c_min":2451,"s_to_c_avg":30186.8,"s_to_c_max":162100,"s_to_c_stddev":51836.5},"pktlen": {"c_to_s_min":66,"c_to_s_avg":97.5,"c_to_s_max":550,"c_to_s_stddev":116.9,"s_to_c_min":66,"s_to_c_avg":1196.9,"s_to_c_max":1502,"s_to_c_stddev":539.0}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} -01357{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":495,"source":"weibo.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089073334322,"flow_src_last_pkt_time":1463089073888564,"flow_dst_last_pkt_time":1463089073891278,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":473,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":473,"flow_dst_tot_l4_payload_len":18114,"midstream":0,"thread_ts_usec":1463089073891278,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35809,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":137,"flow_avg":46949.3,"flow_max":391179,"flow_stddev":82555.8,"c_to_s_min":137,"c_to_s_avg":59088.8,"c_to_s_max":391179,"c_to_s_stddev":105413.3,"s_to_c_min":2552,"s_to_c_avg":34809.8,"s_to_c_max":181460,"s_to_c_stddev":47161.6},"pktlen": {"c_to_s_min":66,"c_to_s_avg":96.8,"c_to_s_max":539,"c_to_s_stddev":114.2,"s_to_c_min":66,"s_to_c_avg":1198.6,"s_to_c_max":1502,"s_to_c_stddev":536.7}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01359{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":444,"source":"weibo.pcap","alias":"nDPId-test","flow_id":18,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089072445071,"flow_src_last_pkt_time":1463089073791996,"flow_dst_last_pkt_time":1463089073794639,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":459,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":869,"flow_dst_tot_l4_payload_len":13850,"midstream":0,"thread_ts_usec":1463089073794639,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35805,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":259,"flow_avg":86983.6,"flow_max":438815,"flow_stddev":119331.4,"c_to_s_min":259,"c_to_s_avg":89795.0,"c_to_s_max":375915,"c_to_s_stddev":116125.7,"s_to_c_min":2661,"s_to_c_avg":84348.0,"s_to_c_max":438815,"s_to_c_stddev":122201.7},"pktlen": {"c_to_s_min":66,"c_to_s_avg":123.8,"c_to_s_max":525,"c_to_s_stddev":142.7,"s_to_c_min":66,"s_to_c_avg":932.1,"s_to_c_max":1502,"s_to_c_stddev":568.1}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01356{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":450,"source":"weibo.pcap","alias":"nDPId-test","flow_id":26,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089073321163,"flow_src_last_pkt_time":1463089073801051,"flow_dst_last_pkt_time":1463089073804152,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":484,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":484,"flow_dst_tot_l4_payload_len":18086,"midstream":0,"thread_ts_usec":1463089073804152,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35807,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":142,"flow_avg":31060.5,"flow_max":183686,"flow_stddev":54622.5,"c_to_s_min":142,"c_to_s_avg":31992.5,"c_to_s_max":183686,"c_to_s_stddev":57431.0,"s_to_c_min":2451,"s_to_c_avg":30186.8,"s_to_c_max":162100,"s_to_c_stddev":51836.5},"pktlen": {"c_to_s_min":66,"c_to_s_avg":97.5,"c_to_s_max":550,"c_to_s_stddev":116.9,"s_to_c_min":66,"s_to_c_avg":1196.9,"s_to_c_max":1502,"s_to_c_stddev":539.0}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} +01356{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":495,"source":"weibo.pcap","alias":"nDPId-test","flow_id":28,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1463089073334322,"flow_src_last_pkt_time":1463089073888564,"flow_dst_last_pkt_time":1463089073891278,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":473,"flow_dst_max_l4_payload_len":1436,"flow_src_tot_l4_payload_len":473,"flow_dst_tot_l4_payload_len":18114,"midstream":0,"thread_ts_usec":1463089073891278,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"93.188.134.246","src_port":35809,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":137,"flow_avg":35845.1,"flow_max":252228,"flow_stddev":55584.3,"c_to_s_min":137,"c_to_s_avg":36949.5,"c_to_s_max":252228,"c_to_s_stddev":63327.3,"s_to_c_min":2552,"s_to_c_avg":34809.8,"s_to_c_max":181460,"s_to_c_stddev":47161.6},"pktlen": {"c_to_s_min":66,"c_to_s_avg":96.8,"c_to_s_max":539,"c_to_s_stddev":114.2,"s_to_c_min":66,"s_to_c_avg":1198.6,"s_to_c_max":1502,"s_to_c_stddev":536.7}},"ndpi": {"confidence": {"6":"DPI"},"proto":"HTTP.Sina(Weibo)","proto_id":"7.200","encrypted":0,"breed":"Fun","category_id":6,"category":"SocialNetwork"}} 00757{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":30,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1463089073394759,"flow_src_last_pkt_time":1463089073773797,"flow_dst_last_pkt_time":1463089073773608,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":428,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":428,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073893914,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42275,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} 00886{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089073537120,"flow_src_last_pkt_time":1463089073537120,"flow_dst_last_pkt_time":1463089073537120,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073893914,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42280,"dst_port":80,"l4_proto":"tcp","ndpi": {"confidence": {"1":"Match by port"},"proto":"HTTP","proto_id":"7","encrypted":0,"breed":"Acceptable","category_id":5,"category":"Web","hostname":"","http": {}}} 00753{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":498,"source":"weibo.pcap","alias":"nDPId-test","flow_id":37,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1463089073537120,"flow_src_last_pkt_time":1463089073537120,"flow_dst_last_pkt_time":1463089073537120,"flow_idle_time":3285032704,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1463089073893914,"l3_proto":"ip4","src_ip":"192.168.1.105","dst_ip":"222.73.28.96","src_port":42280,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":3} |