diff options
Diffstat (limited to 'tests/result/nDPId_iec60780-5-104.pcap.txt')
| -rw-r--r-- | tests/result/nDPId_iec60780-5-104.pcap.txt | 108 |
1 files changed, 108 insertions, 0 deletions
diff --git a/tests/result/nDPId_iec60780-5-104.pcap.txt b/tests/result/nDPId_iec60780-5-104.pcap.txt new file mode 100644 index 000000000..ae33adffb --- /dev/null +++ b/tests/result/nDPId_iec60780-5-104.pcap.txt @@ -0,0 +1,108 @@ +0366{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15} +0470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":0,"flow_packet_id":1,"flow_first_seen":1219992231267,"flow_last_seen":1219992231267,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1568,"dst_port":2404,"l4_proto":"tcp"} +0401{"flow_id":0,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbS5AAIAGRKWsG\/htrBv4TwYgCWR6t61JAAAAAHAC\/\/8CpgAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0401{"flow_id":0,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQVVAAIAGcH6sG\/hPrBv4bQlkBiDrZdPBeretSnAS\/\/9DbQAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0397{"flow_id":0,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobS9AAIAGRKysG\/htrBv4TwYgCWR6t61K62XTwlAQ\/\/9wMQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0397{"flow_id":0,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubTBAAIAGRKWsG\/htrBv4TwYgCWR6t61K62XTwlAY\/\/8BHwAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":0,"flow_packet_id":4,"flow_first_seen":1219992231267,"flow_last_seen":1219992231283,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1568,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0397{"flow_id":0,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQVZAAIAGcH+sG\/hPrBv4bQlkBiDrZdPCeretUFAY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0397{"flow_id":0,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992231,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobTFAAIAGRKqsG\/htrBv4TwYgCWR6t61Q62XTyFAQ\/\/lwKwAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0397{"flow_id":0,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992239,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAApbTZAAIAGRKSsG\/htrBv4TwYgCWR6t61Q62XTyFAY\/\/lwIgAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0389{"flow_id":0,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992239,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQVlAAIAGcIKsG\/hPrBv4bQlkBiDrZdPIeretUVAQ\/\/hJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0397{"flow_id":0,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992248,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAqbTlAAIAGRKCsG\/htrBv4TwYgCWR6t61R62XTyFAY\/\/luuAAAAWgAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0391{"flow_id":0,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992248,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQVpAAIAGcIGsG\/hPrBv4bQlkBiDrZdPIeretU1AQ\/\/ZJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":0,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992271,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubTtAAIAGRJqsG\/htrBv4TwYgCWR6t61T62XTyFAY\/\/n0BQAAAgJoABIS","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0391{"flow_id":0,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992271,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQVtAAIAGcICsG\/hPrBv4bQlkBiDrZdPIeretWVAQ\/\/BJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":0,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992291,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubUBAAIAGRJWsG\/htrBv4TwYgCWR6t61Z62XTyFAY\/\/nFDwAAaARDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":0,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992291,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQVxAAIAGcHmsG\/hPrBv4bQlkBiDrZdPIeretX1AY\/+pJFQAAaASDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":0,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992291,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobUFAAIAGRJqsG\/htrBv4TwYgCWR6t61f62XTzlAQ\/\/NwHAAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":30,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":1,"flow_packet_id":1,"flow_first_seen":1219992393215,"flow_last_seen":1219992393215,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1570,"dst_port":2404,"l4_proto":"tcp"} +0403{"flow_id":1,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbYNAAIAGRFCsG\/htrBv4TwYiCWRtLtqlAAAAAHAC\/\/\/i0AAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0402{"flow_id":1,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQXdAAIAGcFysG\/hPrBv4bQlkBiJI3nuobS7apnAS\/\/8eOQAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":1,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobYRAAIAGRFesG\/htrBv4TwYiCWRtLtqmSN57qVAQ\/\/9K\/QAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":1,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubYVAAIAGRFCsG\/htrBv4TwYiCWRtLtqmSN57qVAY\/\/\/b6gAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":33,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":1,"flow_packet_id":4,"flow_first_seen":1219992393215,"flow_last_seen":1219992393217,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1570,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0398{"flow_id":1,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQXhAAIAGcF2sG\/hPrBv4bQlkBiJI3nupbS7arFAY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":1,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992393,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobYZAAIAGRFWsG\/htrBv4TwYiCWRtLtqsSN57r1AQ\/\/lK9wAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0414{"flow_id":1,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992435,"pkt_len":70,"pkt":"ABXFGNTMABNy14eKCABFAAA4bZRAAIAGRDesG\/htrBv4TwYiCWRtLtqsSN57r1AY\/\/nkBQAABwcHBwcHB2gFFxcXFxcXFw==","pkt_caplen":70,"pkt_type":2048,"pkt_ipoffset":14} +0389{"flow_id":1,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992435,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQXlAAIAGcGKsG\/hPrBv4bQlkBiJI3nuvbS7avFAQ\/+lJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0473{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":0,"flow_packet_id":29,"flow_first_seen":1219992231267,"flow_last_seen":1219992392222,"flow_tot_l4_data_len":683,"flow_min_l4_data_len":20,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1568,"dst_port":2404,"l4_proto":"tcp"} +0398{"flow_id":1,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992453,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubZdAAIAGRD6sG\/htrBv4TwYiCWRtLtq8SN57r1AY\/\/mf1AAAaARDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":1,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992453,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQXpAAIAGcFusG\/hPrBv4bQlkBiJI3nuvbS7awlAY\/+NJFQAAaASDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":1,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992453,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobZhAAIAGREOsG\/htrBv4TwYiCWRtLtrCSN57tVAQ\/\/NK4QAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0415{"flow_id":1,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992485,"pkt_len":72,"pkt":"ABXFGNTMABNy14eKCABFAAA6baBAAIAGRCmsG\/htrBv4TwYiCWRtLtrCSN57tVAY\/\/NiQAAACAgICAgICAhoBhgYGBgYGBgY","pkt_caplen":72,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":1,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992485,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQXxAAIAGcF+sG\/hPrBv4bQlkBiJI3nu1bS7a1FAR\/9FJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":1,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992485,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobaFAAIAGRDqsG\/htrBv4TwYiCWRtLtrUSN57tlAQ\/\/NKzgAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":1,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992485,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobaJAAIAGRDmsG\/htrBv4TwYiCWRtLtrUSN57tlAR\/\/NKzQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":46,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":2,"flow_packet_id":1,"flow_first_seen":1219992486295,"flow_last_seen":1219992486295,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1571,"dst_port":2404,"l4_proto":"tcp"} +0402{"flow_id":2,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbaNAAIAGRDCsG\/htrBv4TwYjCWQlpaXOAAAAAHAC\/\/9fMAAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0402{"flow_id":2,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQX5AAIAGcFWsG\/hPrBv4bQlkBiP13h8HJaWlz3AS\/\/9KOQAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":2,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobaRAAIAGRDesG\/htrBv4TwYjCWQlpaXP9d4fCFAQ\/\/92\/QAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":2,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubaVAAIAGRDCsG\/htrBv4TwYjCWQlpaXP9d4fCFAY\/\/8H6wAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":49,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":2,"flow_packet_id":4,"flow_first_seen":1219992486295,"flow_last_seen":1219992486297,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1571,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0390{"flow_id":2,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQX9AAIAGcFysG\/hPrBv4bQlkBiP13h8IJaWl1VAQ\/\/lJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":2,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQYBAAIAGcFWsG\/hPrBv4bQlkBiP13h8IJaWl1VAY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":2,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992486,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobaZAAIAGRDWsG\/htrBv4TwYjCWQlpaXV9d4fDlAQ\/\/l29wAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0473{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":53,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":1,"flow_packet_id":16,"flow_first_seen":1219992393215,"flow_last_seen":1219992485282,"flow_tot_l4_data_len":394,"flow_min_l4_data_len":20,"flow_max_l4_data_len":38,"flow_avg_l4_data_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1570,"dst_port":2404,"l4_proto":"tcp"} +0398{"flow_id":2,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992546,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubblAAIAGRBysG\/htrBv4TwYjCWQlpaXV9d4fDlAY\/\/nL5AAAaARDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":2,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992546,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQYFAAIAGcFSsG\/hPrBv4bQlkBiP13h8OJaWl21AY\/\/NJFQAAaASDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":2,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":55,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992546,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobbpAAIAGRCGsG\/htrBv4TwYjCWQlpaXb9d4fFFAQ\/\/N28QAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0411{"flow_id":2,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":56,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992580,"pkt_len":67,"pkt":"ABXFGNTMABNy14eKCABFAAA1bb9AAIAGRA+sG\/htrBv4TwYjCWQlpaXb9d4fFFAY\/\/O+nQAACAgICAgICAhoBhgYGA==","pkt_caplen":67,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":2,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992580,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQYJAAIAGcFmsG\/hPrBv4bQlkBiP13h8UJaWl6FAQ\/+ZJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":2,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992589,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAtbcJAAIAGRBSsG\/htrBv4TwYjCWQlpaXo9d4fFFAY\/\/MupwAAGBgYGBgA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":2,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992589,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQYNAAIAGcFisG\/hPrBv4bQlkBiP13h8UJaWl7VAR\/+FJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":2,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992589,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobcNAAIAGRBisG\/htrBv4TwYjCWQlpaXt9d4fFVAQ\/\/N23gAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":63,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":3,"flow_packet_id":1,"flow_first_seen":1219992590188,"flow_last_seen":1219992590188,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1572,"dst_port":2404,"l4_proto":"tcp"} +0402{"flow_id":3,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbcVAAIAGRA6sG\/htrBv4TwYkCWQxVG2fAAAAAHAC\/\/+LrwAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0403{"flow_id":3,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQYVAAIAGcE6sG\/hPrBv4bQlkBiSd+ybXMVRtoHAS\/\/\/GywAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":3,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobcZAAIAGRBWsG\/htrBv4TwYkCWQxVG2gnfsm2FAQ\/\/\/zjwAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":3,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubcdAAIAGRA6sG\/htrBv4TwYkCWQxVG2gnfsm2FAY\/\/+EfQAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":66,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":3,"flow_packet_id":4,"flow_first_seen":1219992590188,"flow_last_seen":1219992590189,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1572,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0398{"flow_id":3,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQYZAAIAGcE+sG\/hPrBv4bQlkBiSd+ybYMVRtplAY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":3,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992590,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobchAAIAGRBOsG\/htrBv4TwYkCWQxVG2mnfsm3lAQ\/\/nziQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0473{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":69,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":2,"flow_packet_id":17,"flow_first_seen":1219992486295,"flow_last_seen":1219992589197,"flow_tot_l4_data_len":398,"flow_min_l4_data_len":20,"flow_max_l4_data_len":33,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1571,"dst_port":2404,"l4_proto":"tcp"} +0398{"flow_id":3,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992650,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubhRAAIAGQ8GsG\/htrBv4TwYkCWQxVG2mnfsm3lAY\/\/lIdwAAaARDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":3,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992650,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQYhAAIAGcE2sG\/hPrBv4bQlkBiSd+ybeMVRtrFAY\/\/NJFQAAaASDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0418{"flow_id":3,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992650,"pkt_len":74,"pkt":"ABXFGNTMABNy14eKCABFAAA8bhVAAIAGQ7KsG\/htrBv4TwYkCWQxVG2snfsm5FAY\/\/NbXgAACQkJCQkJCQkJaAYZGRkZGRkZGRk=","pkt_caplen":74,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":3,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992650,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQYlAAIAGcFKsG\/hPrBv4bQlkBiSd+ybkMVRtwFAQ\/99JDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0411{"flow_id":3,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992676,"pkt_len":68,"pkt":"ABXFGNTMABNy14eKCABFAAA2bh1AAIAGQ7CsG\/htrBv4TwYkCWQxVG3Anfsm5FAY\/\/OmmwAACQkJCQkJCQkJaAYZGRk=","pkt_caplen":68,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":3,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992676,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQYpAAIAGcFGsG\/hPrBv4bQlkBiSd+ybkMVRtzlAQ\/9FJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":3,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992686,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubiBAAIAGQ7WsG\/htrBv4TwYkCWQxVG3Onfsm5FAY\/\/OoCAAAGRkZGRkZ","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":3,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992686,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQYtAAIAGcFCsG\/hPrBv4bQlkBiSd+ybkMVRt1FAQ\/8tJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":3,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992710,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubiNAAIAGQ7KsG\/htrBv4TwYkCWQxVG3Unfsm5FAY\/\/NISQAAaARDAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0471{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":88,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":4,"flow_packet_id":1,"flow_first_seen":1219992782348,"flow_last_seen":1219992782348,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1577,"dst_port":2404,"l4_proto":"tcp"} +0402{"flow_id":4,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbjdAAIAGQ5ysG\/htrBv4TwYpCWQN1WRMAAAAAHAC\/\/+4fAAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0402{"flow_id":4,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQZFAAIAGcEKsG\/hPrBv4bQlkBikE5Jl8DdVkTXAS\/\/8aCwAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":4,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobjhAAIAGQ6OsG\/htrBv4TwYpCWQN1WRNBOSZfVAQ\/\/9GzwAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":4,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubjlAAIAGQ5ysG\/htrBv4TwYpCWQN1WRNBOSZfVAY\/\/\/XvAAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":91,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":4,"flow_packet_id":4,"flow_first_seen":1219992782348,"flow_last_seen":1219992782350,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1577,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0398{"flow_id":4,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":92,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQZJAAIAGcEOsG\/hPrBv4bQlkBikE5Jl9DdVkU1AY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":4,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992782,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobjpAAIAGQ6GsG\/htrBv4TwYpCWQN1WRTBOSZg1AQ\/\/lGyQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0414{"flow_id":4,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992804,"pkt_len":71,"pkt":"ABXFGNTMABNy14eKCABFAAA5bkBAAIAGQ4qsG\/htrBv4TwYpCWQN1WRTBOSZg1AY\/\/leQQAACgoKCgoKCgoKCmgIGhoaGho=","pkt_caplen":71,"pkt_type":2048,"pkt_ipoffset":14} +0389{"flow_id":4,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992804,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQZNAAIAGcEisG\/hPrBv4bQlkBikE5JmDDdVkZFAQ\/+hJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":4,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992818,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAtbkFAAIAGQ5WsG\/htrBv4TwYpCWQN1WRkBOSZg1AY\/\/n4dgAAGhoaGhoA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0390{"flow_id":4,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992818,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQZRAAIAGcEesG\/hPrBv4bQlkBikE5JmDDdVkaVAR\/+NJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":4,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992818,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobkJAAIAGQ5msG\/htrBv4TwYpCWQN1WRpBOSZhFAQ\/\/lGsgAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":4,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992818,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobkNAAIAGQ5isG\/htrBv4TwYpCWQN1WRpBOSZhFAR\/\/lGsQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0391{"flow_id":4,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992818,"pkt_len":54,"pkt":"ABNy14eKABXFGNTMCABFAAAoQZVAAIAGcEasG\/hPrBv4bQlkBikE5JmEDdVkalAQ\/+NJDwAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":101,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":5,"flow_packet_id":1,"flow_first_seen":1219992819942,"flow_last_seen":1219992819942,"flow_tot_l4_data_len":28,"flow_min_l4_data_len":28,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1578,"dst_port":2404,"l4_proto":"tcp"} +0404{"flow_id":5,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992819,"pkt_len":62,"pkt":"ABXFGNTMABNy14eKCABFAAAwbkRAAIAGQ4+sG\/htrBv4TwYqCWRBsBqPAAAAAHAC\/\/\/OXQAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0405{"flow_id":5,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992819,"pkt_len":62,"pkt":"ABNy14eKABXFGNTMCABFAAAwQZZAAIAGcD2sG\/hPrBv4bQlkBir5wu6KQbAakHAS\/\/\/l\/gAAAgQFtAEBBAI=","pkt_caplen":62,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992819,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobkVAAIAGQ5asG\/htrBv4TwYqCWRBsBqQ+cLui1AQ\/\/8SwwAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992819,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubkZAAIAGQ4+sG\/htrBv4TwYqCWRBsBqQ+cLui1AY\/\/+jsAAAaAQHAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":104,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":5,"flow_packet_id":4,"flow_first_seen":1219992819942,"flow_last_seen":1219992819944,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":20,"flow_max_l4_data_len":28,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1578,"dst_port":2404,"l4_proto":"tcp","ndpi": {"proto":"IEC60870","category":"IoT-Scada"}} +0399{"flow_id":5,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992819,"pkt_len":60,"pkt":"ABNy14eKABXFGNTMCABFAAAuQZdAAIAGcD6sG\/hPrBv4bQlkBir5wu6LQbAallAY\/\/lJFQAAaAQLAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":106,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992820,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobkdAAIAGQ5SsG\/htrBv4TwYqCWRBsBqW+cLukVAQ\/\/kSvQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0474{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":107,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":3,"flow_packet_id":25,"flow_first_seen":1219992590188,"flow_last_seen":1219992781349,"flow_tot_l4_data_len":626,"flow_min_l4_data_len":20,"flow_max_l4_data_len":42,"flow_avg_l4_data_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1572,"dst_port":2404,"l4_proto":"tcp"} +0415{"flow_id":5,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992852,"pkt_len":70,"pkt":"ABNy14eKABXFGNTMCABFAAA4QaNAAIAGcCisG\/hPrBv4bQlkBir5wu6RQbAallAY\/\/lJHwAAaA4AAAAARgEEAA2RAAAAAA==","pkt_caplen":70,"pkt_type":2048,"pkt_ipoffset":14} +0398{"flow_id":5,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":108,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992852,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAobk5AAIAGQ42sG\/htrBv4TwYqCWRBsBqW+cLuoVAQ\/+kSvQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0414{"flow_id":5,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":109,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992869,"pkt_len":70,"pkt":"ABXFGNTMABNy14eKCABFAAA4blFAAIAGQ3qsG\/htrBv4TwYqCWRBsBqW+cLuoVAY\/+kw8AAAaA4AAAIAZAEGAA2RAAAAFA==","pkt_caplen":70,"pkt_type":2048,"pkt_ipoffset":14} +0482{"flow_id":5,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":110,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992869,"pkt_len":118,"pkt":"ABNy14eKABXFGNTMCABFAABoQaRAAIAGb\/esG\/hPrBv4bQlkBir5wu6hQbAaplAY\/+lJTwAAaAQBAAIAaA4CAAIAZAEHAA2RAAAAFGgWBAACAAGJFAANkRonANCAgIDAgICAgGgQBgACAAODFAANkSpOAICAgA==","pkt_caplen":118,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":111,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992870,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAoblJAAIAGQ4msG\/htrBv4TwYqCWRBsBqm+cLu4VAQ\/6kSrQAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0474{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":112,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":4,"flow_packet_id":13,"flow_first_seen":1219992782348,"flow_last_seen":1219992818955,"flow_tot_l4_data_len":310,"flow_min_l4_data_len":20,"flow_max_l4_data_len":37,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1577,"dst_port":2404,"l4_proto":"tcp"} +0399{"flow_id":5,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992889,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAubldAAIAGQ36sG\/htrBv4TwYqCWRBsBqm+cLu4VAY\/6mhmgAAaAQBAAgA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0415{"flow_id":5,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992889,"pkt_len":70,"pkt":"ABNy14eKABXFGNTMCABFAAA4Qa9AAIAGcBysG\/hPrBv4bQlkBir5wu7hQbAarFAY\/+NJHwAAaA4IAAIAZAEKAA2RAAAAFA==","pkt_caplen":70,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992890,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAoblhAAIAGQ4OsG\/htrBv4TwYqCWRBsBqs+cLu8VAQ\/5kSpwAAAAAAAAAA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0399{"flow_id":5,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","pkt_oversize":false,"pkt_ts":1219992909,"pkt_len":60,"pkt":"ABXFGNTMABNy14eKCABFAAAublxAAIAGQ3msG\/htrBv4TwYqCWRBsBqs+cLu8VAY\/5mflAAAaAQBAAoA","pkt_caplen":60,"pkt_type":2048,"pkt_ipoffset":14} +0475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":147,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap","flow_id":5,"flow_packet_id":47,"flow_first_seen":1219992819942,"flow_last_seen":1219993055118,"flow_tot_l4_data_len":1373,"flow_min_l4_data_len":20,"flow_max_l4_data_len":84,"flow_avg_l4_data_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"172.27.248.109","dst_ip":"172.27.248.79","src_port":1578,"dst_port":2404,"l4_proto":"tcp"} +0152{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":147,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/iec60780-5-104.pcap"} |