diff options
Diffstat (limited to 'tests/result/nDPId_smb_deletefile.pcap.txt')
| -rw-r--r-- | tests/result/nDPId_smb_deletefile.pcap.txt | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/tests/result/nDPId_smb_deletefile.pcap.txt b/tests/result/nDPId_smb_deletefile.pcap.txt new file mode 100644 index 000000000..9d12b57f5 --- /dev/null +++ b/tests/result/nDPId_smb_deletefile.pcap.txt @@ -0,0 +1,20 @@ +0366{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15} +0473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","flow_id":0,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":1584368315417,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp"} +0944{"flow_id":0,"flow_packet_id":1,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368315,"pkt_len":434,"pkt":"2MuK4S0uKDc3AG3ICABFAAGkAABAAEAGtNLAqAF2wKgBu94QAb3ooAVq8kMyI1AYqgDfmAAAAAABeP5TTUJAAAEAAAAAAAUAAAEAAAAAmAAAAJwPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgAHAAAAAAAAAAAAEwAdQBjAGEAXABEAG8AdwBuAGwAbwBhAGQAcwAAAAAA\/lNNQkAAAQAAAAAADgAAAQQAAACIAAAAnQ8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AAJgAAAAEAaQBuAG4AbwBzAGUAdAB1AHAALQA1AC4ANgAuADEALgBlAHgAZQAAAP5TTUJAAAEAAAAAAAYAAAEEAAAAAAAAAJ4PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAP\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8=","pkt_caplen":434,"pkt_type":2048,"pkt_ipoffset":14} +0533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","flow_id":0,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":1584368315417,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"NetBIOS.SMBv23","category":"System"}} +1064{"flow_id":0,"flow_packet_id":2,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368315,"pkt_len":554,"pkt":"KDc3AG3I2MuK4S0uCABFAAIcOK5AAIAGO6zAqAG7wKgBdgG93hDyQzIj6KAG5lAYEAjw+QAAAAAB8P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAJwPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAPJad+s0itQBeC8Pcpz71QGM0O1xnPvVAYzQ7XGc+9UBACAAAAAAAAAAIAAAAAAAABEAAAAAAAAAEgQAAAoAAABlAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAADYAAAAnQ8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASACOAAAAAAAAAAAAAAAzwlM5LZjUATN2tkyb+9UBqrZQPC2Y1AHHrtHNIlnVAYD0HQAAAAAAAAAeAAAAAAAgAAAAJgAAAAAAAAAYAEkATgBOAE8AUwBFAH4AMQAuAEUAWABFAAAAq04CAAAAAQBpAG4AbgBvAHMAZQB0AHUAcAAtADUALgA2AC4AMQAuAGUAeABlAAAA\/lNNQkAAAQAAAAAABgADAAUAAAAAAAAAng8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=","pkt_caplen":554,"pkt_type":2048,"pkt_ipoffset":14} +0386{"flow_id":0,"flow_packet_id":3,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368315,"pkt_len":54,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAbm8kM0F1AQqfyLpgAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0868{"flow_id":0,"flow_packet_id":4,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":378,"pkt":"2MuK4S0uKDc3AG3ICABFAAFsAABAAEAGtQrAqAF2wKgBu94QAb3ooAbm8kM0F1AYqgDGowAAAAABQP5TTUJAAAEAAAAAAAUAAAEAAAAAgAAAAJ8PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgAAAAAAAAAAAAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAQQAAABoAAAAoA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AACAAAAAEATAB1AGMAYQD+U01CQAABAAAAAAAGAAABBAAAAAAAAAChDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/","pkt_caplen":378,"pkt_type":2048,"pkt_ipoffset":14} +1019{"flow_id":0,"flow_packet_id":5,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":522,"pkt":"KDc3AG3I2MuK4S0uCABFAAH8OLFAAIAGO8nAqAG7wKgBdgG93hDyQzQX6KAIKlAYEAdr9gAAAAAB0P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAJ8PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAHF8fnEN3tQBwjwds5371QFsgQlGF1nVAZpBFPwbWdUBABAAAAAAAAAAEAAAAAAAABEAAAAAAAAAEwQAAAoAAADNAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAAC4AAAAoA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASABwAAAAAAAAAAAAAABsgQlGF1nVAaWmw1ic+9UBpabDWJz71QGlpsNYnPvVAQAAAAAAAAAAAAAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD5UGAAAABQBMAHUAYwBhAP5TTUJAAAEAAAAAAAYAAwAFAAAAAAAAAKEPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","pkt_caplen":522,"pkt_type":2048,"pkt_ipoffset":14} +0386{"flow_id":0,"flow_packet_id":6,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":54,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAgq8kM161AQqfyIjgAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0894{"flow_id":0,"flow_packet_id":7,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":394,"pkt":"2MuK4S0uKDc3AG3ICABFAAF8AABAAEAGtPrAqAF2wKgBu94QAb3ooAgq8kM161AYqgDtZwAAAAABUP5TTUJAAAEAAAAAAAUAAAEAAAAAgAAAAKIPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgACAAAAAAAAAAAAEwAdQBjAGEA\/lNNQkAAAQAAAAAADgAAAQQAAAB4AAAAow8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AAEgAAAAEARABvAHcAbgBsAG8AYQBkAHMAAAAAAAAA\/lNNQkAAAQAAAAAABgAAAQQAAAAAAAAApA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/w==","pkt_caplen":394,"pkt_type":2048,"pkt_ipoffset":14} +1042{"flow_id":0,"flow_packet_id":8,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":538,"pkt":"KDc3AG3I2MuK4S0uCABFAAIMOLJAAIAGO7jAqAG7wKgBdgG93hDyQzXr6KAJflAYEAanewAAAAAB4P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAKIPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAGyBCUYXWdUBsSVXap371QGlpsNYnPvVAaWmw1ic+9UBACAAAAAAAAAAIAAAAAAAABAAAAAAAAAAFAQAAAoAAACxAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAADIAAAAow8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASAB6AAAAAAAAAAAAAADyWnfrNIrUAcMy8HGc+9UBjNDtcZz71QGM0O1xnPvVAQAAAAAAAAAAAAAAAAAAAAARAAAAEgAAAAAAAAAQAEQATwBXAE4ATABPAH4AMQAAAAAAAAAAAAAAGpUGAAAABgBEAG8AdwBuAGwAbwBhAGQAcwAAAAAAAAD+U01CQAABAAAAAAAGAAMABQAAAAAAAACkDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==","pkt_caplen":538,"pkt_type":2048,"pkt_ipoffset":14} +0386{"flow_id":0,"flow_packet_id":9,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":54,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAl+8kM3z1AQqfyFVgAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0991{"flow_id":0,"flow_packet_id":10,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":466,"pkt":"2MuK4S0uKDc3AG3ICABFAAHEAABAAEAGtLLAqAF2wKgBu94QAb3ooAl+8kM3z1AYqgB5sQAAAAABmP5TTUJAAAEAAAAAAAUAAAEAAAAA2AAAAKUPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACAABEAgAAAAAAAAAABAAAAAAAAAHgARADAAAAAGAAAAEwAdQBjAGEAXABEAG8AdwBuAGwAbwBhAGQAcwBcAGkAbgBuAG8AcwBlAHQAdQBwAC0ANQAuADYALgAxAC4AZQB4AGUAAAAAAAAAAAAQAAQAAAAAAAAAAABNeEFjAAAAAP5TTUJAAAEAAAAAABEAAAEEAAAAaAAAAKYPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAhAAENAQAAAGAAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/wEAAAAAAAAA\/lNNQkAAAQAAAAAABgAAAQQAAAAAAAAApw8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/w==","pkt_caplen":466,"pkt_type":2048,"pkt_ipoffset":14} +0558{"flow_id":0,"flow_packet_id":11,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":180,"pkt":"KDc3AG3I2MuK4S0uCABFAACmOLNAAIAGPR3AqAG7wKgBdgG93hDyQzfP6KALGlAYEAQu2wAAAAAAev5TTUJAAAEAAAAAAA8AAAADAAAAAAAAAAAPAAAAAAAADQAAAwAAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAJAEgAMgAAAAAAAAACAAAAJgAAAGkAbgBuAG8AcwBlAHQAdQBwAC0ANQAuADYALgAxAC4AZQB4AGUA","pkt_caplen":180,"pkt_type":2048,"pkt_ipoffset":14} +0388{"flow_id":0,"flow_packet_id":12,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":54,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAsa8kM4TVAQqf+DOQAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +1072{"flow_id":0,"flow_packet_id":13,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":554,"pkt":"KDc3AG3I2MuK4S0uCABFAAIcOLRAAIAGO6bAqAG7wKgBdgG93hDyQzhN6KALGlAYEAS2GQAAAAABgP5TTUJAAAEAAAAAAAUAAAABAAAAuAAAAKUPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAADPCUzktmNQBM3a2TJv71QGqtlA8LZjUAceu0c0iWdUBAAAeAAAAAACA9B0AAAAAACAAAAAAAAAAFQQAAAoAAADFAAAACgAAAJgAAAAgAAAAAAAAABAABAAAABgACAAAAE14QWMAAAAAAAAAAP8BHwD+U01CQAABAAAAAAARAAAABQAAAEgAAACmDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAD+U01CQAABAAAAAAAGAAMABQAAAAAAAACnDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGz+U01CQAAAAAAAAAASAAAAAQAAAAAAAAD\/\/\/\/\/\/\/\/\/\/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALAACAAEAAADNtesUnIBJiady75EwC3S7AwAAAAAAAAAAAAAAAAAAAAAAAAA=","pkt_caplen":554,"pkt_type":2048,"pkt_ipoffset":14} +0388{"flow_id":0,"flow_packet_id":14,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":54,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAsa8kM6QVAQqfyBSAAA","pkt_caplen":54,"pkt_type":2048,"pkt_ipoffset":14} +0532{"flow_id":0,"flow_packet_id":15,"max_packets":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","pkt_oversize":false,"pkt_ts":1584368317,"pkt_len":158,"pkt":"2MuK4S0uKDc3AG3ICABFAACQAABAAEAGtebAqAF2wKgBu94QAb3ooAsa8kM6QVAYqgANAgAAAAAAZP5TTUJAAAEAAAAAABIAAAEAAAAAAAAAAKgPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAkAAAAAAAAAM216xScgEmJp3LvkTALdLsAAAAAAAAAAAAAAAA=","pkt_caplen":158,"pkt_type":2048,"pkt_ipoffset":14} +0480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":101,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap","flow_id":0,"flow_packet_id":101,"flow_first_seen":1584368315417,"flow_last_seen":1584368317802,"flow_tot_l4_data_len":27272,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":270,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp"} +0152{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":101,"source":"\/home\/toni\/git\/nDPI\/tests\/pcap\/smb_deletefile.pcap"} |