00474{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"signal.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569051245838,"flow_last_seen":0,"flow_min_l4_payload_len":300,"flow_max_l4_payload_len":300,"flow_tot_l4_payload_len":300,"flow_avg_l4_payload_len":300,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00806{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051245,"pkt_ts_usec":838268,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/2DBiVgAcCABFAAFIKS8AAP8RkXYAAAAA\/\/\/\/\/wBEAEMBNJxAAQEGACG6jqoAAQAAAAAAAAAAAAAAAAAAAAAAANgwYlYAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwoBeQMGD3f8XywuOQIF3D0HAdgwYlYAHDMEAHanAAwKTHVjYXMtaU1hY\/8AAAAAAAAAAAAAAAAA"}
00568{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1569051245838,"flow_last_seen":0,"flow_min_l4_payload_len":300,"flow_max_l4_payload_len":300,"flow_tot_l4_payload_len":300,"flow_avg_l4_payload_len":300,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,121,3,6,15,119,252,95,44,46"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"signal.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1569051247593,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":60793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00450{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":593701,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"xiwDYGpkxGGLNYKpCABFAABHd8wAAP8RvnbAqAIRwKgCAe15ADUAM\/YJyvgBAAABAAAAAAAABGU2NzMFZHNjZTkKYWthbWFpZWRnZQNuZXQAAAEAAQ=="}
00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"signal.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1569051247593,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":60793,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e673.dsce9.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1569051247594,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":594090,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGZHDAqAIRIuHwrcBKAbtArcPUAAAAALAC\/\/8kVgAAAgQFtAEDAwYBAQgKKFVNgQAAAAAEAgAA"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"signal.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1569051247599,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":599529,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGSLbAqAIRFzkYEN66AbtonqfVAAAAALAC\/\/\/ZywAAAgQFtAEDAwcBAQgKKFVR7gAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1569051247600,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":600467,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGZHDAqAIRIuHwrd67AbuyrbdxAAAAALAC\/\/+b2AAAAgQFtAEDAwcBAQgKKFVR7wAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1569051247601,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":601573,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGZHDAqAIRIuHwrd68AbvGwW2DAAAAALAC\/\/\/RsAAAAgQFtAEDAwcBAQgKKFVR8AAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1569051247603,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":603797,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGZHDAqAIRIuHwrd69Abtt2McPAAAAALAC\/\/\/RCgAAAgQFtAEDAwcBAQgKKFVR8gAAAAAEAgAA"}
00471{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":630078,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"xGGLNYKpxiwDYGpkCABFAABXR+wAAEARrUfAqAIBwKgCEQA17XkAQwp5yviBgAABAAEAAAAABGU2NzMFZHNjZTkKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAA8ABBc5GBA="}
00677{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":8,"source":"signal.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1569051247593,"flow_last_seen":1569051247630,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":60793,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"e673.dsce9.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.57.24.16"}}
00433{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":643687,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAADQGlLoXORgQwKgCEQG73rrg+UqLaJ6n1qAScSCOEgAAAgQFrAQCCAqWTinBKFVR7gEDAwc="}
00422{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":645554,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN66AbtonqfW4PlKjIAQBAspvwAAAQEICihVUhuWTinB"}
01119{"flow_id":4,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":645675,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGRr3AqAIRFzkYEN66AbtonqfW4PlKjIAYBAt1eQAAAQEICihVUhuWTinBFgMBAgABAAH8AwORcncPsZ5qIVMCFuWgfAh6It7r+HS2ZZg+ldmkQzu5TCBZnL8ZiCuWJmLRaxcsIL0Nu9GPkgNG7xXFvEs6oR8pMAA0EwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqACdAJwAPQA8ADUAL8AIwBIACgEAAX\/\/AQABAAAAABUAEwAAEGl0dW5lcy5hcHBsZS5jb20AFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAgWo6on7tfmVX9S3E+N7mNvysCblDKK8M25vsu0sA3gR4ALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVANEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00782{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"signal.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1569051247599,"flow_last_seen":1569051247645,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57018,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.AppleiTunes","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"itunes.apple.com","ja3":"17305a56a62a10f6b0ee8edcc3b1769c","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00422{"flow_id":4,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":689292,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0iWYAADQGC1wXORgQwKgCEQG73rrg+UqMaJ6p24AQAOsqrAAAAQEICpZOKe8oVVIb"}
02368{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":690070,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUiWcAADQGBbsXORgQwKgCEQG73rrg+UqMaJ6p24AQAOsk4AAAAQEICpZOKe8oVVIbFgMDAHoCAAB2AwMUvHUAE5HMBEvgFTw0tJYf9hRVmcvTon70MEFpfY6v5iBZnL8ZiCuWJmLRaxcsIL0Nu9GPkgNG7xXFvEs6oR8pMBMCAAAuACsAAgMEADMAJAAdACCntgbwbo5VCKgnWyzzbxNiYUv5TbAEMN8fHIjijFrefhQDAwABARcDAwAuswKpeCejOoOw25TCHDnCBnSE\/EDYh72zOouUq0a4h55O2UyGCXr9v\/kUb\/uSOxcDAxXadbUshWDvGBikuR8SOuBpUeNI1693y8L3641uBF4BZxIMw4+PPQdMEhC1axL6i9NCqA1nBf1y3dZcjHQsYZunXzGkrdM0vWa3qphO0piLVIKXE\/3+596rbcx2BPuIMa9lWSn\/ct8NiZoQCJJNM8PjO8W9lfNC5ECdeCmmjgHxxIJhiJTlywDSOm9Uc0pSUiePTxv\/4KT6AL11Br\/ijo9iy5r1UGyGfO0IwL7VxAoqhQ+zdzXP1EAXuk66nYkfQq0ZhpZ+3DCjdvBM9l4Sx4hr7lgjn6tZpOTRdoHCRBAAJ8CmppexmxAbf3JZYiY3VUjLo9Ik6JGRyyx\/FtiseJMdk3glQ8VpuUSwnPWXfUtSsBtMscBr+2Y31TguARp+u0UONMA51QCEZ53+Z+RuEs3JwFbDMrxtEprt97PbptEsgR1A1LMv7LzI8YYwJJoW2DhCgaKBxnkbZlQ1J6gnQVzYORGWorgvyKUYxM0z2JfaATyNddNAbozunJz4QJu+1AfmvXfltPj7Ci8er+MIVgYsL+mHb6IL1P2uMImO+3XY604f7C8uqXLGk\/XP5fQhxQRzNMoQx5h3Y3oLiSqjQWdq2D+L2Uje0qgr5hdumqqN2807uonZJKKJRa7QaHud8+ENKDxe6FVnMXNfF5MMMbaMWooisAni7666s3DlkqkhxijBQ1X0YB7ah1BWbReHB3Gnm3pR009L42qSb7iikBn9uLdMyAvc36sJFM2LaglZWmjfFtNz6nfYJg3ozeHP9q8in\/F6k34KD1wgssOdQlaaGBk+SyiSrYDr03Ax0vJjYKwNuo+bX7dU5KMcVLegtPCi0pIjiutSiUAemkFtRbxujywM9xI5KcRdn8zU007oFNbjuqA9GkP8OqvlHM8rhL8+QXRgohZbBtLkW6dqsBmkUNfjZ1rN5O2r+UvO6wVsjBqANpm9XkHTQmP3DS8TcYs4YqL8uaiR+3BQzl7CT5ZeA1D1ZWQ0QFNeZZMf+3VzuAXKpbnV\/vnrKPyXVNf8JohigJxUTWW\/ofmC94vzPfkmR1EwWSkzmQcg8J4i7UNazI3V5+I0k\/hJIww2hI3FhjkbeesO10ockpQQkX0TvyhpUt9CgaJfkoCi0XWvjioULJwWc9rHKVYmrvSR1Q6+2GEsfnkxFfteQUj856jvSAMDkvUWLsesaxvoaQW6Go1gNwaECPwhMouTIR7mWZb7LITEVw3agwZ5d+G6gr4fZWqA4Pz4NyEvC4\/YvcKwD6TrpeDiNTCjz6OUu7\/0G1i6yQbGsjRPKf0bGiRgED0QQhDfV3HRULSCd+tnyfocZTRRZaaPYy8L6UXJfHD48YEa171lKCrIFIijj2cIip0nYv79\/FjnSUBmuq\/Y7XqlELQxjusNGnTdBehnRPCnuuMJZCORNShUmNsELcm9LsBTbCsfCUxxXUqT7fqfdeFRwlk\/9fqFAntGDCdU\/FjIp7e1gDx35ylDg1\/YD6EuuU4gmzsouRwDt6XF77Qk02kXFIYLGHjKJMTXzNvbIS4aMoERgjIPqtV45PvaH9ceHJs9POim0Zq+rvcux2Wk4n+achEJL1yQUCuioQoaLZ9zznii5TqhbWfvpJ1tYI6qgtsnGhrFhRsX9jxugLreyTblL9GAxeMd1SVWkRnV46WycjNkOH05jmyT"}
00823{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":13,"source":"signal.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":6,"flow_first_seen":1569051247599,"flow_last_seen":1569051247690,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57018,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.AppleiTunes","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.3","client_requested_server_name":"itunes.apple.com","ja3":"17305a56a62a10f6b0ee8edcc3b1769c","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
02380{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":690287,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUiWgAADQGBboXORgQwKgCEQG73rrg+VAsaJ6p24AQAOuJLwAAAQEICpZOKe8oVVIbxAXCpHbxPftaL4zD+bXbUvS8WzTblfQmSFg3TcVgBhrRL7IMVVjmem3E64jPckHXSIMaCBo0I6Vru1KcVVtRsTg\/KT8zjUtuGiDTbqlTqprLzMVMKG5JBGoAPgC871UdRhEjkyTpQETY0\/jDkHxSwOH4x4tr\/E9d8X60qp0b\/8eSP3yaZNx6nPtIDWU9bO9w8kuQCfrDwTEjcGZ0hAhigPynn99QQxdSNZAB4I0Ea0UJ86TWYm80tof3NT+f0dEuX6V8zRYUyDPRWw0iiPKDgdvySuxFILhkiF6MZX8EFKMcL\/yEvW94RcjYbpJvt91GL7snvYFl8bXMXmoTpXqvnUGhXc0nZEuoqH3+5Oix15F0gTTHbsruxzP8sFnF9mcTLDks8vv\/dHU8oZiHJQHStW6a6yoSWFiAV697M7\/n+qgt9ESweWU7DmmEfWUxaEq+qgkJaeDz2eDqVhc4AoXnECDQ+K\/iJW\/DlDACPYMLiLp+DwuWvAVyyRncqDwiY5NN35jujMOyJMTssVmmkQ2\/COS5GFAfClCsxcYxHYXc+ZoFRrEPvOBF\/VVocQs4w2EzBRZ8ziaI4JSM42QdhQEMz5A7Y1dcYC3lsTvUyzaebJNRykwIVtGK\/kk41STOkjp+IRsHK4v0wNgoKSkZ\/KAnXenufKx7+ol6XwCeMTyv5G7NuQGuRA3+HJJRv\/q813ewEIOsmUZN2y9urgQGCTjxA4hNycl7l7i+P6ecXDqSNyVhPtZY0y\/42gXiKs3+jtZMxFGDsuKCyFaR8PfxeI+teeYy7dzGNyOLjeFNv7UsiZg57I+r7+fb+ZGBPZPf21numlZbcdiXlTotn\/JSv1nv95V8cKsUXhVmaLOj+Znha4jPuMbbBxMSAfUMZMYObaxxtAsUAjuVU6LcMesmSPlZPVvvyjDOMO9kV1Nss7hBTIqC9CqOD8tWmUAA8RDhPWOmcCoaVvQK4gamwkMa5\/oo+llZxpMe6FT\/Cy5pfA9RdtTsTSAAHZ6k1w7F5FJX6WCosUra5AJtx58za0ujMV65mGpgLE8RUJMOKoGKSV3ry5yEUa+\/CdmZ9W6gaYUVYZLJpgcrso\/wMBkzWxIKHiI0L5Yto8+9H5Pav2fcE8zeTAOupLYj\/mNC3CpinV\/1tXD0mczD11UtvsKwGwZ+1ywKYB6YktBCKzgawLWTqlxOFSLVCgGDUARyqLj0fzUB8HHcvLngkSv9Gc2cM\/p\/zJe7oF2Hlil\/qgGEmIxpw37N8ywkO8psfZcB1fstW5+nMkgCPjhAHqYduF6d+BslQEATpnfEf4319WFCVpVnsJej9zDqCxii8iaLQ1FnBv8CJab9k+nhklAxNHea63zjQkoMmoWK0bNHME45w+dwL+VvSFLJkJqHdQYmOB6OuqUSsgBPgjSy4Yj4zICpNnkopcYNmF8sFixg5tY0Agwg6g+zOUf1auld5T4mS89vZcvBp\/H2pjFXqr4F2+nr8aDZqxszaOav1rlo+LtuFDnSIm8EK9\/b8UkqZ1mdLyfFzWAXAjYZLoaXI2ETFePtnPjccHnkkALLzbJYFNXVgjNr56WzKmuyQAzZOeo2MThI508zTwSLTBmDMuvmevCTF+JnO4Jwn9eSLeza\/V3HQkQTg60Fr6B7sqhtvA8\/Y5QpENWUN3c02GKHt\/VGmKHSeCwvKvmPn108H4HMIfL0fDzuEBzmZ1H5IhR1PCnSAD8\/jAXT8kUfxUwcUyFl9ZtX6hJrkxuc+tzXz2LE3+WHRdjrs363PwgyplOYHNKHhRUFw5GYte3mv5TNY4uDKa0Dy+bQy9sFRNe\/47JVi0gJ94Gic1DghxysVQTcdZaipYhrbuvVJZlY1p7s0RpdAw36Hdw+SjMdlGyb3D3Vk0SV9ALyeNezhkDfgeCtYgKn2wq0Blr1ZBnB"}
02069{"flow_id":4,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":690606,"pkt_caplen":1282,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1282,"pkt_l4_len":1248,"pkt":"xGGLNYKpxiwDYGpkCABFAAT0iWkAADQGBpkXORgQwKgCEQG73rrg+VXMaJ6p24AYAOsQRQAAAQEICpZOKe8oVVIbgcjm4wszT5ZXlXNWtV0zRbnQ0QVtT5ZipYVbTMplTQXXYKOwUoUSe1qODXfp95OGTrfDfCvMoopRGn2ONzPoFKyyrDTvM6+othCUgsXqizlgIDZMQzfLS4Am2bGg5hZX\/2xFNG9BZqqV1XIqDxWL9KNTgLN+IzQTQ9zr245kLykxiTujX2LmcTrRzYne3NmhGc6djTMLVgFppANRE3G2V7k0toZM+pULkDBl5s7hdce2qLF5oBRFCGYUcBKv9jpJnmwDM+djWHTE8x4Ou9S0ZYvXwRUCRvtVQQg41sIptslztqDKOufaRqT1C+UeoH3a1lkeGRXuwjuFFAq9Yhyvk27taFX6GZ99kunbKFlKlns6fiCipVV6CDJJaVS8Ki9wt4DBmu9HJqBBHRPDtMUelH2i0XWTydUBhC\/u\/urhJOKao8N\/joTK9DHox2aAh9CM6QrywyOkd98Fhrs9Lyq0CKYt1vpKudYBW7kH7Z3W2GlxUzRTqvkwZ+72TWwQItbGZ87O6IxjzTVnoQOUtKAes2mw2Y0KZiP3DkXQak2ojPVjiXPxlJDs0lhzt0tyrXSNrM3IvJ3uuUKLuLRnLU+E1tcnuzfQ05Z5dMeAnLv5N4jG3RpjfZyXxy0H2QuVK9z1qFAaBoEdS0EHA+OHToINQ1EyiMVMWgAwHO3zinXahWZudOgXUWzIhhwDU2qpLxcfSnHBMZShsy0VWynIPJLuiUiB3S4Gl4Beu++7OA11rhpIAPwq28IGF4XQN6U2+Kq5ToG2TR0UIQ8BWaWYq41PcG13eTkr3gvj7Z4eB+SCU8fUmi1872hxLpVO2R42pCcFcTvsv0Gq876QqkAGfwmjBs9oOYWGMzPQmhjb8hDlqkoSYJYSA9J7QRjX9t6PCIXpx2okbL27ElKPZlCf54w8TZDoM5\/w9Uon\/HW3I47ZGhWK9RjLjuOTLzugDyXp\/W2k2vMhA+wRBgDjnPejoz7eBPG\/RN1Uwc7nbC8G9ZINXKXC61sIWIUUNPzYD4v0x9IJXwWm3jKCtxFn67zuezCfN56Xr29XZWC3DbGj6bd19ttlR7D2xXEpjeXOSsBcjomezhVUqxUGRgVCghfiE1dEu\/tTBua2OCVeleB2Tg44voJatV5pEUtBFejT45C\/TW\/ncDo8ntGIJq9XrwfZbO3CThdJhhTIrts2NDPVRfjGENmwYrKXroPLZ7+6rWgqFfSVWvs7R+rGLWZ3BiRBMBkGvf89Hy7+RKpbNsQWdHSD2oYEcG6XUc0DnXyQZjQH62caupn5cApKIDKgWLzfbhkGGiLoFGqoGlr2I3kn5\/3+A2ABfumW99BkoierP9+0W6H\/VcX6nw8vpdgrODVsmSDq5cqNHuTO70zojR5jUOesKl7LA7kmyfJVilQxzONsDQ61nNEGCzS0tUEgM82St1scF+2juM2ITbLELE2yfQqGmRe2hIhMtIOw+WZ+fmT3MXEn7vGXibBA3XbDHSs6MZfoQJZVGGT7+5\/Wl\/G\/ropW\/z5UvF6mKNaBlJJQQ05O1F7ouI7kLsNUpUVoBuErftuq3MclniVRlqMBVXsLAUsUdHYMsuiBvpGJgHZtvzsX3MsyCwOkkOem4kElrXRK69wcmg=="}
02386{"flow_id":4,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":690774,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUiWoAADQGBbgXORgQwKgCEQG73rrg+VqMaJ6p24AQAOu3qwAAAQEICpZOKfAoVVIb3CjSG8W+zO6s93o3NrVx+sWT7unr9HQTwuUAwYwy2juLUDN7lcvCpisJgbWd16dtEYIHt8jWpTaLm9qulXwqVpYAojWFmzoKfoOyYpKuCYDH2xLo0TbprJFVK+RtIyT10mHF2WV1fLYH8Nitm6r7ggLOiiSmcGcu74aH6TM4cpCsP55XolFNJ\/1T94Kju3LU6ENc4OSG1u3fLVuC9K72+rRTvJii7xH90Y4rH\/JqdosPRC67+xsS+J8WSAV3+7mdcEDvIQbyZ\/AjN\/Toqj\/VyX7saKR+0R6an20SGOGVN3Xj5CK4GNgT6+Fmm8cO5vPvA+7XX6xx1S+RCQ+WZSyDTOn9DxF1v\/sroK9tTPRkUTn42dq5e+U3N5OuXO\/OCFJeAXUTOHTVseLasgMixaIsHXp5HxBRQkElKz\/0bmp1fTB\/YnXw0nyF9+jfNkytwIRPNsyhjOsEBD4b\/mX8qjiDKiIWwLjBrKMQ68435ehvs0WrLDUeNQ23Sp6q1IstLR328zmVrHmOH2+QvlABOhgAPBeoHYRhVYkTEh\/+dAHTgjzZUlvhYTaHZx\/OqEXYrIyUxeFLNmPXfGpbTxgSfHrkM3yx65gSt7R\/NZDIL11Ts0PqLdpcqxnSbL6QCyL+4qgSRSxdpC\/Gh5+65M8+4sTKj7rRE7utOJNH2WE2Q4uMx6hzy74S7fmh5V66QiOA\/EbFdGvWGj5cFpCg6S3WOOrzPwLMJwwhF+BHslLFzgBONVoJKIpF6D6K\/dWAJCPKQ4cTArvTaCg\/111QAmHeAksHUTli4Opff2CnEc+0D5fdKit50wTOekHrzV7T3iFgAmEoR\/owPDh\/yvEv9N5ZCaPS1xW0xe\/cEr+wc38yf0aU0rS6ANXWhRqM5pwhuCtuezIikq4a9ZEv6jTNbVI66UrEmLlftFxKEKm2fZGBYyrh2AeEwt+PMDFPjJfVf9vChGjdLh0juqCn9J3K0d9AapVSbr0oEjUEtH+Vj+dmw+9eDVUv6bxJgKZtozf\/7GpSeWDlKc5wMtL7fBzF6jtBRPqIKSqL3BMswelCm8egzmXM41YX668TEVzFkYxLxFIB+g7yP+ePHuYz4ceiF6jBV1RpPK4kCEdc+qhxs\/F7BsyM6K2coNxH6eXgjjOrZ+GLZiP90I22Q6k1taIhgV0y6Fnxche\/wKrhd0o+Ht+2Daqc8WBiY9ZmPZ0qWLjG0DJOxEywrmu\/RBZaWLCgIHqLyqBFDa+qGZw6tY5YnkPgPVrEqEXOqwm5NelxwHHb8l\/mS0iuuVMquEQrsV3f0SfzAAl8w\/MVOF9OencG85LVrqTB5\/tgc5Op0coscxcEGCbrb75zx81VcXUnO151f\/1YabjcVRkzLGlrcBpkZzlGBKuG30Y\/0x3OyFmNg1COmirie12cyb\/V7zt9h+tkosv6XE1i6p2AhmuUBdhn9\/9HKLUCG\/va4wJCob03jUk7RxeBvcPDmZ\/eZDGov\/z6WoxfBu7KYx41KUXSVDO3eiVdDQG+M6y5AH2NZzKv1eIp5QzGfwoWNZbyX7U4DwZ5Ck9EDWLy6Xmd1+FJdUJMRnyVMjAa1iVdv9d1EJrqwJjPpCMdWrAHd6WpxrwnGql\/T15uqhCbqld5UpQTsywDFc8m34GQpHOlpQi2EVThke+plojMgRk1vVJNcrmZuydcr5ed4+HLp6UPQ0koL0o7\/NiRxQ6IeCLcO66mEtnYAbT+9IyRcrnjwVF3aJDlegdLmq6famVO2UtyJfgYdPysbMXYxPIHGELI6LGIA60ZEN4WHS78ilcUN3tDQ1NZjIs6\/Nj1X7epYJRSeYqwkoeH8\/gAzvvxtmK6XnTsK2zVRaO9x2DHnBS5tKgRiKmxDiUUaHSevOdf2aGHzYbN+yZ9vXnSTlMVQkrPFTd8R+P669ek88Asu5kU"}
00424{"flow_id":4,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":693471,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN66Abtonqnb4PlVzIAQA\/QcNAAAAQEICihVUkqWTinv"}
00423{"flow_id":4,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":693489,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN66Abtonqnb4PlajIAQA+sXfQAAAQEICihVUkqWTinv"}
00423{"flow_id":4,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":693539,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN66Abtonqnb4PlgLIAQBAARxwAAAQEICihVUkqWTinw"}
00435{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":704415,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO0G93Mi4fCtwKgCEQG7wEr7fyfqQK3D1aASaN\/uCAAAAgQFrAQCCApkFVboKFVNgQEDAwg="}
00422{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":706588,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrcBKAbtArcPV+38n64AQCBZ9JQAAAQEICihVTfNkFVbo"}
00692{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":706645,"pkt_caplen":263,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":263,"pkt_l4_len":229,"pkt":"xiwDYGpkxGGLNYKpCABFAAD5AABAAEAGY7fAqAIRIuHwrcBKAbtArcPV+38n64AYCBZZNQAAAQEICihVTfNkFVboFgMBAMABAAC8AwNdhdJvuXs\/d642PJRF7UI\/AdVwXtSGkzdnBwsA+gkrIgAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAZwAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcACgAIAAYAFwAYABkACwACAQAADQASABAEAQIBBQEGAQQDAgMFAwYDAAUABQEAAAAAABIAAAAXAAA="}
00786{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":22,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1569051247594,"flow_last_seen":1569051247706,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":197,"flow_tot_l4_payload_len":197,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00435{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":709413,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO0G93Mi4fCtwKgCEQG73rtLEL7asq23cqASaN9\/CQAAAgQFrAQCCApkFVbqKFVR7wEDAwg="}
00422{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":711067,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd67AbuyrbdySxC+24AQBAsSOAAAAQEICihVUlpkFVbq"}
01119{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":711181,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGYnfAqAIRIuHwrd67AbuyrbdySxC+24AYBAsbUQAAAQEICihVUlpkFVbqFgMBAgABAAH8AwNvt088oc+wJ\/keps9Nd59wAmt0exXgkmLypgOxJ3yQxCADkYPnm5qJAc81bPMGd68mU3RC86F4komLht8jFwvJuwAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAgDvSu5WvgGSyqdaiHWcjph88Rx8PSoGix+VWVEEqv9GkALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00796{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":25,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1569051247600,"flow_last_seen":1569051247711,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00434{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":714648,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO0G93Mi4fCtwKgCEQG73r1n96jrbdjHEKASaN+tQgAAAgQFrAQCCApkFVbrKFVR8gEDAwg="}
00435{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":714775,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G9nMi4fCtwKgCEQG73rwJHv1\/xsFthKASaN+4LQAAAgQFrAQCCApkFVbrKFVR8AEDAwg="}
00423{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":716291,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd69Abtt2McQZ\/eo7IAQBAtAbwAAAQEICihVUl9kFVbr"}
01121{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":716407,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGYnfAqAIRIuHwrd69Abtt2McQZ\/eo7IAYBAtWzgAAAQEICihVUl9kFVbrFgMBAgABAAH8AwNt7hXbpLjXMRR\/bxdtzkjvB4xS1PwDQ6PxbRaUrO0qwSDVSMeS43dgzqJuDX9Nz7D77w9PJu+JEAZF32iZkikHGQAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAggkVxJnNxvx7yRJ3IWr6\/bePVPj3hLoE6hEcrUhAYuEMALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00796{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":29,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1569051247603,"flow_last_seen":1569051247716,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00422{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":716684,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd68AbvGwW2ECR79gIAQBAtLWAAAAQEICihVUl9kFVbr"}
01123{"flow_id":6,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":716836,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGYnfAqAIRIuHwrd68AbvGwW2ECR79gIAYBAtCawAAAQEICihVUl9kFVbrFgMBAgABAAH8AwMC\/iq\/29\/bfQmL3NywRdaHPxawxpN\/gjq67bcZmEul+iC0YvLniq6GFUwRgLKNIv\/K1BW3lLi2Y9hIO9HhpF3gJwAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAg4ti0IjmHHcY34Qh7EHKKwWM8SOIvozUrzGlVTZfDoB4ALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00796{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":31,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1569051247601,"flow_last_seen":1569051247716,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01249{"flow_id":4,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":736785,"pkt_caplen":673,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":673,"pkt_l4_len":639,"pkt":"xGGLNYKpxiwDYGpkCABFAAKTiWsAADQGCPgXORgQwKgCEQG73rrg+WAsaJ6p24AYAOuJWgAAAQEICpZOKh4oVVJKnIdxTDQCa3bwpp8qZUEnScFYs3z3dWDBGjzryxaWrIi+qzoWSMnArxF3sImdbCn52xRLpVshwlw+WqkG3hLIfozqw5ZHTeAfADPExF\/wey\/sr0EihW+TfoHNmSbwGc0ikc1SDLvnbvY0fX2A4pmZj4jKsnVwZoRndmPrFndUPs9rUpHAfuV9ErfRLYgvbD46TyqH0H2ABuXN6f8uunLcCX6NOcBSsdPG3pv7M3BpVCgoXNeVmEg9TQdA2z+ddzK2M30O0y\/\/mrGq4Pb0SfrA8UUwXw5BhJHT2594o0FS3phkSwE3Adkc3NQIVWiISpJ37nre6SGOBxcDAwEZroqigXUEsChF9TPrIWnhL335\/QTgDSXCse7a8tfDZ30r7uZclwhK5hcYan+zLya7EEteRNl\/QlPJcQ4vbycyu4vCd6WPqPJ\/DYVl3pcffiA2MNdXJKrj0e6JyuDfLHhmKw5hU86hih3Vf1cQUBBpqpxQvLhwbLc5oxhqjZ9JAp6pQyceyui6v3OkzLh0O112i7yTrliNBGBPKJSyZ+Pp\/Mo9GEnwiCGln\/yZ++BPDIL2RDocRF7jvLJfPcyuiGsSxA4P\/HsIT5bZS3Zscm6MSq7cJ7qORcBYYtdUI4pt+IDz2gHWZrp+ipI3wud6YhZtuyq9WquduBrCl9UqpFM2X+oB+BzgfkPZAxbz6zRNnwg2wqPaFkkTox0XAwMARTp6ekbMYoGvY57U9nXsg7rDWcypKmPyEBHt5j4665u7PEuG2oIHovZFn30sZHD\/rMQHzFm7aVRYHI2Yv4CfSBbnBw4YFw=="}
00424{"flow_id":4,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":738209,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN66Abtonqnb4Plii4AQA\/sPFAAAAQEICihVUnWWTioe"}
00535{"flow_id":4,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":745981,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":146,"pkt_l4_len":112,"pkt":"xiwDYGpkxGGLNYKpCABFAACEAABAAEAGSHLAqAIRFzkYEN66Abtonqnb4Plii4AYBAAqMQAAAQEICihVUnyWTioeFAMDAAEBFwMDAEWt3vSyYiyXNihI1uEvJcD3z4UZlRCq\/v6Noa6tzj1C2PFXglBI2RcmKUroHMPUFJ7ycyKUh9XP0G0NH2GNDEqL6FJpfsY="}
00422{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":816804,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0cO8AAO0Ghowi4fCtwKgCEQG7wEr7fyfrQK3EmoAQAG6D7AAAAQEICmQVVwQoVU3z"}
02357{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":818667,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUcPAAAO0GgOsi4fCtwKgCEQG7wEr7fyfrQK3EmoAQAG4WPAAAAQEICmQVVwUoVU3zFgMDAFkCAABVAwPc909jc\/a4iqBfpiekbcU8+LL\/ViLUa3VEtY9sKaHIISBOpjSQqcfDFIpBjm15LStVN32XWcn9Y5zNrzIlx4N\/GcAvAAAN\/wEAAQAACwAEAwABAhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3Bl"}
00843{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":59,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1569051247594,"flow_last_seen":1569051247818,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1637,"flow_avg_l4_payload_len":272,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"303951d4c50efb2e991652225a6f02b1","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}}
01818{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":818679,"pkt_caplen":1095,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1095,"pkt_l4_len":1061,"pkt":"xGGLNYKpxiwDYGpkCABFAAQ5cPEAAO0GgoUi4fCtwKgCEQG7wEr7fy2LQK3EmoAYAG5f1AAAAQEICmQVVwUoVU3zciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEypibcpB8suaanHOY9SoCSN0NHwGMJ4pIWQvyBijPTWA2EP2EPfqnXdUisC4Pb4OM5ySBmLP6w0pboMLmiQBa9gYBAQA7WFTYV3qMJPFywNI4IVakynFqqq4OCC2y9MUP9g3f\/gQ6\/b4BQTX5tnnzs45u7uJ5n3ycLcVaexZSXSzBH9THuSYGTgWqTO5IPiwzH64FkTGOGsrH5ixWuBCfvK6bvg+isWHFVkrk1uzOPwuvuQwSjIKEPgHhE\/c1KTV2RXOHBYJnemfYtsJAMdAqySwO27qbYiyuci8QZVkGbzqlirqZ\/V+xkcpVRj1zVjRYELjuGO\/KuVU4DfrD3MjxMOgGIQ4kd4locHD7VyUCOeFFDf0gX3CrOlpPFQYgsWZ5Y7A5d0pIkhzeaxZS2DWW3wqmU2XzzJ3\/MdcgBis9zMbCg5YHFgMDAAQOAAAA"}
01231{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":60,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":7,"flow_first_seen":1569051247594,"flow_last_seen":1569051247818,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2666,"flow_avg_l4_payload_len":380,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"303951d4c50efb2e991652225a6f02b1","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00422{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":820337,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrcBKAbtArcSa+38xkIAQB+9yVQAAAQEICihVTmNkFVcF"}
00422{"flow_id":5,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":62,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":820470,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA06d0AAO0GDZ4i4fCtwKgCEQG73rtLEL7bsq25d4AQAG4TtAAAAQEICmQVVwYoVVJa"}
02355{"flow_id":5,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":822394,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXU6d4AAO0GB\/0i4fCtwKgCEQG73rtLEL7bsq25d4AQAG7q5gAAAQEICmQVVwYoVVJaFgMDAGICAABeAwMNXD8fXbNx86yVNZArROawe23r2GZoQa3gLHkrH4BfYiDYrD5r2btJMgmiQISYggyjzcYEtCwpCd3hAwR36bb9U8AvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00852{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":63,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1569051247600,"flow_last_seen":1569051247822,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01829{"flow_id":5,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":822421,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARC6d8AAO0GCY4i4fCtwKgCEQG73rtLEMR7sq25d4AYAG6ByQAAAQEICmQVVwYoVVJaZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EE3ecTy+6jnlMrNpbZTIAwArvkiOIfUg610O9bIAAW3K+f6BdAyjwzCSwQQGhwDJQc9kNXtCjtMOgrhB58Hf6YUAYBAQAOYV7EzNIKjxhuqbi91MheopXcoDmIsgmHAwsfk5nPLanTx9Y+0OGVH\/cQPWZKAeQKebYJsZuYA2jgH86xEruWZQgRpJjzY5LGsrFgK8PWH9Kuv\/Aks16UO0Fljri74+vQ1PqVg+C2qPlhTXWfYVZWx3CRgcmCRuGS6Ahmy+tQajp8rd3eHE+9nwzyw\/8W+mjs7XWJREMJWA2kKUMidGpPdbknJdGDk\/P8UIoX3zvNEj12pjk0QnOMhrlzAROUBsM4zXRDSQrgAQuQkIHXFb\/AkAMWwonXebSDBNwnBu40MFVcWw4gCpwV9eN5CWqVxtWuhBTxNmgsnRxsjP26R0IaFgMDAAQOAAAA"}
01240{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":64,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":7,"flow_first_seen":1569051247600,"flow_last_seen":1569051247822,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00526{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":823475,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"xiwDYGpkxGGLNYKpCABFAAB\/AABAAEAGZDHAqAIRIuHwrcBKAbtArcSa+38xkIAYCABaGAAAAQEICihVTmZkFVcFFgMDAEYQAABCQQQ0a64xGwwi1kkJsdUkQiNOXRlFpHsfkxHSAhcTsXv6UyZKkk4J1ZCtXUXGlACAfofI4Wt3Eai4rLftrFZhdx5J"}
00423{"flow_id":5,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":823951,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd67Abuyrbl3SxDIiYAQA\/cGEQAAAQEICihVUsZkFVcG"}
00423{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":827539,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0\/+sAAO0G948i4fCtwKgCEQG73r1n96jsbdjJFYAQAG5B6wAAAQEICmQVVwcoVVJf"}
02356{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":830388,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXU\/+wAAO0G8e4i4fCtwKgCEQG73r1n96jsbdjJFYAQAG5scQAAAQEICmQVVwgoVVJfFgMDAGICAABeAwMvJ3aJtK0kaecaCZoe0tWDQbGlv7Y+K9fLr8mRSrrnUCDZ0QnDKT+KoPSvU+UzJyw64qxui2t3eVV6nNiyIB\/wKMAvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00852{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":68,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":6,"flow_first_seen":1569051247603,"flow_last_seen":1569051247830,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01831{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":830426,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARC\/+0AAO0G838i4fCtwKgCEQG73r1n966MbdjJFYAYAG6dQgAAAQEICmQVVwgoVVJfZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EE6KGWqENscs7my902gawi82EKGEBY1OGfCfEfs7ccHGRh\/ivx4SUKMrTlS5v1UjrC46CJp46iaaYMUhfqQloWHQYBAQCK5xLvS8uYOH+now\/VHq0+02Yf\/3dOOduLRhd\/U10lyXbakGblKOev0HYzCWD1LMPGzJ+aAqSss1M0\/tRwNDL+MwmzLschKgXIEyFMjj+oV+knxenQFOJNP+AMJogCZ0ndTs+TrruKmq03cz5imW\/nL46yqnkx8gUP1Yu7AMbchxBVlAMph0uTVkFAFMHS59CeTXh+pYWTuiyGhUWJylpqoJ9cH8dpUVcvKwfOL4AhZTAlB058Vtw3SRtuIhbdKFTFYYRM8B2iOARPcnK52bczpoXKQd1Ppube4uIpD2t0FPo7ShsDqPM79kQtshChk1GlRFCGA+L5WL78DoirnVfdFgMDAAQOAAAA"}
01240{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":69,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":7,"flow_first_seen":1569051247603,"flow_last_seen":1569051247830,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00423{"flow_id":6,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":830427,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0qogAAO4GS\/Mi4fCtwKgCEQG73rwJHv2AxsFviYAQAG5M0wAAAQEICmQVVwgoVVJf"}
02356{"flow_id":6,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":832906,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUqokAAO4GRlIi4fCtwKgCEQG73rwJHv2AxsFviYAQAG621gAAAQEICmQVVwgoVVJfFgMDAGICAABeAwMfr0tPJB6EerPxtB9rbk4yB+ls6Zlwm2aEnwwF4DJG5SBjSOP6ZrEXGLOGyuPQLd8ex1o\/\/eXmbMaXqtuiQ9iL+sAvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00852{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":71,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":6,"flow_first_seen":1569051247601,"flow_last_seen":1569051247832,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01831{"flow_id":6,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":832918,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARCqooAAO4GR+Mi4fCtwKgCEQG73rwJHwMgxsFviYAYAG4fHwAAAQEICmQVVwgoVVJfZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEdfPoVIyelAs1jDQcYxNUltibkItZOC04agY2rkl7kMMiBS\/aF+0jsINgkrbWwWAfbwuwerivp8REahUHCyJFuAYBAQAwgXAg1F\/KADI27hgUi\/kZ2sOJHbC\/ZPcTIYXQ1w90dtoz6bZyrm1epVwCQwjBL2QjpYwnDUdIPvsjjmkEb5S3D8Td13XPzd1jHR+whv0NGBxiBMR+u2B3dFNLty6clmqhY7\/y55vsTHDSX3GA89ayJr86+2Cyp5bNhpW\/sJYDYfpH82gx73nDCPQQTGxxTDJPQLZlf0FPd+OymguMU5XiHADFr\/rMRdzxd1YvV1NC8DRBwjXXeZgaI8MGGg0WqD47SPHU3AWGmz8DHk7YkMiB4a20GDuRbi6NkKteoBMtuoULvZMUoeTOPp+YOVNtFbUvQxiAnMf2jMHrb0HSOxB4FgMDAAQOAAAA"}
01240{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":72,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1569051247601,"flow_last_seen":1569051247832,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00599{"flow_id":5,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":833987,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGY\/7AqAIRIuHwrd67Abuyrbl3SxDIiYAYBABg8wAAAQEICihVUtBkFVcGFgMDAEYQAABCQQTzJ1yPIXJ3ZnR+vGzI54jrzhnu8C3zk3AuTzCiaxGYRAyma\/mN8ZRj03ZTAyyUj+D\/l2fAgVRsNhr3Y0B3RZ5gFAMDAAEBFgMDACgAAAAAAAAAAJjG9\/FrrX2\/si5tk63YfV\/QxCZCnOQaYOIilQwA+2OO"}
00424{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":834319,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd69Abtt2MkVZ\/eymoAQA\/c0QgAAAQEICihVUtBkFVcI"}
00424{"flow_id":6,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":834575,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd68AbvGwW+JCR8HLoAQA\/c\/KwAAAQEICihVUtBkFVcI"}
00598{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":840191,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGY\/7AqAIRIuHwrd69Abtt2MkVZ\/eymoAYBABMcgAAAQEICihVUtZkFVcIFgMDAEYQAABCQQSAJzWvCnK0aJhUQQC6oX3wq29Zh+S2wSQpZdMfEgVug8N7b1hQ6tqKVONPcnNAVkGw03nTK3ScsEhoHjv7zPddFAMDAAEBFgMDACgAAAAAAAAAAJz8B9mobdEuxCQMKA\/FdMuU\/\/5gEuyfr7x4e9qsJmkA"}
00595{"flow_id":6,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":842977,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGY\/7AqAIRIuHwrd68AbvGwW+JCR8HLoAYBABfPAAAAQEICihVUthkFVcIFgMDAEYQAABCQQTX9ABbSXAnuBVjrUckqWb55UlmE4yvNWkoJQkka9DAHLXz7MQ8dkmMxJ1rEj3fIxC49HC2wJuR2N2vx59EgawEFAMDAAEBFgMDACgAAAAAAAAAAN3aOEJmmIah7\/RbdRsJWUPclmEEGateGdrsMcprBICz"}
00494{"flow_id":5,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":943194,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABn6eAAAO0GDWgi4fCtwKgCEQG73rtLEMiJsq259YAYAG69TQAAAQEICmQVVyUoVVLQFAMDAAEBFgMDAChwMq\/o++J1m+aZio58YaG66jfGqIU98RNrHtG4md66XLBGsFJo88BC"}
00520{"flow_id":5,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":943223,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB56eEAAO0GDVUi4fCtwKgCEQG73rtLEMi8sq259YAYAG5XAAAAAQEICmQVVyUoVVLQFwMDAEBwMq\/o++J1nL4edJ02PnylxIyl\/o9XXSsLthTjT3nyUBTFRaigAk2tNn+mcrb9zDm7H2TD5EflHVxrHRArQAhg"}
00424{"flow_id":5,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":944284,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd67Abuyrbn1SxDIvIAQA\/8EwgAAAQEICihVUz1kFVcl"}
00498{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":945815,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGZEfAqAIRIuHwrd67Abuyrbn1SxDIvIAYBADqXgAAAQEICihVUz5kFVclFwMDADAAAAAAAAAAARlUoQDL9AONRZWZoPWvYVJPRkg2\/2hibkX8OuOPQ5LyLZdawMsJcPU="}
00493{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":945833,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGZErAqAIRIuHwrd67AbuyrboqSxDIvIAYBADlUQAAAQEICihVUz5kFVclFwMDAC0AAAAAAAAAAjAVvcrU0na4NUOjlwgd5atWB7V6QpDGfuOvr4T70XZlHxKqtxg="}
00482{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":945883,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGZFLAqAIRIuHwrd67AbuyrbpcSxDIvIAYBAB+HgAAAQEICihVUz5kFVclFwMDACUAAAAAAAAAA2VWwXLzP6p\/oY8NIHJAATFoPmGKNJAr594bVj3A"}
00496{"flow_id":7,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":950911,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABn\/+4AAO0G91ki4fCtwKgCEQG73r1n97KabdjJk4AYAG6hewAAAQEICmQVVyYoVVLWFAMDAAEBFgMDACiOQpHtZL+9E9bSiyV\/Gp9tSl0qsmyckCGSx0xbf\/YtXkcjrcmzswHT"}
00521{"flow_id":7,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":950938,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5\/+8AAO0G90Yi4fCtwKgCEQG73r1n97LNbdjJk4AYAG6CkAAAAQEICmQVVyYoVVLWFwMDAECOQpHtZL+9FI0pdylhzWC\/6ykmz+h2J5Qx+DGlPEvIGz+GnnM28oWlvsaABZk2H4WTbHBUtEF4d1\/8vBk6BWm+"}
00425{"flow_id":7,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":953035,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd69Abtt2MmTZ\/eyzYAQA\/8y9wAAAQEICihVU0RkFVcm"}
00499{"flow_id":7,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":953546,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGZEfAqAIRIuHwrd69Abtt2MmTZ\/eyzYAYBADNtAAAAQEICihVU0VkFVcmFwMDADAAAAAAAAAAAbsPqSjCb\/jHraCKqhsVJIh624VO1mfR5nUTyA9i9BW6LB36wbMgMHc="}
00494{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":953568,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGZErAqAIRIuHwrd69Abtt2MnIZ\/eyzYAYBAAjCwAAAQEICihVU0VkFVcmFwMDAC0AAAAAAAAAAr6sauNFu3vXjP63DLrlvC+MzCGBUu7+ziHidUza7210QPmn6wk="}
00483{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":953583,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGZFLAqAIRIuHwrd69Abtt2Mn6Z\/eyzYAYBACk7AAAAQEICihVU0VkFVcmFwMDACUAAAAAAAAAAyTc6C2A8\/LkfdLsG8JvPnTE6MhXKTD+NtirbEKH"}
00495{"flow_id":6,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":955904,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnqosAAO4GS70i4fCtwKgCEQG73rwJHwcuxsFwB4AYAG5sewAAAQEICmQVVycoVVLYFAMDAAEBFgMDACh\/EvinPkBCbgdYRqBmOxnOdBzZJ9qyVVQWJ6OwzGFp3jpRgvwV80pt"}
00522{"flow_id":6,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":955916,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5qowAAO4GS6oi4fCtwKgCEQG73rwJHwdhxsFwB4AYAG6PPQAAAQEICmQVVycoVVLYFwMDAEB\/EvinPkBCb56\/Y1mdD9P\/nshsSf5SokuZTH+sZmZH76Sk+7zDkIOGHagcz4nDQPP6t4m6HxtY+7KWeRDkJHbK"}
00425{"flow_id":6,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":958406,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrd68AbvGwXAHCR8HYYAQA\/892gAAAQEICihVU0lkFVcn"}
00499{"flow_id":6,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":106,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":959283,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGZEfAqAIRIuHwrd68AbvGwXAHCR8HYYAYBAAu\/AAAAQEICihVU0pkFVcnFwMDADAAAAAAAAAAATcufglEViLPiPjL092UEQJo0U64vUF2UFkY53GOwbJOwkAvWB0AwLM="}
00495{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":959300,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGZErAqAIRIuHwrd68AbvGwXA8CR8HYYAYBABEBgAAAQEICihVU0pkFVcnFwMDAC0AAAAAAAAAAqISE8B12kMfYa+2uGxDkEAjhOLHV1PQbjMZZA9t\/Hrkm215chk="}
00482{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":108,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":959407,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGZFLAqAIRIuHwrd68AbvGwXBuCR8HYYAYBAD1JgAAAQEICihVU0pkFVcnFwMDACUAAAAAAAAAA35IIP1PbvAvAh7sE6GkD8KbJNOMX2z3shtqa05K"}
00424{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":973291,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0cPIAAO0Ghoki4fCtwKgCEQG7wEr7fzGQQK3E5YAQAG55YQAAAQEICmQVVywoVU5m"}
00497{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051247,"pkt_ts_usec":974411,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xiwDYGpkxGGLNYKpCABFAABnAABAAEAGZEnAqAIRIuHwrcBKAbtArcTl+38xkIAYCAACOwAAAQEICihVTvxkFVcsFAMDAAEBFgMDACjF9vt\/9gkmYguZ\/E008ELB8CGGKKgGnT35n32pwCXRS\/STmslJWMGa"}
00423{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051248,"pkt_ts_usec":83530,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0cPMAAO0Ghogi4fCtwKgCEQG7wEr7fzGQQK3FGIAQAG54fQAAAQEICmQVV0coVU78"}
00495{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":138,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051248,"pkt_ts_usec":83551,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABncPQAAO0GhlQi4fCtwKgCEQG7wEr7fzGQQK3FGIAYAG5cXgAAAQEICmQVV0coVU78FAMDAAEBFgMDACjFKRzNiN688WuC\/jhhgMDnvnEWIkXsOIwqIk1\/je0ktQnyQDtkTv0L"}
00424{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051248,"pkt_ts_usec":84947,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGZHzAqAIRIuHwrcBKAbtArcUY+38xw4AQB\/9wSwAAAQEICihVT2pkFVdH"}
01017{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":140,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051248,"pkt_ts_usec":104787,"pkt_caplen":502,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":502,"pkt_l4_len":468,"pkt":"xiwDYGpkxGGLNYKpCABFAAHoAABAAEAGYsjAqAIRIuHwrcBKAbtArcUY+38xw4AYCAD9QQAAAQEICihVT35kFVdHFwMDAa\/F9vt\/9gkmYxL\/+ShPTbFvI1PSPYhUM2de99uXXOHXe9OCXLAUfarkUFfRoe5S47APECytCBHsU0u7TdOM\/XF8xVecTCpQuOm6IEHioppxi2LiRb6vTlZfdTzTgq8ExcQVwy1FsKT5KSeMhsz1VrnGNNkKTe6g9yy1yjgMe7wf\/OZ60WcOhsNRAUUUrmlgEmXRmDQXh61e8dDNIAFuxrKkVrihwuZtI1leYNUChEvuTsGPsKolArsOXDwnuc2791g3u46Vb+P5NgXhP\/GwVi06j1An4YT0zQ+H1zJQ5jv0ZeQLF+tW4yxbichxXk8GrqQYk7I+t+w6WSfnDUjOulq15JRfVl1HArxinr7NuRrAWd9wpdBZPIs8UeQonaxWS9EijXMrsnMZjwZODw9cXwmnF0iQT5V1IjxpZt0Ro7pTOEoSsWww5eXtxWQq6So6o8fP1Nk3wxRHcFHtqXUR0ojeEYUhYR8k+TZXdb2m59C3zrdwC+x2kqxLgwN337oSIRUgcCiGE3mcm25rRLWcfutMjVWfN6jzcPjvqsGnAOIR9r8VfnOBoq2GToS+NZyDIQ=="}
00808{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":147,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051248,"pkt_ts_usec":547165,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/2DBiVgAcCABFAAFIKTAAAP8RkXUAAAAA\/\/\/\/\/wBEAEMBNJw9AQEGACG6jqoABAAAAAAAAAAAAAAAAAAAAAAAANgwYlYAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwoBeQMGD3f8XywuOQIF3D0HAdgwYlYAHDMEAHanAAwKTHVjYXMtaU1hY\/8AAAAAAAAAAAAAAAAA"}
00808{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":148,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051253,"pkt_ts_usec":252519,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/2DBiVgAcCABFAAFIKTEAAP8RkXQAAAAA\/\/\/\/\/wBEAEMBNJw4AQEGACG6jqoACQAAAAAAAAAAAAAAAAAAAAAAANgwYlYAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwoBeQMGD3f8XywuOQIF3D0HAdgwYlYAHDMEAHanAAwKTHVjYXMtaU1hY\/8AAAAAAAAAAAAAAAAA"}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":149,"source":"signal.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1569051255515,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.146.144","src_port":56996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":149,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":515841,"pkt_caplen":112,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":112,"pkt_l4_len":78,"pkt":"xiwDYGpkxGGLNYKpCABFAABiAABAAEAG01TAqAIREfiSkN6kAbu8mMGjrFDpOoAYBADERQAAAQEICihVb2TeKRePFwMDACkAAAAAAAAAByneD5KHf7LhXiN5Pdq3wP31zhE4MGciEgckOq75+f9F5w=="}
00468{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":150,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":515860,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"xiwDYGpkxGGLNYKpCABFAABTAABAAEAG02PAqAIREfiSkN6kAbu8mMHRrFDpOoAYBABt7AAAAQEICihVb2XeKRePFQMDABoAAAAAAAAACJW1v\/IhTp91V+O68DpoE88kag=="}
00423{"flow_id":8,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":151,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":515909,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAG04LAqAIREfiSkN6kAbu8mMHwrFDpOoARBACJkgAAAQEICihVb2XeKReP"}
00423{"flow_id":8,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":152,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":539572,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0qAMAADEGen8R+JKQwKgCEQG73qSsUOk6vJjB0YAQBCu0hAAAAQEICt4q7JEoVW9k"}
00423{"flow_id":8,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":153,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":539575,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0qAQAADEGen4R+JKQwKgCEQG73qSsUOk6vJjB8IAQBCu0ZAAAAQEICt4q7JEoVW9l"}
00423{"flow_id":8,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":154,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":539646,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0qAUAADEGen0R+JKQwKgCEQG73qSsUOk6vJjB8IARBCu0YwAAAQEICt4q7JEoVW9l"}
00423{"flow_id":8,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":155,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":539776,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0qAYAADEGenwR+JKQwKgCEQG73qSsUOk7vJjB8YAQBCu0YgAAAQEICt4q7JEoVW9l"}
00423{"flow_id":8,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":156,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051255,"pkt_ts_usec":541412,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAG04LAqAIREfiSkN6kAbu8mMHwrFDpO4ARBAC0cgAAAQEICihVb4DeKuyR"}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":157,"source":"signal.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1569051257169,"flow_last_seen":0,"flow_min_l4_payload_len":23,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":23,"flow_avg_l4_payload_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"2.18.232.118","src_port":57017,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00455{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":157,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":169058,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"xiwDYGpkxGGLNYKpCABFAABLAABAAEAGjWvAqAIRAhLodt65Absqy4Q4WMZypYAYBABE5AAAAQEICihVdq6vX9qZFQMDABKEOlUEciue5QZs7g3+sWQHUk8="}
00423{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":158,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":169426,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGjYLAqAIRAhLodt65Absqy4RPWMZypYARBABBggAAAQEICihVdq6vX9qZ"}
00455{"flow_id":9,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":159,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":192060,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"xGGLNYKpxiwDYGpkCABFAABL884AADUG5JwCEuh2wKgCEQG73rlYxnKlKsuET4AYAQIBNAAAAQEICq9gUAcoVXauFQMDABK6ebhIWf6gqCdSaZoYDdKf06A="}
00423{"flow_id":9,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":160,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":192085,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0888AADUG5LICEuh2wKgCEQG73rlYxnK8KsuET4ARAQLO+gAAAQEICq9gUAcoVXau"}
00423{"flow_id":9,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":161,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":192407,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA089AAADUG5LECEuh2wKgCEQG73rlYxnK9KsuEUIAQAQLO+AAAAQEICq9gUAgoVXau"}
00407{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":162,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":194310,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xiwDYGpkxGGLNYKpCABFAAAoAABAAEAGjY7AqAIRAhLodt65Absqy4RPAAAAAFAEAABzDwAA"}
00407{"flow_id":9,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":163,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":194777,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xiwDYGpkxGGLNYKpCABFAAAoXdwAAEAGb7LAqAIRAhLodt65Absqy4RPAAAAAFAEAABzDwAA"}
00408{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051257,"pkt_ts_usec":194834,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xiwDYGpkxGGLNYKpCABFAAAo4ZQAAEAG6\/nAqAIRAhLodt65Absqy4RQAAAAAFAEAABzDgAA"}
00808{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":171,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051261,"pkt_ts_usec":595218,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/2DBiVgAcCABFAAFIKTIAAP8RkXMAAAAA\/\/\/\/\/wBEAEMBNJwwAQEGACG6jqoAEQAAAAAAAAAAAAAAAAAAAAAAANgwYlYAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwoBeQMGD3f8XywuOQIF3D0HAdgwYlYAHDMEAHanAAwKTHVjYXMtaU1hY\/8AAAAAAAAAAAAAAAAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":172,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1569051264073,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":73974,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGUS7AqAIRI6kDKMBLAbsF0WXIAAAAALAC\/\/9prAAAAgQFtAEDAwYBAQgKKFWN0AAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":173,"source":"signal.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1569051264078,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57022,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":78385,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGSLbAqAIRFzkYEN6+AbvH3a+JAAAAALAC\/\/8ydQAAAgQFtAEDAwcBAQgKKFWSTQAAAAAEAgAA"}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":174,"source":"signal.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1569051264088,"flow_last_seen":0,"flow_min_l4_payload_len":55,"flow_max_l4_payload_len":55,"flow_tot_l4_payload_len":55,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":56263,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00467{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":174,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":88425,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"xiwDYGpkxGGLNYKpCABFAABTylIAAP8Ra+TAqAIRwKgCAdvHADUAPyTGAMEBAAABAAAAAAAAEnRleHRzZWN1cmUtc2VydmljZQ53aGlzcGVyc3lzdGVtcwNvcmcAAAEAAQ=="}
00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":174,"source":"signal.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1569051264088,"flow_last_seen":0,"flow_min_l4_payload_len":55,"flow_max_l4_payload_len":55,"flow_tot_l4_payload_len":55,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":56263,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Signal","breed":"Fun","category":"Chat"},"dns": {"query":"textsecure-service.whispersystems.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1569051264090,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":90815,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGUS7AqAIRI6kDKN6\/Abvpz5RJAAAAALAC\/\/80LQAAAgQFtAEDAwcBAQgKKFWSWgAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":176,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1569051264091,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":91926,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGUS7AqAIRI6kDKN7AAbuO10RdAAAAALAC\/\/\/fDwAAAgQFtAEDAwcBAQgKKFWSWwAAAAAEAgAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":177,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1569051264093,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":93006,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGUS7AqAIRI6kDKN7BAbuYIIuMAAAAALAC\/\/+OlgAAAgQFtAEDAwcBAQgKKFWSWwAAAAAEAgAA"}
00436{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":113301,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAADQGlLoXORgQwKgCEQG73r7gO6oYx92viqAScSBHlgAAAgQFrAQCCAqWTmoXKFWSTQEDAwc="}
00599{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":113960,"pkt_caplen":193,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":193,"pkt_l4_len":159,"pkt":"xGGLNYKpxiwDYGpkCABFAACz4rsAAEAREhzAqAIBwKgCEQA128cAn9JUAMGBgAABAAYAAAAAEnRleHRzZWN1cmUtc2VydmljZQ53aGlzcGVyc3lzdGVtcwNvcmcAAAEAAcAMAAEAAQAAAB0ABDavL27ADAABAAEAAAAdAAQi4fCtwAwAAQABAAAAHQAEaxdHWcAMAAEAAQAAAB0ABCOpAyjADAABAAEAAAAdAAQ0zyk7wAwAAQABAAAAHQAENMjD8Q=="}
00693{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":179,"source":"signal.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1569051264088,"flow_last_seen":1569051264113,"flow_min_l4_payload_len":55,"flow_max_l4_payload_len":151,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":56263,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Signal","breed":"Fun","category":"Chat"},"dns": {"query":"textsecure-service.whispersystems.org","num_queries":1,"num_answers":6,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"54.175.47.110"}}
00449{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":180,"source":"signal.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1569051264115,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
00432{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":115004,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"xiwDYGpkxGGLNYKpCABFAAA4YPoAAEABlGjAqAIRwKgCAQMDIGEAAAAARQAAs+K7AABAERIcwKgCAcCoAhEANdvHAJ8AAA=="}
00481{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":180,"source":"signal.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1569051264115,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}}
00424{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":181,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":116081,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN6+AbvH3a+K4DuqGYAQBAvjSwAAAQEICihVknGWTmoX"}
01126{"flow_id":11,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":182,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":116204,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGRr3AqAIRFzkYEN6+AbvH3a+K4DuqGYAYBAtznQAAAQEICihVknKWTmoXFgMBAgABAAH8AwPawK\/+wN1+Tx0CNiEAg+cUW3czvaCh\/qY5WXGzJz9xKSBQ\/3brog7H4kKz+Cr0Y+KAPc0Wuh7pzTw9CcTlpz8EzgA0EwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqACdAJwAPQA8ADUAL8AIwBIACgEAAX\/\/AQABAAAAABUAEwAAEGl0dW5lcy5hcHBsZS5jb20AFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAgQjLeK9mUdDm2SPbON0\/yv\/211C08osOnnwisGWfkQjYALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVANEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00784{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":182,"source":"signal.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":4,"flow_first_seen":1569051264078,"flow_last_seen":1569051264116,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57022,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.AppleiTunes","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.2","client_requested_server_name":"itunes.apple.com","ja3":"17305a56a62a10f6b0ee8edcc3b1769c","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00424{"flow_id":11,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":183,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":150664,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0riEAADQG5qAXORgQwKgCEQG73r7gO6oZx92xj4AQAOvkPwAAAQEICpZOaj0oVZJy"}
02378{"flow_id":11,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":184,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":151436,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUriIAADQG4P8XORgQwKgCEQG73r7gO6oZx92xj4AQAOvEnQAAAQEICpZOaj0oVZJyFgMDAHoCAAB2AwMA9vr9rkd4ApXKyDGM9DvNqLylQa2U3Kj2eYOyu9RJDyBQ\/3brog7H4kKz+Cr0Y+KAPc0Wuh7pzTw9CcTlpz8EzhMCAAAuACsAAgMEADMAJAAdACCVXfSN3Gm6j3Dzd6yKHirgAxbwYWbpS\/t6nzsX9\/1tHxQDAwABARcDAwAubSX2Yk494MC9aR7fCLNwMxN0Or0wXtcHzqTKZcy1Z7r1XEI5b+rsKAfvtLQvMRcDAxXa6CIxOumkbdppHVhUPPUFc9A0D2VreyuftXwz1F1aIcOpup2lw\/WinI9r84Oj14qP4mvLrzURHw05iQuzZQJcJffQ3n33JhH87R4b5SLH\/sWKtBdYmlv66OLR7cWh803EGzANE4\/\/50haa\/DfzI+66ZCXGVZ1cR0tPlKH4qGZ0\/teswg4plrYdA7F+UjB\/MgH04JHHhDrZT\/gW3XZsMjXqDRxMOe8zdLkVIZWowd0smMxhuYMHDnkO8L2p06dIu1Y9I1nrDgogegRm3IqIhnzBuclK8UolTqUfOTT8Rs8cL6yKMEFhKeHeTI2DCMgOEXXPIAPWDUelqwPg851vA02Ku6ItriMfedawd0VcQzNjSfqWq8ny0bLY431MeLy1lswpPf2rLrD4SsbAT8YGRYVVn6fezp1NTkVFTdty+YjXk+RUvXkuAbfcvrkRbSxzEkTEoJWEROx\/h9dvULj14VHUBU7W02\/LWGPup7bSV6zXAscGUmgJoMC9aF5ATH7abehZp10SOhmBZl+ZcZCLgDTpC2CuFTcKjTJGLBZ5blfnWZbzM83hdr2Dx6UCdIAAJR2AjgGfC82i95bSjhJS5IWB51v1res9laqPBGLK3YTUhr\/mVDNF6qVq3nJGELIqKXn9Ju5piQrbN8XBx\/e\/tJK0yiaYgzK\/U4uFtv5+l4nUqqhbMmpjyRcgzriES1wmgLtgiJWxOeNbaTleyPGIe6ODQ2rEg8WgV6MSRut0SJvcLtXfbLeG22ZSHtByXdj0TojjjUrwaPEHSvf9Ll0it+sCaiAHKpU8gK22cCzayJTNM1lihw6+iXYFQpSGU0YQzUCx6FpJeSzk1RyVa8oSaLkCRii5V2j+fvsHdAgImdoaSH5JLMPjgkuRuyCVpN6wuwwxhTzKpFAa1CdNEO1MTnFhruBh6DAvYID9mS9ooBfqYZe66dHMy87CdSuckAW0nPrfKxm6ejhYXB\/YyEZ6NL2Kx7keMZqrsR\/Ii2I2voK3tA0Z0d+nsnmpXKhDd9miuueeeSSm5JKv4A7eMJuH25rgpHErf8xRnpDId+P+\/ItJ3UUyoWNPIsKecvwbHpMSO5XoS4RKTP5ULhw4Ih4GTulI7dVthXRWrlMcZdPqaC+6Hfkr9vCX0O6BgWNfbnf\/LNIOF0MFwXHJFUZAHukuUl\/UuaGNwN\/p5zMsqxPJjynhIZ8o2Gx\/Pqa2UL0NaVNiAJ7P+PtDTSIjSRsHAtPKxOOpVBbhQxgA6jKs7CZE8qyzGzTzfm6U4uY3kpkuyg5nl7uo82UxJbGHXDwAE0s9UhR+bcq8NRbSlfimPjwGmDveTvXM6h94SIrtvbWxRvTE1jKYGjlsf4bzZoPCN+9mu6J8nfCfJfJxfuBIcW5tJOiifODQ+ET72qFymTL+xdQxSuWDYHNlH0kU+ZD8VgRwXxXzEmCPs7v5xJzz7uPEnnbZhFydli0o+GyMH1BtjAaoepUYM1+olAUC4OMjUaI\/haoRSwFZDNitVy\/sojBc2DIS9BwRB8pEbq+vKbml82NxLNk764m2a4sUxhtwW47ZUDtXDJpnNF1YfTNBPQsPsYhShPUNQoWk\/uxdsDKIr7\/hJnMNDpJOeMJqM0e5Ks+7bidksjRBVXEEiyn34wFqJBvEIP6ix7jF8EZn9yWVjKnpFuzR89k"}
00825{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":184,"source":"signal.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":6,"flow_first_seen":1569051264078,"flow_last_seen":1569051264151,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57022,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.AppleiTunes","breed":"Fun","category":"Streaming"},"tls": {"version":"TLSv1.3","client_requested_server_name":"itunes.apple.com","ja3":"17305a56a62a10f6b0ee8edcc3b1769c","ja3s":"15af977ce25de452b96affa2addb1036","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
02373{"flow_id":11,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":151667,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUriMAADQG4P4XORgQwKgCEQG73r7gO6+5x92xj4AQAOtdjAAAAQEICpZOaj0oVZJyn08AXZfpifqi3wkFAomv1JNbKYDKrsp+LsJ8qHOU6FtBsbmXn+KTk8wO2iHKdrz2\/8zP+U2ix2yLTK8qnthh9K0EGMQtT1Le7\/pv6\/2XqqwuYQ7+I7tGGlBpxwp\/IObWiQhvM7iCl1cdGimpZP4k8QXRDpzf0rqDc+13YjM0gi0OZx4kEN0hVrggAswtbozNmC8rsWOlT0kjfImkBpxXir3Y7+a2tED5tyVBciEsNAzErXFUniww4LzfCGy1T0eHu2EBL8St+jaItlcLzrl9H2Ll2ojYMs8iaILfQcTaP5evHSoFbRhNSHG2thuozP1+LkrFnUrShXJH0cf4hBic8VMq7dBeFQlsycpVOCSkCikEcQYtteLlMb1Qot84xoZ8ghEizN97L1eNqLSFie38BEaohniQHibduiY3bHluI95ZpV36AZZYSGXM2bJqxd8BNUhGikRILrmhDjn3Pr0nA6kHmE9xgTUSywLsWKKnTgrjDX2O6wSruCKXUblBI\/hVsyM5Eq4t5jgoHQlnn6tN52dztYz9NtsOmyktPFhVMFCeKu88ldqaR2ONc7dULXSpRfS9Fb2n3EgpU5dNdJ7QXz8qC6aY1uoe6cP7llb3eJS8KGX4UVLc8Xzmvdw7cN6onDkEYGBUtuVrB\/w+SX4Xlz8QnAi5Im8QqXuLXTeDukeBH6Ap\/bYrVOdOBw82b371MO19IuM9rGLTo7+jjn9zv+p1J59crNN9pQ6V+D+\/YgmYzmTfXGjQ0lYmeDglrg9toVcIxX4EhgQmlQImI2O+De2cxrCYB1P15WaYcrPkONdplqutl351pd0JEu5dnlmjvKk87HVc0k+rcOsEmGQbg0nsLQNZ1cBb9wZL5lQWaGydBQ3eMNCyKh6JPGUYgrANBuMB+YpIN0MbPC4yXlLSLS+agKuAHHFTb2LO+TX+f6l9x6nh9FaIoNzPm+kWkOPEwg7VFtxn38Ep\/E4ZqucAQjBK6nxN45DPsJ61oXTg6ibCjZ6nBYp49Z\/RT8VoYUyNqxhvyCeH5Z3TeeCEKcFFAk1k+cAihAt4aI6NlwjscxQFLo5HpVZY2ueB+ujQ5lP\/wW0tBy0XtlgnJJImrPSI8kJSidf1d8p\/KXHqrUQwxq5UkcUgDAHquUk5\/wBE1k2GNYFq22qCNb6Z8UDmQMQu7nChP9Ob\/LmJotdkaNbSg+y6SxEwclTyjLyIm+mOLOGPX7rKI3qa5NFkYhh8r2vGb9WMyq\/xLji75moCwAY642FWvdO\/J92DHXQuhxpNwfr73To1bDuLaAAKMPqsUUBqf3NgkVn1dlGjr08uanx0CQ+AWfOtMIiMBX5oQ4retDT\/3ziEI2QQ5QzPmjwqhhHeeONhOiCifwcnQvMonxQ5AUCY2QBi8kheX\/P4Ytbp8OQ7tupiyNSbuJDl6TPHBxINBISdToFsYmC\/pXIRnSShXnz+sbSgx+r8467NklxL5R2kGCSsf8pMZCL7ZIugGgCX\/P8z7MmezeDrIJrmjusr4qLIJ4NIDM1qKiFnfG7UYtIKjx05xeyCk+ch4pv+okkGkedwxtP0s0BVHPo5+MiofFCINSXZjOPdkj+wqM0xjWujt1s+YAue2yQbb5c\/\/vo61N13wrBEsELZgr0A+0QjOjsPACKwkW6sVdVxIe2yshPA3yFvJqSJ4C9q9ilZRoZuKUgJAA5Sc3BJujs1HNKWum8uYw52JQqZDYs08Kw7QPCsFiS8s3AauymBueYRR8aipzE0\/mF89nsyjz2tRdZ3nTgnsE2uU5gbjzUo8oFLHauutS3HBw2eUHQ24cFIoorVyvGu8LGsHvCrYP6cd67KjWYO48co5MBSsizfslv9Ec9c7zjX8rfMThTOkcKZn08l2P0y5FxFLMJvpNLQH3vA0bhcQ76kZBOEGxLJpXE3FlKj"}
02081{"flow_id":11,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":151976,"pkt_caplen":1282,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1282,"pkt_l4_len":1248,"pkt":"xGGLNYKpxiwDYGpkCABFAAT0riQAADQG4d0XORgQwKgCEQG73r7gO7VZx92xj4AYAOvUVAAAAQEICpZOaj0oVZJykMTnT9umJuzLkPbl0yKdSDEDgItG5CkvUTO4K1g8+ok9Ke0w4g9YqWttZMWTDfHuFkTHMFVypiYPzHnUZRXXjRh5NNyaPSNu12pGzmTcitTA37c6uCNwYnjxHWEN3+\/wfMREPl9Z6gjcmzscGdSaJgQjUqUKQ+ENACFglyD6ndSy52hcx+ef0e8UXvJfm9O1DQbFO9fQ\/1MhuinAfqbmvbpiv0LkHx87l8mDC5wXifTGtd7rmqfwL5NroqZgJw+YQ174BrqEdFUKSX\/Yik\/uqBv\/CeAdA0WQJLXHFgUBBfDxS+J1KqN+\/sF8E9LU8EL0GA2hv2gGXgiNxMZser2Wwl\/1IFAgpZTHNjy94xx0go6NOZ3IjW4ajSiCcddTpbJDLt9BQXe6VeW\/mtGeLIolClWG4BRAyo9NlOdEEQun8vfbvc795TOZeb8oQWcb8s7THP\/uvQfsdaqttuB8Vp1l12OJ7OMMvysTJSh9SDWe8DF93cSxandFZ0XgG\/7\/9uVpM5at9CfgqS5N3+CYNGTQpVErHrCtWofEO8uehZFzYto1dzT1zGdBeR3xKoz7fayu7+d7GuEiQM+ZBb7MHxaOUPQJgrQYSvr064EclahWiEI0nqhBLYSlsMBVH4fG57X0BrOvxZiuOOyuBIQYqBbMKjboJwc3qr5ZaVOvQaSbTY8Ij3O+L6m4G\/7IwBTYIVVE2\/nzGDpR1Gonuugkivak1tkdpQD81XQf0zREF3EFCzhegv+QFzz2Iplc1iuNHrOh4rOCOnMn5r30YzB5jQF8IUBveZScPPOrqUkG0OV01IoPfoOym4RFSM51t3yQqANqB8Z6mNdgw3bQ94wE\/6gAJm+OqFhBGHdGk79r4a\/BR\/wehQC0NUwszUpS0wNvxxcXNJqzZ5KibYlO9ArSnbM5nEPXNayCqP\/sbS32bB+gKN0Icp2tIhatgE0N6o+xG8+gBHLEBzOUZzeG4IUdDwmty5IHw30uFW+gVdUq9JhIqDJ\/sgrD\/LpGsk8pubk8FIu67zwX0w58zuypR7IrD\/ZSGtgyzMTcIb9a1V1hLdpCenCu5JCgoLvh4UVuB7bg4Ztfq+rQB3m0\/KynpLYL9g\/WbcCouNbRmjFsQ2m+p+hP33cvLGMT5I3FH+QrzDavVUZR6w2AovBbqPjNDWZD0HBK1yc6XUbTxL108mqQLA4ODuZxkQEo7KNAiAZSmCbT3PVsjrLcSYR5BrvNZwaWlbn4qWj64UNwU1rAvUUhjD2NZS7lXyl745WCn4GoFNHo3EA3pGft9Anjfpzf3wQsneqjkf83ZCw8XeEOXw0nhdtUanKbqZQqdYFjaxwHl2dluz304YXoqCkyRUAPgYvcC0xCMuuwyvM6FaYETEFVbuxQ7gH9m8w0\/aNEzacr41v8n2CkdCEgFyAX6eIgnYbuVMJT35oNAEWMitW1sOCRCSLnVwNTU5uBbzQ6lpdqo\/eG+xlyH3yTBPZlA2\/klRa\/fNkGbtkuwschjdKURojmlA2BALpT2Qcffnbvn7W57aVF8B9Fp+9aF+FG3hDYRkyz+lrFSJqugSNx9P4uYc8v1a1BvVlLqMH0uG\/n+DzX5UocPTTTyZH1VUbBxrtIf+gWY6k7Nw=="}
02383{"flow_id":11,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":152149,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUriUAADQG4PwXORgQwKgCEQG73r7gO7oZx92xj4AQAOuCDQAAAQEICpZOaj4oVZJyhQp03z5wa6OUr5vY7qF2DZ9zjmZpNw67ljFIv8YL2z7zgcnR3q+zXA1uYqK5XxYlwVeu2zbPiaPIXuEABgixQsiAm\/q1hp\/IgThUyM2RBeMOJe6lsCYGJeqqe9Aem7sVxjfd7xo56IIPZ9nPnis+smkeVUYFY7N+2QIGNTeultLNy\/HDR4hTasUNeWF4Moe\/1FdqV13D1LhI3gwN2PFKfNGHmIcEek2GxDUy9bxf9zrqYLMm86pxI5cUsxgJaBfUA8uHfpRBwbakCMnjFMsFJSKCubL2EoGMUY6NEl4+90R5W0qj1DSYBA2uoGMhckvvnhOdXw67IRbK6lWU+6qF8\/VbsDr7uqF0SbXbILusjxQumoUm3aXXW8+IU\/s2\/f6IwbB7zX0AI\/d6ya15E\/LcoFm30ZbN+M6+ntSZYOIM2SuIsQltmFq2iguvabHIleo3jNsngkHJYcxA4yq87m1FMEQYWi8YNjamQDUYW2KMOvHPOovEtRf30CQSALlH78NSTL6hu6vEvZuhNi5TUGs\/F1RVc4TnnM\/nSrEeVJWUTG2BvLsXflRCUEe9x0uRKotK9svzPMbMUSuqMVAZGSQ3eZcwlkEvNU8kVoVLfM1VRdbJPH9w0KOx7m3nDI6w62j9raHCub9uAq7LKyr4+MYBJDOA0fqNfcmSA10MNFpxoPovGouSDyXZULb9z2qF7m5qjLT1A7U3uNWN\/bgOKs+yTWQ2CVL2H6kPdKJWYOWm\/Z3D5hHHFAu\/R\/pNaRPSM3I0jjlsAhCedSJTkeUCuCvskFGFJzUp7Bj\/J+IF2UcGrI9dpNI7NSNeDPdcnMg2CagaKvxDhkFI6CAyPiyAGtuMINy\/90\/yoeYeiZPL1LaPbxKN07nUV48cweM8P4ingKgWPzHl9nSaJOKW6bMaVXXY\/ukfEXtscq6Pu0nSRjg0toE3mpGbnUWPX1PR6YK+HMByhCXeFtGEnbMZIIxl8cgK6V5ePJBAjSzJKDiqwVEjtDNjLnjI+nsXv9L0EBnGAaR2Kn31PWXxzJR3lydIvZLYtN3RixvCr8dLJf5yLUZeidcu4WVBsHLeLz5SiwV7dAdH3JoTw7gMTkNBUpDHGXZhSJEitqK5hN0S+dDiYmXZgzSCfo+BNu+FEEYXexbyLkX48RaeWE8CqGr4v1lkkbRRj17yFOxGGMVMWdsX1JltDPcHHER0DTGfbQyPiEPJ9wqViKMe9qsKmz\/aZJOqN99\/mYFpkoT6jVG26q1bdyfgHNaAUxicSrsb1OqU0IYS+BwY7WD+TXAivC6UuQHf0\/uBjHxJzi4qeAs7TXHpuXXd5Q7VRGX05E+UI+YK3vzLAJWEIBBtozTibm5AvPDxaF1nBZeEqk9STRZyJ92oOXLCqK3+AiWXigy2zkY+mbydTXAD+Dm32ArwHBcIGIV+gMzSSYFblKZJha0Ir1Z\/uiZX\/T6Ztvs6junmUqQBHJQqW9MPfItkb+cbcl1w5+Zuq5rhS1W3V2Q4kYj0gSmcqAPCwLzNL6XIr\/D2oZj7vRi3VEDMnD63flyXYfSsHwDvk\/1lZVkeDK11m77696dw\/5mWdPs2AmD682ZHF0iBK\/Db5FmLd614cPQyrtPiD4Vu0xMi9LJJQduWGOXasyJOfsPmfWBE7M\/vimrnFDW746IEXgobjNKijuTYmrp23gvl5dfUFdqKRXHOZSoGebgvYWtMLGyrUtJvEpVO8R+uq8tkjvTaNj\/B+fseJjfSloezby0Xl5kF3ftCaJG6TjkHjxuW6qoWD7\/tdBjOu56EdIFhf\/iZggSt9KYH6Z8tDdgSySmP3Zp9Cd5x63FpGBDzMkN31v17RN45rk9KdKn1C46w5Ul2ZgtSeBkM3Z6JzCJsdXH1XbEp0FxpvNNkp39KgIDkQwfMSamyPlcRmKBGna+iuv\/W"}
00426{"flow_id":11,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":188,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":153248,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN6+AbvH3bGP4Du1WYAQA\/TV0gAAAQEICihVkpaWTmo9"}
00426{"flow_id":11,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":189,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":153401,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN6+AbvH3bGP4Du6GYAQA\/bREAAAAQEICihVkpaWTmo9"}
00437{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":190,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":185629,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G4zEjqQMowKgCEQG7wEvNn9QhBdFlyaASaN\/LpgAAAgQFrAQCCApkFUBJKFWN0AEDAwg="}
00425{"flow_id":10,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":186713,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKMBLAbsF0WXJzZ\/UIoAQCBZawQAAAQEICihVjkRkFUBJ"}
01251{"flow_id":11,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":192,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":186995,"pkt_caplen":673,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":673,"pkt_l4_len":639,"pkt":"xGGLNYKpxiwDYGpkCABFAAKTriYAADQG5DwXORgQwKgCEQG73r7gO7+5x92xj4AYAOtSLwAAAQEICpZOamEoVZKWpBLq1cB7OdZb6xp9z5fwrC3OVnVl2VdwPkolr4BdfDYeAIQr9Dkn9Rsvvf4KEikTR0BFWnQINwbkQCNO99y3yeYtGbvpbfy8u4H198gZjVR+Gyqwo6PV4tPwO6z2f8tuKz2tY1Wg6nw\/0CgwbCufi9WnWGvjeR2ZqSysvkZCHIrGz1O7VPGBlLw3XyYe34nJxFSmopT+POuDNbl292u7XzRQlDJkZb3CHbjIcmIJ0dV8miK3ibEyfMd79twkaWLFVRdZ4p\/jU7xNRa2jb3CW2NYTs8SX7O4Pw5PNySZ4T87+LhWeZ2VkIIeAVZjRtyDi3IOoHMFNDhcDAwEZ3+hD+U9Vi\/5Xcf5vCiPBn1BmO9wNSV6AdF3tRHnea3hr4ZdD+hkzSaVvgKpYHFHgB23\/e2quxLEexhaK0nMZ4VxZniNgSR6Yf9LrlK3bMuqscrTGCRrhJW27wXnH4rCCAiY2J0iz82w7tjvS10QvXSj1623\/HZVo4I1mby2o04dNaEpsAWvaKQETFwWkfgDAVedcyQuAdzC8wJ3\/+QOXOYjIb+me0tv8ThMnYPdF8UJ7DVx4USDSX\/C9hh5CtHEB8cLvL23i1rGL9I5V7gs\/Dfcdj0XIlBC0mRN\/2fG\/xt2wuxvlPyTGeWAIMj7hTzUwxjMJHydcleQ9TyJCmCrDuVvC+RQxQIPSBahwXfO8ajnrFjzBiaALDTkXAwMARakWzMpwVM5wZrzPDptq4zf+MkRtlYtKoayRLlOpXf5hmjmoathW6qRP+yAdeWHdGLRhcZ+5E7erNqJ7muze6s\/VJL32XA=="}
00436{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":193,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":198395,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G4zEjqQMowKgCEQG73r+o1iHY6c+USqASaN9tOAAAAgQFrAQCCApkFUBMKFWSWgEDAwg="}
00436{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":194,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":203333,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G4zEjqQMowKgCEQG73sBFykuNjtdEXqASaN9RcQAAAgQFrAQCCApkFUBNKFWSWwEDAwg="}
00436{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":195,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":203483,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G4zEjqQMowKgCEQG73sEV2c5FmCCLjaASaN+uMAAAAgQFrAQCCApkFUBNKFWSWwEDAwg="}
00693{"flow_id":10,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":229464,"pkt_caplen":263,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":263,"pkt_l4_len":229,"pkt":"xiwDYGpkxGGLNYKpCABFAAD5AABAAEAGUHXAqAIRI6kDKMBLAbsF0WXJzZ\/UIoAYCBbVbwAAAQEICihVjm1kFUBJFgMBAMABAAC8AwNdhdKAFZvPd8KN3PrIuLJ+p3RN76tFaWi69JIAQQd9fgAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAZwAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcACgAIAAYAFwAYABkACwACAQAADQASABAEAQIBBQEGAQQDAgMFAwYDAAUABQEAAAAAABIAAAAXAAA="}
00785{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":196,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":4,"flow_first_seen":1569051264073,"flow_last_seen":1569051264229,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":197,"flow_tot_l4_payload_len":197,"flow_avg_l4_payload_len":49,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00426{"flow_id":11,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":197,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":254064,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN6+AbvH3bGP4DvCGIAQA\/vIpwAAAQEICihVkvqWTmo+"}
00425{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":198,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259275,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN6\/Abvpz5RKqNYh2YAQBAsAMQAAAQEICihVkvtkFUBM"}
01121{"flow_id":13,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":199,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259325,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGTzXAqAIRI6kDKN6\/Abvpz5RKqNYh2YAYBAufSQAAAQEICihVkvtkFUBMFgMBAgABAAH8AwN+5Ttf6YokHynLX4ecaPrHKATOoW12Tu+wzd9uDQspWSA1hUwuwgYjwI2sT5j3KinfN4lvjC3KseF9UMaW83tPxQAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAgepTejFE5doby0DivzOsCuvXU1Qv8gn4J5BRpbhy8vDQALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":199,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_first_seen":1569051264090,"flow_last_seen":1569051264259,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00424{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":200,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259363,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7AAbuO10ReRcpLjoAQBAvkagAAAQEICihVkvtkFUBN"}
01123{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":201,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259470,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGTzXAqAIRI6kDKN7AAbuO10ReRcpLjoAYBAsKeAAAAQEICihVkvxkFUBNFgMBAgABAAH8AwNYXsKfONHmzDFwOYBHmMHWccv+TKZTGPJmOKuaWv\/yOCDtD78sld\/x8V+rzxyBuU3uWmdAA4D7yp8sPLtMpD+m1QAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAg1yEhEumbjcw84EpI\/aJKwlqb4nNO3GXKiR9CVTP9slYALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":201,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1569051264091,"flow_last_seen":1569051264259,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00424{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":202,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259507,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7BAbuYIIuNFdnORoAQBAtBKQAAAQEICihVkvxkFUBN"}
01121{"flow_id":15,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":259677,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGTzXAqAIRI6kDKN7BAbuYIIuNFdnORoAYBAvQ5wAAAQEICihVkvxkFUBNFgMBAgABAAH8AwMBrKJ6lAeYyvz4VxhLDcDvBph9JELZn65LIOXEqYKG0yBO77oSw5+zVdfbslJwrAju9uKTARXrNL8JS7VTuLS\/cAAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAgH0+fBZOWslk8wxPYbGM9RiS44cUzBW0Uf6uB5Vg5FGAALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":203,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":4,"flow_first_seen":1569051264093,"flow_last_seen":1569051264259,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01251{"flow_id":11,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":204,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":270338,"pkt_caplen":673,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":673,"pkt_l4_len":639,"pkt":"xGGLNYKpxiwDYGpkCABFAAKTricAADQG5DsXORgQwKgCEQG73r7gO7+5x92xj4AYAOtR3AAAAQEICpZOarQoVZKWpBLq1cB7OdZb6xp9z5fwrC3OVnVl2VdwPkolr4BdfDYeAIQr9Dkn9Rsvvf4KEikTR0BFWnQINwbkQCNO99y3yeYtGbvpbfy8u4H198gZjVR+Gyqwo6PV4tPwO6z2f8tuKz2tY1Wg6nw\/0CgwbCufi9WnWGvjeR2ZqSysvkZCHIrGz1O7VPGBlLw3XyYe34nJxFSmopT+POuDNbl292u7XzRQlDJkZb3CHbjIcmIJ0dV8miK3ibEyfMd79twkaWLFVRdZ4p\/jU7xNRa2jb3CW2NYTs8SX7O4Pw5PNySZ4T87+LhWeZ2VkIIeAVZjRtyDi3IOoHMFNDhcDAwEZ3+hD+U9Vi\/5Xcf5vCiPBn1BmO9wNSV6AdF3tRHnea3hr4ZdD+hkzSaVvgKpYHFHgB23\/e2quxLEexhaK0nMZ4VxZniNgSR6Yf9LrlK3bMuqscrTGCRrhJW27wXnH4rCCAiY2J0iz82w7tjvS10QvXSj1623\/HZVo4I1mby2o04dNaEpsAWvaKQETFwWkfgDAVedcyQuAdzC8wJ3\/+QOXOYjIb+me0tv8ThMnYPdF8UJ7DVx4USDSX\/C9hh5CtHEB8cLvL23i1rGL9I5V7gs\/Dfcdj0XIlBC0mRN\/2fG\/xt2wuxvlPyTGeWAIMj7hTzUwxjMJHydcleQ9TyJCmCrDuVvC+RQxQIPSBahwXfO8ajnrFjzBiaALDTkXAwMARakWzMpwVM5wZrzPDptq4zf+MkRtlYtKoayRLlOpXf5hmjmoathW6qRP+yAdeWHdGLRhcZ+5E7erNqJ7muze6s\/VJL32XA=="}
00441{"flow_id":11,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":205,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":271704,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGSLbAqAIRFzkYEN6+AbvH3bGP4DvCGLAQBABPuwAAAQEICihVkwqWTmq0AQEFCuA7v7ngO8IY"}
00424{"flow_id":10,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":227,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":341086,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0lEcAAO4GTvIjqQMowKgCEQG7wEvNn9QiBdFmjoAQAG5hVAAAAQEICmQVQHAoVY5t"}
02357{"flow_id":10,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":228,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":342899,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUlEgAAO4GSVEjqQMowKgCEQG7wEvNn9QiBdFmjoAQAG4V2AAAAQEICmQVQHAoVY5tFgMDAFkCAABVAwPngLgY21HHoPH4CHf91D0DijSN0DONzcF4eVqKpsvieiDsfCrRuAo7QF9VH+77JZkXFC2O7ty5q3WnB\/Zm5PDVl8AvAAAN\/wEAAQAACwAEAwABAhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3Bl"}
00842{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":228,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":6,"flow_first_seen":1569051264073,"flow_last_seen":1569051264342,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1637,"flow_avg_l4_payload_len":272,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"303951d4c50efb2e991652225a6f02b1","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}}
01819{"flow_id":10,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":343005,"pkt_caplen":1095,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1095,"pkt_l4_len":1061,"pkt":"xGGLNYKpxiwDYGpkCABFAAQ5lEkAAO4GSusjqQMowKgCEQG7wEvNn9nCBdFmjoAYAG7s8gAAAQEICmQVQHAoVY5tciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEMWQCAHI03NByJ4q5lY4gg05XSW8QObiJ+zMq73hVFLAJzDkl9ZUshAKm\/\/0LLAwHdejH2c8JuzrkkKH7vtHNRQYBAQBF6rWl38tLgEZaJHR9miBCj6f6krpP4qMlleinhhfvaPVBMsxp0rRHZqEiOWuqcl+3RQMgsXC1X6qgTVEqi6gn1H6XqLqGqmLU6E98mkI\/a3hD8MgnOzIA\/PAu6B8ewRT3DPOYWix2wWKu3Jw68DXr0Pv4N7B3O0ihPYP3gM+9UP1b+752vl\/Gdn65iz3nMp7XqOfViJuWlIJBTuQ3+u7iqgg41yQeOXQpklE7xD9585YfCLqbxsAQVuJAE9pZcjXHPNLfAVkwGuxWzDSxvqTRUOolp7Z7XCt16FswouX09M3tQEBQH7gXW6cZeiOMq+yDdAbutVQAs8WkqVN18gQLFgMDAAQOAAAA"}
01230{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":229,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":7,"flow_first_seen":1569051264073,"flow_last_seen":1569051264343,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2666,"flow_avg_l4_payload_len":380,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"303951d4c50efb2e991652225a6f02b1","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00425{"flow_id":10,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":344475,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKMBLAbsF0WaOzZ\/dx4AQB+9PvQAAAQEICihVjt5kFUBw"}
00531{"flow_id":10,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":346706,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"xiwDYGpkxGGLNYKpCABFAAB\/AABAAEAGUO\/AqAIRI6kDKMBLAbsF0WaOzZ\/dx4AYCABSpQAAAQEICihVjuBkFUBwFgMDAEYQAABCQQTAAQFeqaxcPjmmsRP0oJLLx6BokWD\/AZ1dfxoGTaM7uCOTu4MS2i9nNUsPIXW9zYz4cBy204beSQi8sZHgvYUk"}
00424{"flow_id":13,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":367627,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0Ya4AAO4GgYsjqQMowKgCEQG73r+o1iHZ6c+WT4AQAG4BngAAAQEICmQVQHcoVZL7"}
02356{"flow_id":13,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":369936,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUYa8AAO4Ge+ojqQMowKgCEQG73r+o1iHZ6c+WT4AQAG6+VgAAAQEICmQVQHcoVZL7FgMDAGICAABeAwNu8dE7Sdw67vExce1lmc6tUX3BJzty7id96PHyq9+LziCrC0t8waXbU1rG+dAlQYUF+O4HLQ41oBg583GSOK2gjsAvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00851{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":233,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":6,"flow_first_seen":1569051264090,"flow_last_seen":1569051264369,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01834{"flow_id":13,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":369938,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARCYbAAAO4GfXsjqQMowKgCEQG73r+o1id56c+WT4AYAG7NNwAAAQEICmQVQHcoVZL7ZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEKpzMfAzPchd0JZSlcwPFvtFBvCqGpfgScKBQqZ\/xzFbCCpOYAXMNG9Rgec\/86sIdMQszMG2fCcBB7wjlosC3sQYBAQCE3r9OzWEvUCQ08VEMJ1X9rtgZHmd0iDDaKAflkMrWL9ShH+vJjHPZAfjkyd9co\/FP7oB43L6REUtrHPu7ZWq1EWidvWB0\/y5MlNbmIgc9sQDoJey5CG\/8U9ijHS4lN0bKoBaWAVoxLxcicbv\/yWJWB9AeztCIBGJG+BpisxgdHcAvvXqZMSTnCgwMkxYuVhG\/TFdujrKgFA+jEziyNmOKQPmNyQ8bfYHKDGCJAREmx5hHgIFdzdJCVZv1N1RxDkItk95piHbGiFBHXi6myS8Km0LO3\/TXDqgXKehMuwrvZfRY8ItmNL621VUldVLpFIzkuXeyZFv0fUbAQPcfqjzlFgMDAAQOAAAA"}
01239{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":234,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":7,"flow_first_seen":1569051264090,"flow_last_seen":1569051264369,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00424{"flow_id":15,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":235,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":371125,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0jjEAAO4GVQgjqQMowKgCEQG73sEV2c5GmCCNkoAQAG5ClwAAAQEICmQVQHcoVZL8"}
00426{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":236,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":371564,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN6\/Abvpz5ZPqNYrh4AQA\/fz+AAAAQEICihVk2lkFUB3"}
00425{"flow_id":14,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":371989,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0C\/kAAO4G10AjqQMowKgCEQG73sBFykuOjtdGY4AQAG7l1wAAAQEICmQVQHcoVZL8"}
02360{"flow_id":15,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":238,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":373131,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUjjIAAO4GT2cjqQMowKgCEQG73sEV2c5GmCCNkoAQAG6iUgAAAQEICmQVQHcoVZL8FgMDAGICAABeAwPhTvJij0GGExhjGkeCX4\/eZO+MLxN\/CXbeunzBcI0XniAinrKyytW4344mV\/s65tnfG\/0k8ZRr+xf+ZuX00iTDx8AvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00851{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":238,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":6,"flow_first_seen":1569051264093,"flow_last_seen":1569051264373,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01829{"flow_id":15,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":239,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":373258,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARCjjMAAO4GUPgjqQMowKgCEQG73sEV2dPmmCCNkoAYAG466QAAAQEICmQVQHcoVZL8ZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEC\/PlgwytI3vpsSej2FF5fbWDIIJMf6fL98CkUslLmixi4P6n41y62BkhZK9KPPgxURpzV5msqtQWASxJ3\/MEXwYBAQAXtZ2x2i2jQZwQy8NRUujyA6ELtnUYFlnwfQiYZOFYNIc4p9thtQasma\/GWOrRaf69vVBYPlBYcfcleztJQyKG3K8LUlrP8IMHeXSg483jkQtKyaXW8EpmPUney3uGTOhpfLKGV+iJounjZRP7h5AzftAVYxmhPTo3ltPkMLg4oMqotBVh378hatFt4kG1+laiiwNli9D0HSSd+alRcg1PVe8Hw581aAQmViLFGUgyz5q0utZIe3lG7LfomtcuRwhELEaZqTAwSnfVBwxdCYOSut84vga3jRVyiKZu8MiYLEbTc3h9Qw8TPLeHxepBb32QbIF6PkmTyvYGJEBMkt5xFgMDAAQOAAAA"}
01239{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":239,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":7,"flow_first_seen":1569051264093,"flow_last_seen":1569051264373,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
02359{"flow_id":14,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":240,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":373882,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUC\/oAAO4G0Z8jqQMowKgCEQG73sBFykuOjtdGY4AQAG45ZgAAAQEICmQVQHgoVZL8FgMDAGICAABeAwNpJs\/GY5HYRjqt9IN2kbVuXOMzCNjyfum\/cYad8+9q2iA0csiw9WuvqD+s5HcN2vlKlingfAxRPD37i5tofd8cDsAvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00851{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":240,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":6,"flow_first_seen":1569051264091,"flow_last_seen":1569051264373,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01834{"flow_id":14,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":241,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":374011,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARCC\/sAAO4G0zAjqQMowKgCEQG73sBFylEujtdGY4AYAG47bQAAAQEICmQVQHgoVZL8ZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EEhqRGI2uPZEQqqs\/NKhZ8VQXts4kh1oPGWXWuR\/wD6nE7bNc4p6EPKJtmOi2EfpKHXE\/F5fwr3J1Q8Z\/6xd9FLgYBAQCRwR7c+DPgPmTyL4aCGhwuEKNygTnjioQOqmXv8Puvd7LCYFQxMQRHPfwpoyJJ00o4SldbbfX0v3hTSWiBjNpPCnWFRor4GR3Fzn6cC4xMIydcKXyFIMmKq\/PMRvKb10BMPytcFTtUWgs1K0AZK5t6PuizWuOMcpX6WhhiQeYaFLoTwbIcNYIL5bNCFi0uaVwTro5a7frJwYWkNhMBHE3\/AU0kwnfs3OePzhTb8FtON0GKTZeokG0ZBf5UMIUJZRGTGP\/4daXmWBavlaHIXpWuxFmTUpMCcrYa93IFs94OJQiKZqkvvUdhAmm3dNy8E8p4p3qTxtVX2u3VQSvqfS9jFgMDAAQOAAAA"}
01239{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":241,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":7,"flow_first_seen":1569051264091,"flow_last_seen":1569051264374,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00425{"flow_id":15,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":242,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":374852,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7BAbuYII2SFdnX9IAQA\/c08AAAAQEICihVk2xkFUB3"}
00425{"flow_id":14,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":243,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":375318,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7AAbuO10ZjRcpVPIAQA\/fYLwAAAQEICihVk2xkFUB4"}
00597{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":248,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":443934,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGULzAqAIRI6kDKN6\/Abvpz5ZPqNYrh4AYBAB0uwAAAQEICihVk69kFUB3FgMDAEYQAABCQQQvIQtTC3wsLDZURcqy6fud3o3cmduBgrSZYhjyE1mtUup0j1FMZ+yIK86HeaJrZEboPP6ftAA12sDFzQ\/cLMiYFAMDAAEBFgMDACgAAAAAAAAAAGhromIIj7FF2zqBnkRGnCJDWAcm3IGLGUhi2Ze+vRhr"}
00596{"flow_id":15,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":249,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":447873,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGULzAqAIRI6kDKN7BAbuYII2SFdnX9IAYBADhWQAAAQEICihVk7NkFUB3FgMDAEYQAABCQQQbnOCcdHPh2bSIqYEk8Yd36sVuiI2ezOOpv1Rw83\/6kSm5XFtYDR9ygWpPUgmxgwHmFwgzdyc5akrdkr2mXHw1FAMDAAEBFgMDACgAAAAAAAAAAJ9fbfokk2CdONkzxd21ov4oOgj1oocFkijBLTVGFpfo"}
00596{"flow_id":14,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":250,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":448809,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGULzAqAIRI6kDKN7AAbuO10ZjRcpVPIAYBAAVcQAAAQEICihVk7NkFUB4FgMDAEYQAABCQQRCQCG4hb4hCmPRID9O1t1wEiiIrckGzSiTI9FC7ju2Ke08GnY+2KxGtygeyDWUto1XM5FVXBpdWFOAN4fuT697FAMDAAEBFgMDACgAAAAAAAAAAPoon4+X+PoxmW+fSw64rgWVo\/YHcdTitcIZ1i3Oxg8m"}
00425{"flow_id":10,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":256,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":500406,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0lEoAAO4GTu8jqQMowKgCEQG7wEvNn93HBdFm2YAQAG5WyQAAAQEICmQVQJgoVY7g"}
00498{"flow_id":10,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":257,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":501481,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xiwDYGpkxGGLNYKpCABFAABnAABAAEAGUQfAqAIRI6kDKMBLAbsF0WbZzZ\/dx4AYCAA4\/gAAAQEICihVj3pkFUCYFAMDAAEBFgMDACjiya5yB8bzgMxtpDZMPgfLCyZ99YOOlz4gAQ7ZaltGbM\/yoD9lgrJL"}
00495{"flow_id":13,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":258,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":551107,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnYbEAAO4GgVUjqQMowKgCEQG73r+o1iuH6c+WzYAYAG6ZYAAAAQEICmQVQKUoVZOvFAMDAAEBFgMDACgrAH9kEyeRf2QftppOVu8koxSwLNhHThtYdnHun4G0DBQQj2Zydpg+"}
00524{"flow_id":13,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":259,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":551142,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5YbIAAO4GgUIjqQMowKgCEQG73r+o1iu66c+WzYAYAG73kAAAAQEICmQVQKUoVZOvFwMDAEArAH9kEyeRgJJd3rMHyX01xQY2PB+rkr4EUb\/iTdLA7RbPnyrAW\/Rbufp6RvQZE8njRQP4jC\/t\/ycynaVGxqIG"}
00428{"flow_id":13,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":260,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":552521,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN6\/Abvpz5bNqNYruoAQA\/\/yYAAAAQEICihVlBpkFUCl"}
00501{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":261,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":553629,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGUQXAqAIRI6kDKN6\/Abvpz5bNqNYruoAYBADVGwAAAQEICihVlBtkFUClFwMDADAAAAAAAAAAAU8MdhigXfH5sFm3\/f4t2mvIHYOCIjpreqpy63kBgoYz+FJhUp1efGk="}
00496{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":262,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":553686,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGUQjAqAIRI6kDKN6\/Abvpz5cCqNYruoAYBACOsQAAAQEICihVlBtkFUClFwMDAC0AAAAAAAAAAv3vsv+XjTKEV9Zrz5YY6MKRYtTOwW2zRjoCytTfR0TSrXAUT7g="}
00484{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":263,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":554063,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGURDAqAIRI6kDKN6\/Abvpz5c0qNYruoAYBACM3wAAAQEICihVlBtkFUClFwMDACUAAAAAAAAAA9pz00Vbc+QMPhdVtPAOlNLde7T8EVpndxCfTlJz"}
00497{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":267,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":558170,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnjjQAAO4GVNIjqQMowKgCEQG73sEV2df0mCCOEIAYAG7lmgAAAQEICmQVQKYoVZOzFAMDAAEBFgMDACgGxBGcuocgeky4jEAlwUHuaVwtgPY+BhY+e\/LLa7akJla5\/xQlvSQN"}
00522{"flow_id":15,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":268,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":558182,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5jjUAAO4GVL8jqQMowKgCEQG73sEV2dgnmCCOEIAYAG577wAAAQEICmQVQKYoVZOzFwMDAEAGxBGcuocge\/xd1dfes7kmqjYjiOIbBJDmLaP+v9vvdkm1D18SXs22zTRvE6lqqR3ftMEUXph\/bPyBxIPl4tlS"}
00426{"flow_id":15,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":269,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":559117,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7BAbuYII4QFdnYJ4AQA\/8zVAAAAQEICihVlCBkFUCm"}
00498{"flow_id":14,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":270,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":560056,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnC\/wAAO4G1wojqQMowKgCEQG73sBFylU8jtdG4YAYAG5RSwAAAQEICmQVQKcoVZOzFAMDAAEBFgMDAChYKi43nl\/rF1QxYcfrhLutr48fDagIfMLktEcK2WfU9k7quQ83\/ryt"}
00499{"flow_id":15,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":271,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":560260,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGUQXAqAIRI6kDKN7BAbuYII4QFdnYJ4AYBADOmgAAAQEICihVlCBkFUCmFwMDADAAAAAAAAAAASRmjam7pY23lezk2JI3t7RFuK6thWWbVzf4ECOnbVvexDBfEZgcnBE="}
00496{"flow_id":15,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":272,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":560281,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGUQjAqAIRI6kDKN7BAbuYII5FFdnYJ4AYBABogQAAAQEICihVlCFkFUCmFwMDAC0AAAAAAAAAAsy\/6ydz+qVrRk5kCxjiPzqmCcsmDMYlvj1+J0vThi5EM0h6K9M="}
00485{"flow_id":15,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":273,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":560341,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGURDAqAIRI6kDKN7BAbuYII53FdnYJ4AYBADoSQAAAQEICihVlCFkFUCmFwMDACUAAAAAAAAAA3OeHt+da\/II3iBHZuZk+ovBbTOKShWlEMbTWaw\/"}
00523{"flow_id":14,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":274,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":560408,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5C\/0AAO4G1vcjqQMowKgCEQG73sBFylVvjtdG4YAYAG6\/JwAAAQEICmQVQKcoVZOzFwMDAEBYKi43nl\/rGAGRhB7F5kbCjk5ZbkBzHyNZjvDhnYddI8aXxeL+H2lEBXIs7XxhirAF5baWhzg6ktDFMPAnrBYn"}
00427{"flow_id":14,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":278,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":561504,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7AAbuO10bhRcpVb4AQA\/\/WkQAAAQEICihVlCJkFUCn"}
00501{"flow_id":14,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":279,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":562462,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGUQXAqAIRI6kDKN7AAbuO10bhRcpVb4AYBAAHHAAAAQEICihVlCJkFUCnFwMDADAAAAAAAAAAAe9uU9NJBOutTb5b37\/VUKwqrW8aVw6Hni\/HtOLqD1RY8FqR0PgG7LY="}
00496{"flow_id":14,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":280,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":562480,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGUQjAqAIRI6kDKN7AAbuO10cWRcpVb4AYBABikAAAAQEICihVlCNkFUCnFwMDAC0AAAAAAAAAAlKsKco8AfH2mYY1+L6\/iZCJrU603A5xm2yld+z9nDYwLkIJP1U="}
00484{"flow_id":14,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":281,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":562606,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGURDAqAIRI6kDKN7AAbuO10dIRcpVb4AYBAC7dAAAAQEICihVlCNkFUCnFwMDACUAAAAAAAAAA9Sf0UZDz\/KDl8oEdFGvdo5lEt5wxH8cGwfdeiaY"}
00425{"flow_id":10,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":285,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":612167,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0lEsAAO4GTu4jqQMowKgCEQG7wEvNn93HBdFnDIAQAG5V4QAAAQEICmQVQLMoVY96"}
00495{"flow_id":10,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":612194,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnlEwAAO4GTrojqQMowKgCEQG7wEvNn93HBdFnDIAYAG79pgAAAQEICmQVQLMoVY96FAMDAAEBFgMDACghB2eB771eibt8xLtm+J2t7+E+Go+xRzU2K1+SjRStFAm8+4PYN+oO"}
00427{"flow_id":10,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":613233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKMBLAbsF0WcMzZ\/d+oAQB\/9NrgAAAQEICihVj+lkFUCz"}
01024{"flow_id":10,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":288,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":618382,"pkt_caplen":502,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":502,"pkt_l4_len":468,"pkt":"xiwDYGpkxGGLNYKpCABFAAHoAABAAEAGT4bAqAIRI6kDKMBLAbsF0WcMzZ\/d+oAYCAA5lQAAAQEICihVj+5kFUCzFwMDAa\/iya5yB8bzgW\/94EWBybAN1ddr\/7WES71\/jCNrzr0FH6q3aJgiy2IfbVQ44mNUDuV7iwXfQaVyuha4zq\/e25UJAkYI6uwvJW+LQUJOd\/v2pq4epMncCGs1ajyZ67Vbew3Gju79DKmvIgpzrv06tpzp7E+daDpbAgsRXv1PvYB\/FN74Ftsu2gPWO2zYBb90gDVSCHkAwtqsoSTg69ARb40jlSYAJQF9HDPxTIqf4gt2uiWWzmUycb5euj7T7WgTLXLwDmYJHFppQPto0FGFG9BrQFaBno6edoJ4ZZYbmgmCI6OtD0GHWkskfQZhfwrsUzWPmO5qfo43cPVVETruvNJsyVcXD6n0czHhT7UwRmyg6zBqDWNzN\/h1bEUhVfJhYtX8WCaf549D\/dTHDX2BfqeRXKa5V2eyZvPUwi+yN1ySsIc4MyJocwaErEj2YimlmKxRE0QEqNIPIC93m8NDcqvoi5o6SIIYS17NLE64lMx7oF3ydL1W4RfeDQ2\/3Rg+xuSfCV0aYKxXY4lk9QxVG4IimVa1gUP0VKmYu8mxI1D\/pOR8FY9SS7tpsmHRTOxgJg=="}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":295,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1569051264666,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":295,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":666082,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGUS7AqAIRI6kDKN7CAbvJrSrvAAAAALAC\/\/+7dwAAAgQFtAEDAwcBAQgKKFWUiQAAAAAEAgAA"}
00436{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":319,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":775024,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAO4G4zEjqQMowKgCEQG73sL5Zid4ya0q8KASaN+dwQAAAgQFrAQCCApkFUDdKFWUiQEDAwg="}
00424{"flow_id":17,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":320,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":776703,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7CAbvJrSrw+WYneYAQBAsw7wAAAQEICihVlPVkFUDd"}
01121{"flow_id":17,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":321,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":776825,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGTzXAqAIRI6kDKN7CAbvJrSrw+WYneYAYBAsKOgAAAQEICihVlPVkFUDdFgMBAgABAAH8AwPqnmHY+ky08QaEFpsYq0FGVLaxG+964Hq2icanaO7xlCBmz3takGKujlgk83\/DuHgM2oWMrAxFhkG7HMIkIEBMvgAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAACoAKAAAJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcAFwAAAA0AGAAWBAMIBAQBBQMCAwgFCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAAMwAmACQAHQAg5cIrTlOOMEP5oixl5QwpN10lLFAYbdhRGOo98Zyw2T4ALQACAQEAKwAFBAMEAwMACgAKAAgAHQAXABgAGQAVAM4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":321,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1569051264666,"flow_last_seen":1569051264776,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00424{"flow_id":17,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":885425,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0Z4EAAO4Ge7gjqQMowKgCEQG73sL5Zid5ya0s9YAQAG4ybAAAAQEICmQVQPgoVZT1"}
02356{"flow_id":17,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":887563,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUZ4IAAO4GdhcjqQMowKgCEQG73sL5Zid5ya0s9YAQAG6wegAAAQEICmQVQPkoVZT1FgMDAGICAABeAwNPU1nCJ97Zo6Vjasw21LYJzTX3WgHniE2ZiBvYvvO2+CByOmROZ9S278p7di5l5CKU0oCAaeZpNl0SjO6ZatfZM8AvAAAW\/wEAAQAACwAEAwABAgAQAAUAAwJoMhYDAwfnCwAH4wAH4AAD5zCCA+MwggLLoAMCAQICAhAYMA0GCSqGSIb3DQEBCwUAMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMB4XDTE5MDIxNTE3MzgxN1oXDTI5MDMxMjE4MjAyMFowgZAxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxLjAsBgNVBAMMJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsyBG10UW3wKLLz5OJmoB1s7B4cDs7uzp+xAOMcalYh2zeKMeI5eS4fZrup1VtHgb8XPc0CjxtIo4ECTf0led4xcI6qra+CWE7B8yrOm4B5WB+rFt1x8Xj4+SRSkkl1mO5SjQElZeSpEpoWomCLRDxMb0qDwfWzcLqYsWeQHtIiBPzWEAOsmV6UE2NHQVNJdatKUHl8y16oCXrU4c0l6+o+bKDTtiskaDATWyONnz1GL1kQjlH8lDSNn296rLmQ\/kEO2CsZeYYAwVPKDQjTfNLDVo4YeZxRDlho+ZcZdamE5Kd7FiSRmA+nLkAydQ60ijWw1Fp7JSHvsL2X08ffpJtAgMBAAGjSDBGMEQGA1UdEQQ9MDuCJXRleHRzZWN1cmUtc2VydmljZS53aGlzcGVyc3lzdGVtcy5vcmeCEnNlcnZpY2Uuc2lnbmFsLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAKWsuR7z3DD\/hxNr0t1jsS\/8oBtaP6uM3Dv1WDnwO6tsohTdhQxfJRHMBKnAzAM9voRiv314toGiGKun6d3y\/TrcyK15lDQgdiPT6biOI4+sVLREXnDl0mhxNgt0yN7ewiHL4WxlNTqyYgy21RRxPEQHrbCScndmFrswcHfVN6FkuGTc45cEC0zoiaaAKUipjJUOjlX4Ha+q0UyNaHMPquP8A8XGBIYi6DJY8uNgP1q8F88lDA5HALWR045FALki4r5+N+Jy3GF2pTFCFvLEDS5LCk6lR9ujCktrdh0VbOHMA35rRs5lki24EQZf\/DqrquVyyzRFCDN9TVXAVBaSoSQAD8zCCA+8wggLXoAMCAQICCQCJui2rSuTzYjANBgkqhkiG9w0BAQUFADCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTAeFw0xMzAzMjUyMjE4MzVaFw0yMzAzMjMyMjE4MzVaMIGNMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9w"}
00851{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":323,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":6,"flow_first_seen":1569051264666,"flow_last_seen":1569051264887,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01832{"flow_id":17,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":887591,"pkt_caplen":1104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1104,"pkt_l4_len":1070,"pkt":"xGGLNYKpxiwDYGpkCABFAARCZ4MAAO4Gd6gjqQMowKgCEQG73sL5Zi0Zya0s9YAYAG5bvwAAAQEICmQVQPkoVZT1ZW4gV2hpc3BlciBTeXN0ZW1zMRMwEQYDVQQDDApUZXh0U2VjdXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwUlgaTggQxdIuKtneIwF5El1BqW3lroFT0Ao2i+qg\/UAzsXltWn73z6POt4ugq6tSg8R6Qd+hMM1XI8C5BUyDHqO7fbNRUKJQLd5hK1dlNL4nulXrPso+oK0n8cCAwHHbCpiNGtUkAmZa90NbXBwJAChUcWDWsAA8qbOQfmZqnIH+ud010uf9CDz0C6HC5\/Bli8DmDZ2HwbyCygzCLZmU7RG7nHYoMRAPZnyL7xwAxG7Xi7VYMAZvUeb1b7cKw+ggsSN6YB+xB+5DD9Dnfd8C4rL59coR2OxbmJa5GKnZDL1lKyqAElcOI2+vb2niQlHVPhwqFzkj9T0HC+lnpzQhwIDAQABo1AwTjAdBgNVHQ4EFgQUAYsY8T\/7ORlEboWGvpRlMqcyPJAwHwYDVR0jBBgwFoAUAYsY8T\/7ORlEboWGvpRlMqcyPJAwDAYDVR0TBAUwAwEB\/zANBgkqhkiG9w0BAQUFAAOCAQEAfh6+IQueptC7yQLtUSujbjw20zBDe\/4zKIxR8R+D91zxX7qY0fm5A6tKTzlOiYyMZ6w9Vw\/xFZk02k1WOYjoXsr+1MyTnn29qSznParLryOH52hEofW4c5Z\/i18bQq0TxoZMQNSDCKNyf7NlhfylWGcnIrum+LmyfdVzwLgTWcCJroO\/7K1r26ZNIaugOs9eNFk1UirSRuxD+NZCXv6BeLrGOSeyz5MSty1szCZ2+RCCQ5kb8h\/KckcFoOkJuqohhWiOJy\/EFOC2tcdnp+Axl0WizD0cIxCzYED6HUd\/M6AjLgPIB2X2WGKGew+0NcDVIlR3MbhaxHgWmCWyxK8C1RYDAwFNDAABSQMAF0EERdMBDGp5AaYd6W8Y6K7XPAtLeSsFd\/MCEliovy7MiCpTpCZWA8iwx\/kasUDw6UD4XgqcMifqWZ7dI035NznLqAYBAQCFO1gzqxBCkwfTt5RbcSNjVhnH9Z1GBA+P3VqIhqi2y3fTC09YsZobAAeaiJC7NlEmQc805qnqhsiTKWt0+o93k6uPH\/QEzerJdaUZhI5Jh3qsiaPpcxj+Sbq4xbluZ+jebQ+cjpA7UtOAEjirJNy3paRE6nfhaXDjiKvtz4Q3dVjpspp2q3zFNtYyrzKjQTP6ebA\/90hP3Z5kBjK5wueng1\/qFFFAJJPNZVjdt90IBhbsqt0UpbO1BcoAzxmPaMGCoFx+b660hzpAsNYwwRcso1FpZ806cfecoUR9K7ZwWe8L1kEL\/Br+QLn49TXSXvz+gvcUw2p+4UyptflrUUVOFgMDAAQOAAAA"}
01239{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":324,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":7,"flow_first_seen":1569051264666,"flow_last_seen":1569051264887,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2995,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"textsecure-service.whispersystems.org","server_names":"textsecure-service.whispersystems.org,service.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"1089ea6f0461a29006cc96dfe7a11d80","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=textsecure-service.whispersystems.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"5E:9E:63:F5:69:45:C7:DC:E6:4D:26:68:36:7E:C2:68:DB:02:60:8B"}}
00425{"flow_id":17,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":889270,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7CAbvJrSz1+WYxJ4AQA\/ckxAAAAQEICihVlWVkFUD5"}
00597{"flow_id":17,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":326,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051264,"pkt_ts_usec":894221,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGULzAqAIRI6kDKN7CAbvJrSz1+WYxJ4AYBACrZgAAAQEICihVlWpkFUD5FgMDAEYQAABCQQTquNP6GY7fQLK2iZyWMIts8xYB7Fly4bH4O\/SnX24F7Ir3fomGTee9Atgk8uJOjMv68Sggowtz2dJ3yTV9cFukFAMDAAEBFgMDACgAAAAAAAAAABOJelbNZWsO\/mOCDsN+UZCa2OkXEQohqoGlLdv8lwo0"}
00493{"flow_id":17,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":328,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":2510,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnZ4QAAO4Ge4IjqQMowKgCEQG73sL5ZjEnya0tc4AYAG61hAAAAQEICmQVQRYoVZVqFAMDAAEBFgMDAChc4ROackEnamCtna2hZgZnF8Vo6DLBQaiWsf69JdY1JXrgUZVAikNH"}
00519{"flow_id":17,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":329,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":2533,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5Z4UAAO4Ge28jqQMowKgCEQG73sL5ZjFaya0tc4AYAG5ZUQAAAQEICmQVQRYoVZVqFwMDAEBc4ROackEnay3sQKBPeFxB1xuT8MyGSV+6ksqT+\/tqxI5IxAcP0AKHBAueplIZs4bAezt0eQW+RNBriZvZaNOI"}
00424{"flow_id":17,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":330,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":3774,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGUTrAqAIRI6kDKN7CAbvJrS1z+WYxWoAQA\/8jfQAAAQEICihVldZkFUEW"}
00498{"flow_id":17,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":331,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":5666,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGUQXAqAIRI6kDKN7CAbvJrS1z+WYxWoAYBABG9wAAAQEICihVlddkFUEWFwMDADAAAAAAAAAAAXr0G6WkwildHebwwoTMS\/j500xAmTZrUAlNO0CDgH4CkWXBIoPemFc="}
00495{"flow_id":17,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":332,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":5683,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"xiwDYGpkxGGLNYKpCABFAABmAABAAEAGUQjAqAIRI6kDKN7CAbvJrS2o+WYxWoAYBAAQbAAAAQEICihVlddkFUEWFwMDAC0AAAAAAAAAAl\/0PFi+uzoLG\/yjsYLC10gy+hXF39eOo8J9Gq0ZRrcXJrO1ha0="}
00481{"flow_id":17,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":333,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051265,"pkt_ts_usec":5694,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"xiwDYGpkxGGLNYKpCABFAABeAABAAEAGURDAqAIRI6kDKN7CAbvJrS3a+WYxWoAYBABfbgAAAQEICihVlddkFUEWFwMDACUAAAAAAAAAA6UYtqR3XQaITcujng0e4PfvGMyB3EHM1ShLjWCd"}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":357,"source":"signal.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1569051266396,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.24.16","dst_ip":"192.168.2.17","src_port":443,"dst_port":57016,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00456{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":357,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":396342,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"xGGLNYKpxiwDYGpkCABFAABMyV0AADQGy0wXORgQwKgCEQG73rjhiC89LB07wYAYAQKY+AAAAQEICpZOcwIoVP9fFwMDABNN53WS+HQ+OdIkNGbGHI++PaTs"}
00424{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":358,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":396673,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0yV4AADQGy2MXORgQwKgCEQG73rjhiC9VLB07wYARAQL5ggAAAQEICpZOcwIoVP9f"}
00456{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":359,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":743731,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"xGGLNYKpxiwDYGpkCABFAABMyV8AADQGy0oXORgQwKgCEQG73rjhiC89LB07wYAYAQKXnQAAAQEICpZOdF0oVP9fFwMDABNN53WS+HQ+OdIkNGbGHI++PaTs"}
00425{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":360,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":980874,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN64AbssHTvB4YgvVYAQA\/9Y6QAAAQEICihVnPyWTnMC"}
00425{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":361,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":980893,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN64AbssHTvB4YgvVoAQA\/9Y6AAAAQEICihVnPyWTnMC"}
00441{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":362,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":980903,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGSLbAqAIRFzkYEN64AbssHTvB4YgvVrAQA\/8BLQAAAQEICihVnPyWTnMCAQEFCuGILz3hiC9V"}
00479{"flow_id":18,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":363,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":980912,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"xiwDYGpkxGGLNYKpCABFAABbAABAAEAGSJvAqAIRFzkYEN64AbssHTvB4YgvVoAYBAA\/FgAAAQEICihVnPyWTnMCFwMDACIKgs7b93B06Cv8uAmmDZC2sqL1mjavG04B6gMvy4n2On1D"}
00458{"flow_id":18,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051266,"pkt_ts_usec":997826,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"xiwDYGpkxGGLNYKpCABFAABMAABAAEAGSKrAqAIRFzkYEN64AbssHTvo4YgvVoAYBADU7gAAAQEICihVnRGWTnMCFwMDABMBoYtcHlLMr5\/EHZNRIBnn\/fb7"}
00422{"flow_id":18,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":366,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":5795,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGSMLAqAIRFzkYEN64AbssHTwA4YgvVoARBABYiwAAAQEICihVnRiWTnMC"}
00408{"flow_id":18,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":367,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":24579,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xGGLNYKpxiwDYGpkCABFAAAoAAAAADQGlM4XORgQwKgCEQG73rjhiC9WAAAAAFAEAADMiwAA"}
00408{"flow_id":18,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":368,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":41242,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xGGLNYKpxiwDYGpkCABFAAAoAAAAADQGlM4XORgQwKgCEQG73rjhiC9WAAAAAFAEAADMiwAA"}
00408{"flow_id":18,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":369,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":48829,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"xGGLNYKpxiwDYGpkCABFAAAoAAAAADQGlM4XORgQwKgCEQG73rjhiC9WAAAAAFAEAADMiwAA"}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":373,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1569051267121,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":373,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":121677,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"xiwDYGpkxGGLNYKpCABFAABAAABAAEAGbbHAqAIRDSP9Kt7DAbsjR8rsAAAAALAC\/\/\/U1AAAAgQFtAEDAwcBAQgKKFWeFwAAAAAEAgAA"}
00440{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":374,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":154562,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"xGGLNYKpxiwDYGpkCABFAAA8AAAAAPEG\/LQNI\/0qwKgCEQG73sO\/wI8zI0fK7aAScSCWtAAAAgQFrAQCCAqvNN\/RKFWeFwEDAwg="}
00425{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":375,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":161440,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGbb3AqAIRDSP9Kt7DAbsjR8rtv8CPNIAQBAsybAAAAQEICihVnjqvNN\/R"}
01122{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":376,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":161538,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"xiwDYGpkxGGLNYKpCABFAAI5AABAAEAGa7jAqAIRDSP9Kt7DAbsjR8rtv8CPNIAYBAvKhwAAAQEICihVnj6vNN\/RFgMBAgABAAH8AwOed0BRRXhHmhS2o0Rd7s+quzaOqPDOekK9aAMPsTMIOSC1IZE3ylyuwin+a6TID60OpC6k\/IyX7sen4PPIFu25JAAiEwETAxMCwCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqAEAAZH\/AQABAAAAABMAEQAADmNkbi5zaWduYWwub3JnABcAAAANABgAFgQDCAQEAQUDAgMIBQgFBQEIBgYBAgEABQAFAQAAAAAAEgAAABAADgAMAmgyCGh0dHAvMS4xAAsAAgEAADMAJgAkAB0AIKiOhVxjy4KSaZXVIZPgxwuPZSXAvfjlA0iNSRIg7yBrAC0AAgEBACsABQQDBAMDAAoACgAIAB0AFwAYABkAFQDlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00773{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":376,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1569051267121,"flow_last_seen":1569051267161,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
00450{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":377,"source":"signal.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1569051264115,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":377,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":194585,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0UOEAAPEGq9sNI\/0qwKgCEQG73sO\/wI80I0fM8oAQAHYz9AAAAQEICq8039UoVZ4+"}
02365{"flow_id":19,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":378,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":197332,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"xGGLNYKpxiwDYGpkCABFAAXUUOIAAPEGpjoNI\/0qwKgCEQG73sO\/wI80I0fM8oAQAHYoLAAAAQEICq8039UoVZ4+FgMDAEYCAABCAwO8CP99YakUmA5\/wTpOe7dfvmNFl3vc9k06WUNBKeJlFgDALwAAGgAAAAD\/AQABAAALAAQDAAECABAABQADAmgyFgMDB6QLAAegAAedAAOkMIIDoDCCAoigAwIBAgICEBcwDQYJKoZIhvcNAQELBQAwgY0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxEzARBgNVBAMMClRleHRTZWN1cmUwHhcNMTkwMjE1MTczODE3WhcNMjkwMzEyMTgxOTUwWjB5MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEdMBsGA1UECgwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxHTAbBgNVBAsMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMRcwFQYDVQQDDA5jZG4uc2lnbmFsLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM18LQzkZEfWlg4hw\/dBL9paXMIB8No3GZAgAy\/09MbfinutJhogqyGsfD9QVwKOcVCvolxWRJxOVHLvfJ+j3OjaizipPSg4tJBcbN+9ZakhzUpPRoghEI4yiKrl0Sqi7vJNILC1JTYvkRytQ9n\/4Jbs5Y2RBnRT1TPYTV57UYEJTbpi7gEiAWGj2rth0iCCvOasx+qhZEdPOn1e6lwVwWKHe0IcTRfT2CWMW01KVLcW86+adINJC\/1ymCCoUyAve8Qsdf59G5bmObwjQzhxFqFhHY7QFfbJcvl0n1Cn1eglY+a\/RyEDs5oux7VcZ8aj6P5GLiya+i08XBOQs3AuHwECAwEAAaMdMBswGQYDVR0RBBIwEIIOY2RuLnNpZ25hbC5vcmcwDQYJKoZIhvcNAQELBQADggEBAG\/PlhcSBiL6fGKTGRpaoycPg7hJ9ziHLiB+y0QyB5wqO5derbp7SMXlOZV+SdL63ngqyVoN0iuC4BM7lU8DJithuOT+DkdBUHAdejNgRNl0tgpxiKFhl81NV1bHcDkHXtI6Eg31yWJKn5PkQX5bVICwoe1ebZJdERU+Uc4uf9IUgrJmkWNSNRRVNtXEiyL7WEbG3MlOE7UNzIJWYeBa\/F7AWNItLd5fu9hbJvGq\/pLUxVuNeSr2mrSxLF\/UtUYOvxNSwLpLCNoS7wnv60ZtLmXBCZ8hswk\/q79aWHy3ln5ByH72UEQs3psE2qaoOv8CGulVWMPSRA2lUjj3NNE1CfIAA\/MwggPvMIIC16ADAgECAgkAibotq0rk82IwDQYJKoZIhvcNAQEFBQAwgY0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMR0wGwYDVQQKDBRPcGVuIFdoaXNwZXIgU3lzdGVtczEdMBsGA1UECwwUT3BlbiBXaGlzcGVyIFN5c3RlbXMxEzARBgNVBAMMClRleHRTZWN1cmUwHhcNMTMwMzI1MjIxODM1WhcNMjMwMzIzMjIxODM1WjCBjTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xHTAbBgNVBAoMFE9wZW4gV2hpc3BlciBTeXN0ZW1zMR0wGwYDVQQLDBRPcGVuIFdoaXNwZXIgU3lzdGVtczETMBEGA1UEAwwKVGV4dFNlY3VyZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFJYGk4IEMXSLirZ3iMBeRJdQalt5a6"}
00829{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":378,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":6,"flow_first_seen":1569051267121,"flow_last_seen":1569051267197,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":1957,"flow_avg_l4_payload_len":326,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"c4b2785a87896e19d37eee932070cb22","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2"}}
01706{"flow_id":19,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":379,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":197345,"pkt_caplen":1009,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1009,"pkt_l4_len":975,"pkt":"xGGLNYKpxiwDYGpkCABFAAPjUOMAAPEGqCoNI\/0qwKgCEQG73sO\/wJTUI0fM8oAYAHYWKgAAAQEICq8039UoVZ4+BU9AKNovqoP1AM7F5bVp+98+jzreLoKurUoPEekHfoTDNVyPAuQVMgx6ju32zUVCiUC3eYStXZTS+J7pV6z7KPqCtJ\/HAgMBx2wqYjRrVJAJmWvdDW1wcCQAoVHFg1rAAPKmzkH5mapyB\/rndNdLn\/Qg89AuhwufwZYvA5g2dh8G8gsoMwi2ZlO0Ru5x2KDEQD2Z8i+8cAMRu14u1WDAGb1Hm9W+3CsPoILEjemAfsQfuQw\/Q533fAuKy+fXKEdjsW5iWuRip2Qy9ZSsqgBJXDiNvr29p4kJR1T4cKhc5I\/U9BwvpZ6c0IcCAwEAAaNQME4wHQYDVR0OBBYEFAGLGPE\/+zkZRG6Fhr6UZTKnMjyQMB8GA1UdIwQYMBaAFAGLGPE\/+zkZRG6Fhr6UZTKnMjyQMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAH4eviELnqbQu8kC7VEro248NtMwQ3v+MyiMUfEfg\/dc8V+6mNH5uQOrSk85TomMjGesPVcP8RWZNNpNVjmI6F7K\/tTMk559vaks5z2qy68jh+doRKH1uHOWf4tfG0KtE8aGTEDUgwijcn+zZYX8pVhnJyK7pvi5sn3Vc8C4E1nAia6Dv+yta9umTSGroDrPXjRZNVIq0kbsQ\/jWQl7+gXi6xjknss+TErctbMwmdvkQgkOZG\/IfynJHBaDpCbqqIYVojicvxBTgtrXHZ6fgMZdFosw9HCMQs2BA+h1HfzOgIy4DyAdl9lhihnsPtDXA1SJUdzG4WsR4FpglssSvAtUWAwMBTQwAAUkDABdBBL30nzZVyj3HADNv+D7T\/SGP9MtFevdpYYCB1v4p50Orcn7nVnrzJgFU5ZtmoIJq9\/VyVsMQpmzBxj2IoM4V8GAGAQEAmJgBb3Rs4zRx7tzAkdDCG5kzx14tBVaGWAVsUGR5HRM+WwrYbCETvNI6BA0j9kJq9NF7G5SBVz3opvSR9jb+wy4xVS08vBBUpJJF1iRj0El6WrqSBKO76KhL6n5uCypiY2s9WVlPZDa9L5ZAy9SRuEJ8djc4tj7fCULAbotLNjIdRMoyJaKfZMYv91TiqWWYXmXdK79atK9RHNU\/3LqduNgXpEy9cBAMvxZTKY2+wNjvctJ97RCpjXjCdE1u92cYqVUxaxOH7751Z0UWfUvt64l9tEOkoHSJx5A5Bx2h1LyN8hTSU1xnfQu\/mIXoIFbpKgAQXnrkYrKCwxgWbGvkWRYDAwAEDgAAAA=="}
01152{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":379,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":7,"flow_first_seen":1569051267121,"flow_last_seen":1569051267197,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":2900,"flow_avg_l4_payload_len":414,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.signal.org","server_names":"cdn.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"c4b2785a87896e19d37eee932070cb22","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=cdn.signal.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"81:3D:8A:2E:EE:B2:E1:F4:1C:2B:6D:20:16:54:B2:C1:87:D0:1E:12"}}
00427{"flow_id":19,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":380,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":200920,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGbb3AqAIRDSP9Kt7DAbsjR8zyv8CYg4AQA\/gm\/AAAAQEICihVnmWvNN\/V"}
00599{"flow_id":19,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":208672,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"xiwDYGpkxGGLNYKpCABFAACyAABAAEAGbT\/AqAIRDSP9Kt7DAbsjR8zyv8CYg4AYBADctAAAAQEICihVnmyvNN\/VFgMDAEYQAABCQQR3AJwD6bvm8LSD4P4qqhTngHu3j+sGyQuY\/SHAiBL2yXE70CUQKXnm7Nk1bW5kNxGjQM7Ydxo9Eb1d6LVwZQCKFAMDAAEBFgMDACgAAAAAAAAAAHpNgLBkD5iitC2mzH\/sbjhLNGCD9Pu3p2ZDjsJD0dhT"}
00427{"flow_id":19,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":240710,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xGGLNYKpxiwDYGpkCABFAAA0UOQAAPEGq9gNI\/0qwKgCEQG73sO\/wJiDI0fNcIAQAHYp9AAAAQEICq8039ooVZ5s"}
00497{"flow_id":19,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":241126,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"xGGLNYKpxiwDYGpkCABFAABnUOUAAPEGq6QNI\/0qwKgCEQG73sO\/wJiDI0fNcIAYAHY9+AAAAQEICq8039ooVZ5sFAMDAAEBFgMDAChvPyAnzRvtIYgg6l3Y13zBGohGG2Gmg1TjY8+hQwNiPvZJrUMz2jKJ"}
00522{"flow_id":19,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":384,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":241148,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"xGGLNYKpxiwDYGpkCABFAAB5UOYAAPEGq5ENI\/0qwKgCEQG73sO\/wJi2I0fNcIAYAHaobQAAAQEICq8039ooVZ5sFwMDAEBvPyAnzRvtIvh4qTZHjGJymA1OE9ErVGlhKg3LgTUzDsjpEwktfQUh4g5td9r8ceptZw9B8lnVDRLIYQeTukhL"}
00427{"flow_id":19,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":385,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":243345,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGbb3AqAIRDSP9Kt7DAbsjR81wv8CYtoAQA\/8mFwAAAQEICihVno2vNN\/a"}
00427{"flow_id":19,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":386,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":243402,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"xiwDYGpkxGGLNYKpCABFAAA0AABAAEAGbb3AqAIRDSP9Kt7DAbsjR81wv8CY+4AQA\/8l0gAAAQEICihVno2vNN\/a"}
00500{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":387,"source":"signal.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1569051267,"pkt_ts_usec":250865,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"xiwDYGpkxGGLNYKpCABFAABpAABAAEAGbYjAqAIRDSP9Kt7DAbsjR81wv8CY+4AYBADbrwAAAQEICihVnpSvNN\/aFwMDADAAAAAAAAAAAVWG6O8VCZhpL3ljuuQbyjQJH99xwYFcfRw3CnAmaC4jWGNvCJKk0L4="}
01156{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":627,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":255,"flow_first_seen":1569051267121,"flow_last_seen":1569051267505,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":198653,"flow_avg_l4_payload_len":779,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Signal","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"cdn.signal.org","server_names":"cdn.signal.org","ja3":"6725ca90906e1036febcbfd464e2e326","ja3s":"c4b2785a87896e19d37eee932070cb22","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, ST=California, L=San Francisco, O=Open Whisper Systems, OU=Open Whisper Systems, CN=TextSecure","issuerDN":"C=US, ST=California, O=Open Whisper Systems, OU=Open Whisper Systems, CN=cdn.signal.org","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","fingerprint":"81:3D:8A:2E:EE:B2:E1:F4:1C:2B:6D:20:16:54:B2:C1:87:D0:1E:12"}}
00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1569051245838,"flow_last_seen":1569051261595,"flow_min_l4_payload_len":300,"flow_max_l4_payload_len":300,"flow_tot_l4_payload_len":1200,"flow_avg_l4_payload_len":300,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1569051255515,"flow_last_seen":1569051255541,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":9,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.146.144","src_port":56996,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":8,"flow_first_seen":1569051255515,"flow_last_seen":1569051255541,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":77,"flow_avg_l4_payload_len":9,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"17.248.146.144","src_port":56996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":12,"flow_first_seen":1569051266396,"flow_last_seen":1569051267048,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":111,"flow_avg_l4_payload_len":9,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.24.16","dst_ip":"192.168.2.17","src_port":443,"dst_port":57016,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":12,"flow_first_seen":1569051266396,"flow_last_seen":1569051267048,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":111,"flow_avg_l4_payload_len":9,"midstream":1,"l3_proto":"ip4","src_ip":"23.57.24.16","dst_ip":"192.168.2.17","src_port":443,"dst_port":57016,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":45,"flow_first_seen":1569051247599,"flow_last_seen":1569051247843,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":11628,"flow_avg_l4_payload_len":258,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":45,"flow_first_seen":1569051264078,"flow_last_seen":1569051264482,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":12235,"flow_avg_l4_payload_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"23.57.24.16","src_port":57022,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":27,"flow_first_seen":1569051247600,"flow_last_seen":1569051261087,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3832,"flow_avg_l4_payload_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57019,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":27,"flow_first_seen":1569051247601,"flow_last_seen":1569051261087,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3875,"flow_avg_l4_payload_len":143,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57020,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":26,"flow_first_seen":1569051247603,"flow_last_seen":1569051261087,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4093,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":57021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":26,"flow_first_seen":1569051264090,"flow_last_seen":1569051264669,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3875,"flow_avg_l4_payload_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57023,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":26,"flow_first_seen":1569051264091,"flow_last_seen":1569051264679,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4093,"flow_avg_l4_payload_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57024,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":26,"flow_first_seen":1569051264093,"flow_last_seen":1569051264674,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3832,"flow_avg_l4_payload_len":147,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57025,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":38,"flow_first_seen":1569051264666,"flow_last_seen":1569051265237,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":17722,"flow_avg_l4_payload_len":466,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":57026,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00514{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1569051257169,"flow_last_seen":1569051257194,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":5,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"2.18.232.118","src_port":57017,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1569051257169,"flow_last_seen":1569051257194,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":23,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":5,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"2.18.232.118","src_port":57017,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":24,"flow_first_seen":1569051247594,"flow_last_seen":1569051257495,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3653,"flow_avg_l4_payload_len":152,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"34.225.240.173","src_port":49226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":25,"flow_first_seen":1569051264073,"flow_last_seen":1569051267100,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4493,"flow_avg_l4_payload_len":179,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"35.169.3.40","src_port":49227,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":255,"flow_first_seen":1569051267121,"flow_last_seen":1569051267601,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":198653,"flow_avg_l4_payload_len":779,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"13.35.253.42","src_port":57027,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1569051264088,"flow_last_seen":1569051264113,"flow_min_l4_payload_len":55,"flow_max_l4_payload_len":151,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":56263,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1569051247593,"flow_last_seen":1569051247630,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.17","dst_ip":"192.168.2.1","src_port":60793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":637,"source":"signal.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 637/637
~~ skipped flows.............: 0
~~ total layer4 data length..: 294110 bytes
~~ total detected protocols..: 16
~~ total active/idle flows...: 19/19
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 5166470 bytes
~~ total memory freed........: 5166470 bytes
~~ total allocations/frees...: 59163/59163
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~