path: root/test/results/KakaoTalk_chat.pcap.out

00482{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1430069021959,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":38448,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00445{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069021,"pkt_ts_usec":959113,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwAAEAAQBHSIAoYUrwKvAEBljAANQAogKaG7QEAAAEAAAAAAAAEYXV0aAVrYWthbwNjb20AAAEAAQ=="}
00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1430069021959,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":38448,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"auth.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1430069022006,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":35603,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":6995,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":79,"pkt_l4_len":43,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAD8AAEAAQBHSHQoYUrwKvAEBixMANQArGNJpegEAAAEAAAAAAAAHYWMtdGFsawVrYWthbwNjb20AAAEAAQ=="}
00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1430069022006,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":35603,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"ac-talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1430069022007,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":57816,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00443{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":7117,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":78,"pkt_l4_len":42,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAD4AAEAAQBHSHgoYUrwKvAEB4dgANQAqGG9RAgEAAAEAAAAAAAAGa2F0YWxrBWtha2FvA2NvbQAAAQAB"}
00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1430069022007,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":57816,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"katalk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00527{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":41815,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":136,"pkt_l4_len":100,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAHgb0gAANREBEwq8AQEKGFK8ADWLEwBk4PlpeoGAAAEAAwAAAAAHYWMtdGFsawVrYWthbwNjb20AAAEAAcAMAAUAAQAABZUADQdhYy10YWxrAmdswBTALwABAAEAAACbAARuTI1wwC8AAQABAAAAmwAEAckAJw=="}
00686{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":4,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1430069022006,"flow_last_seen":1430069022041,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":127,"flow_avg_l4_payload_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":35603,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"ac-talk.kakao.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.141.112"}}
00495{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":41999,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":114,"pkt_l4_len":78,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGIb0wAANREBKAq8AQEKGFK8ADWWMABOrZ2G7YGAAAEAAgAAAAAEYXV0aAVrYWthbwNjb20AAAEAAcAMAAUAAQAABccACgRhdXRoAmdswBHALAABAAEAAABWAATSZ\/AP"}
00683{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":5,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1430069021959,"flow_last_seen":1430069022041,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":38448,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"auth.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.15"}}
00568{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":42121,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":166,"pkt_l4_len":130,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAJbtdwAANREvTwq8AQEKGFK8ADXh2ACCeK5RAoGAAAEABQAAAAAGa2F0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAD9AAMBmthdGFsawJnbMATwC4AAQABAAAAegAEbkyOIsAuAAEAAQAAAHoABAHJAD3ALgABAAEAAAB6AAQByQA\/wC4AAQABAAAAegAEbkyNJQ=="}
00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1430069022007,"flow_last_seen":1430069022042,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":122,"flow_tot_l4_payload_len":156,"flow_avg_l4_payload_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":57816,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"katalk.kakao.com","num_queries":1,"num_answers":5,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.142.34"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1430069022058,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":41909,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00452{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":58570,"pkt_caplen":84,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":84,"pkt_l4_len":48,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEQAAEAAQBHSGAoYUrwKvAEBo7UANQAwrR37RAEAAAEAAAAAAAAHYm9va2luZwRsb2NvBWtha2FvA2NvbQAAAQAB"}
00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1430069022058,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":41909,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"booking.loco.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1430069022059,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":12908,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00448{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":59149,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEBMmwANQAtbIX3UQEAAAEAAAAAAAAEdXAtbQR0YWxrBWtha2FvA2NvbQAAAQAB"}
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1430069022059,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":12908,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-m.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1430069022059,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":58810,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00444{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":59638,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwAAEAAQBHSIAoYUrwKvAEB5boANQAoZpVNewEAAAEAAAAAAAAEaXRlbQVrYWthbwNjb20AAAEAAQ=="}
00655{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1430069022059,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":58810,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"item.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00496{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":93909,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":114,"pkt_l4_len":78,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGIb1QAANREBJgq8AQEKGFK8ADXlugBOjwdNe4GAAAEAAgAAAAAEaXRlbQVrYWthbwNjb20AAAEAAcAMAAUAAQAABdUACgRpdGVtAmdswBHALAABAAEAAADUAATSZ\/AP"}
00684{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":10,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1430069022059,"flow_last_seen":1430069022093,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":58810,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"item.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.15"}}
00511{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":94092,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":124,"pkt_l4_len":88,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGzteAAANREveAq8AQEKGFK8ADUybABYuHj3UYGAAAEAAgAAAAAEdXAtbQR0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAD8wAPBHVwLW0EdGFsawJnbMAWwDEAAQABAAAAeAAE0mfwEA=="}
00689{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":11,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1430069022059,"flow_last_seen":1430069022094,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":12908,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-m.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.16"}}
00519{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":94214,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":130,"pkt_l4_len":94,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAHLteQAANREvcQq8AQEKGFK8ADWjtQBeT7D7RIGAAAEAAgAAAAAHYm9va2luZwRsb2NvBWtha2FvA2NvbQAAAQABwAwABQABAAAD8wASB2Jvb2tpbmcEbG9jbwJnbMAZwDQAAQABAAAAeAAEbkyOfQ=="}
00692{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":12,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1430069022058,"flow_last_seen":1430069022094,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":41909,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"booking.loco.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.142.125"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1430069022100,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":5929,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":100592,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEBFykANQAtVi4l7AEAAAEAAAAAAAAEdXAtcAR0YWxrBWtha2FvA2NvbQAAAQAB"}
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1430069022100,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":5929,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-p.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":14,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1430069022104,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":9094,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":104834,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEBI4YANQAt2SeQlQEAAAEAAAAAAAAEdXAtdgR0YWxrBWtha2FvA2NvbQAAAQAB"}
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1430069022104,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":9094,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-v.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":15,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1430069022105,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":56820,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":105414,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEB3fQANQAtU9dudwEAAAEAAAAAAAAEdXAtYwR0YWxrBWtha2FvA2NvbQAAAQAB"}
00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1430069022105,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":56820,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-c.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00512{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":234412,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":124,"pkt_l4_len":88,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGwb1gAANREBGwq8AQEKGFK8ADUXKQBYAAol7IGAAAEAAgAAAAAEdXAtcAR0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAFlQAPBHVwLXAEdGFsawJnbMAWwDEAAQABAAAAiwAE0mfwEA=="}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":16,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1430069022100,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":5929,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-p.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.16"}}
00512{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":234626,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":124,"pkt_l4_len":88,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGwb1wAANREBGgq8AQEKGFK8ADUjhgBYgN2QlYGAAAEAAgAAAAAEdXAtdgR0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAFlwAPBHVwLXYEdGFsawJnbMAWwDEAAQABAAAAqwAE0mfwEA=="}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":17,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1430069022104,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":9094,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-v.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.16"}}
00512{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":234717,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":124,"pkt_l4_len":88,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGztegAANREvdgq8AQEKGFK8ADXd9ABYZqtud4GAAAEAAgAAAAAEdXAtYwR0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAD8wAPBHVwLWMEdGFsawJnbMAWwDEAAQABAAAAeAAEbkyNVQ=="}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":18,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1430069022105,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":56820,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-c.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.141.85"}}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1430069022249,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":29029,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00451{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":249457,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEBcWUANQAtiQin1QEAAAEAAAAAAAAEdXAtYQR0YWxrBWtha2FvA2NvbQAAAQAB"}
00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1430069022249,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":29029,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-a.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":20,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1430069022252,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":25117,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00456{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":252173,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":82,"pkt_l4_len":46,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEIAAEAAQBHSGgoYUrwKvAEBYh0ANQAu\/udwlQEAAAEAAAAAAAAFdXAtZ3AEdGFsawVrYWthbwNjb20AAAEAAQ=="}
00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1430069022252,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":25117,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-gp.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":21,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1430069022252,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":43077,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00451{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":252722,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEBqEUANQAtOYa3iAEAAAEAAAAAAAAEZG4tbAR0YWxrBWtha2FvA2NvbQAAAQAB"}
00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":21,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1430069022252,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":43077,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"dn-l.talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00513{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":282050,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":124,"pkt_l4_len":88,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGwb2AAANREBGQq8AQEKGFK8ADVxZQBYBjqn1YGAAAEAAgAAAAAEdXAtYQR0YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAFwgAPBHVwLWEEdGFsawJnbMAWwDEAAQABAAAARAAE0mfwEA=="}
00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":22,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1430069022249,"flow_last_seen":1430069022282,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":29029,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-a.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.16"}}
00475{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":295691,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":97,"pkt_l4_len":61,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAFHtewAANREvkAq8AQEKGFK8ADWoRQA9yiS3iIGAAAEAAQAAAAAEZG4tbAR0YWxrBWtha2FvA2NvbQAAAQABwAwAAQABAAAEOQAEbkyNVg=="}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":23,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1430069022252,"flow_last_seen":1430069022295,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":43077,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"dn-l.talk.kakao.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.141.86"}}
00513{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":295813,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":126,"pkt_l4_len":90,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAG4b2QAANREBFgq8AQEKGFK8ADViHQBaJnpwlYGAAAEAAgAAAAAFdXAtZ3AEdGFsawVrYWthbwNjb20AAAEAAcAMAAUAAQAABasAEAV1cC1ncAR0YWxrAmdswBfAMgABAAEAAACsAARuTI0a"}
00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":24,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1430069022252,"flow_last_seen":1430069022295,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":82,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":25117,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"up-gp.talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"110.76.141.26"}}
00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":25,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1430069022297,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"103.246.57.251","src_port":51021,"dst_port":8080,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":297766,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADzzVkAAPwZJoAoYUrxn9jn7x00fkMsN9JkAAAAAoAI5CGIPAAACBAV4BAIICgALB88AAAAAAQMDBw=="}
00448{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":411444,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADwAAEAALQZO92f2OfsKGFK8H5DHTSs\/AzbLDfSaoBIWoGVTAAACBAV4BAIICpj2V6UACwfPAQMDCQ=="}
00435{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":419806,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADTzV0AAPwZJpwoYUrxn9jn7x00fkMsN9JorPwM3gBAAc6oGAAABAQgKAAsH25j2V6U="}
01236{"flow_id":13,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":470435,"pkt_caplen":657,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":657,"pkt_l4_len":621,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAoHzWEAAPwZHWQoYUrxn9jn7x00fkMsN9JorPwM3gBgAc7\/9AAABAQgKAAsH4Jj2V6UAAQAABQAAAAIAAACFu44d6eKRW8xEcB\/UnBAy24xe+l6rapUvi1UugWhQr8JVyzf92hUpPODCs6WuL68W4Vjci8Xt4n9a+OFdkbvZyV3LZKoOlbwvwVlwywL2DKMKwAhl4TCIfFl8mnR64ih5Z1dq5qFOPDK7UMEuwqY0TXlrdK\/\/D+oGBTFlIKyOkC\/CCT6VjbaqJ89fBS7PSYVOk8G9aIjHG5IEf42V8z0x\/sXGcMp3htvM\/7RE5EXumrc0OOus1OaMDdJUuDisEtGwy9jv7DVTZssoRvTfDjsMZUDpN7vskrwxzFKEo1m8jBbYRs729RfzMRL5ebr1BgnlnFa0\/18rseKhcz+uZX5BPQEAAKBZAv+ID\/LQjX6bgoz0NN5F+fY8ocOuEw0VMu\/6TrY93rzCtLaGBMxSDuCpu1Bcs+O+i6PokL4MldAhZMGx93P9pp2m5PE0hNRm1IEvCDCj7FiRZuFp+rTL8ZUDe3tAe2S2ixtcFkxLGer+iQEoOuqxO7zwkX8IUaQnXUDB4JwKZN0ed1S0OWVFMQp6T\/0oeVKk9uS1cH17rd8WQbDMPIsE0MkKM\/h9W0QkbK+K4uqzQ7i0YnYx\/Bs+9n6g0SJaPaZkhxlDZnAJjotfpmO+TvWfOwJM6sFRlgEUNg13BjWbJMHuYML+9ghYSOUR54rgsStfbWhXf61lakWyBXwk8iCvPJaicMoaUM99gNXjBpXPIRk\/FgLVSxT1l8Z7NtGfTGipcn5uyhUwPBwOBxg8mNyVSj0lcw8z3Lid8xqx"}
00436{"flow_id":13,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":611701,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADRbH0AALgby32f2OfsKGFK8H5DHTSs\/AzfLDfbngBAADqdRAAABAQgKmPZYbQALB+A="}
00720{"flow_id":13,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":647742,"pkt_caplen":274,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":274,"pkt_l4_len":238,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAQJbIEAALgbyEGf2OfsKGFK8H5DHTSs\/AzfLDfbngBgADsrbAAABAQgKmPZYlAALB+DKAAAAoFkC\/4gP8tCNfpuCjPQ03kX5ZT2hwz0SDRU07eJflBwtFPV5JKc4qwZt9JmLd5nDiTYuAz6hED52mR1p+zgppELWWzSgjEgOr0doFoIFR2TYBxPm5xdGUCIRoKCHpKsU3VWhb+nYsDx5Pf8LCQ5Oo8lRB6Gg9+zmhy4riv76TlqCUugtK45ol2sMT3a1TCBjfuA7G\/n4jpBG8I4WhofsXSCtmEkKDblHy\/21GbGey\/YH3wn8eRewb+YRKoHNU\/+oeWFRMCrCIIrlzQ=="}
00435{"flow_id":13,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069022,"pkt_ts_usec":651343,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADTzWUAAPwZJpQoYUrxn9jn7x00fkMsN9ucrPwQFgBAAe6XcAAABAQgKAAsH85j2WJQ="}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":32,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1430069026012,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"216.58.221.10","dst_ip":"10.24.82.188","src_port":80,"dst_port":35922,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00420{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":12030,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq7kAArAYRrNg63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00419{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":58295,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00421{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":148230,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq70AArQYQq9g63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00420{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":156775,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":36,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1430069026370,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35503,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00449{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":370215,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADzmtkAAPwbpMgoYUryt\/GECiq8Bu\/wa79AAAAAAoAI5CCGaAAACBAV4BAIICgALCWYAAAAAAQMDBw=="}
00476{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069026,"pkt_ts_usec":490363,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFPzWkAAPwZJhQoYUrxn9jn7x00fkMsN9ucrPwQFgBgAezf0AAABAQgKAAsJcpj2WJQbAAAAo1kC\/4gP7taEcNXOxadg3tEhq8tPTAcjxeAa"}
00476{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":365912,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFPzW0AAPwZJhAoYUrxn9jn7x00fkMsN9ucrPwQFgBgAezedAAABAQgKAAsJyZj2WJQbAAAAo1kC\/4gP7taEcNXOxadg3tEhq8tPTAcjxeAa"}
00449{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":366126,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADzmt0AAPwbpMQoYUryt\/GECiq8Bu\/wa79AAAAAAoAI5CCE2AAACBAV4BAIICgALCcoAAAAAAQMDBw=="}
00421{"flow_id":14,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":380255,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq8UAArQYQqdg63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00420{"flow_id":14,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":385169,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00424{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":408118,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACyOBEAA+AaI9K38YQIKGFK8AbuKr2Aiq0X8Gu\/RYBIRHJekAAACBAV4"}
00421{"flow_id":15,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":415442,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjmuEAAPwbpRAoYUryt\/GECiq8Bu\/wa79FgIqtGUBA5CIc5AAA="}
00671{"flow_id":15,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069027,"pkt_ts_usec":422126,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":240,"pkt_l4_len":204,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAODmuUAAPwboiwoYUryt\/GECiq8Bu\/wa79FgIqtGUBg5CCTlAAAWAwEAswEAAK8DAVU9HySXfmPaSP66Sz+6k6Z\/7zxfemNbfoeAqoBY5ktfAABGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
00759{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":44,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":5,"flow_first_seen":1430069026370,"flow_last_seen":1430069027422,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":184,"flow_tot_l4_payload_len":184,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35503,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1430069028075,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"120.28.26.242","dst_ip":"10.24.82.188","src_port":80,"dst_port":34503,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00418{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":75659,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgUEEAA+AZ+3XgcGvIKGFK8AFCGx0Ds0yKXy0vyUBQAAEEKAAA="}
00424{"flow_id":15,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":103644,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACynf0AA+AZvea38YQIKGFK8AbuKr2YOB1z8Gu\/RYBIRHDWiAAACBAV4"}
00421{"flow_id":15,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":105689,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjmukAAPwbpQgoYUryt\/GECiq8Bu\/wa8IlgIqtGUBA5CIaBAAA="}
00424{"flow_id":15,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":159644,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgaA+a38YQIKGFK8AbuKr2Aiq0b8Gu\/RYBClZAjXAAABAQEB"}
00496{"flow_id":13,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":231787,"pkt_caplen":111,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":111,"pkt_l4_len":75,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAF9bIUAALgbysmf2OfsKGFK8H5DHTSs\/BAXLDfcGgBgADgZ1AAABAQgKmPZuZQALCcknAAAAo1kC\/4gP7taEcNXOxadg3tEhv8tPTBMjxeAKcsC92PhHEHcZ7kW5"}
00436{"flow_id":13,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":238593,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADTzXEAAPwZJogoYUrxn9jn7x00fkMsN9wYrPwQwgBAAe42TAAABAQgKAAsKIZj2bmU="}
00421{"flow_id":14,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069028,"pkt_ts_usec":960211,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq8kAArAYRqNg63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00419{"flow_id":14,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069029,"pkt_ts_usec":28022,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":53,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1430069030083,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":61011,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":83014,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBHSGwoYUrwKvAEB7lMANQAt50i5OgEAAAEAAAAAAAAJcGx1cy10YWxrBWtha2FvA2NvbQAAAQAB"}
00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":53,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1430069030083,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":61011,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"plus-talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":54,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1430069030083,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","src_port":61011,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":83228,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":81,"pkt_l4_len":45,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEEAAEAAQBEUGwoYUrwKvL8B7lMANQAtKUi5OgEAAAEAAAAAAAAJcGx1cy10YWxrBWtha2FvA2NvbQAAAQAB"}
00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":54,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1430069030083,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","src_port":61011,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"plus-talk.kakao.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00505{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":55,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":115576,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":119,"pkt_l4_len":83,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGccBgAANREA8Aq8AQEKGFK8ADXuUwBTwyO5OoGAAAEAAgAAAAAJcGx1cy10YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAAHYwAKBHBsdXMCZ2zAFsAxAAEAAQAAAQkABNJn8A8="}
00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":55,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1430069030083,"flow_last_seen":1430069030115,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":61011,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"plus-talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.15"}}
00505{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":56,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":119544,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":119,"pkt_l4_len":83,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGf90QAANRFhIwq8vwEKGFK8ADXuUwBTEye5OoGAAAEAAgAAAAAJcGx1cy10YWxrBWtha2FvA2NvbQAAAQABwAwABQABAAADlQAKBHBsdXMCZ2zAFsAxAAEAAQAAAMkABNJn8A8="}
00692{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":56,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1430069030083,"flow_last_seen":1430069030119,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","src_port":61011,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.KakaoTalk","breed":"Acceptable","category":"Chat"},"dns": {"query":"plus-talk.kakao.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"210.103.240.15"}}
00459{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":57,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1430069030119,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","l4_proto":"icmp","flow_datalink":113,"flow_max_packets":15}
00544{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":119696,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":147,"pkt_l4_len":111,"pkt":"AAQCEgAAAAAAAAAAAAAIAEXAAIMZuAAAQAE5cQoYUrwKvL8BAwMj8wAAAABFAABn\/dEAADURYSMKvL8BChhSvAA17lMAUxMnuTqBgAABAAIAAAAACXBsdXMtdGFsawVrYWthbwNjb20AAAEAAcAMAAUAAQAAA5UACgRwbHVzAmdswBbAMQABAAEAAADJAATSZ\/AP"}
00489{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":57,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1430069030119,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}}
00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":58,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1430069030121,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":37821,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00449{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":121588,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwrfUAAPwbw8woYUrzSZ\/APk70Bu6\/qIaMAAAAAoAI5CH35AAACBAV4BAIICgALCt4AAAAAAQMDBw=="}
00423{"flow_id":20,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":159674,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwUQ0AA+AZPPdJn8A8KGFK8AbuTvWC6rQuv6iGkYBIRHPMdAAACBAV4"}
00421{"flow_id":20,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":162268,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgrfkAAPwbxBgoYUrzSZ\/APk70Bu6\/qIaRguq0MUBA5COKyAAA="}
00716{"flow_id":20,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":171973,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":272,"pkt_l4_len":236,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAQArf0AAPwbwLQoYUrzSZ\/APk70Bu6\/qIaRguq0MUBg5CN2\/AAAWAwEA0wEAAM8DAVU9HyfJAvY\/iCLGWBYFY6M34NB+ZLfXCieB9l4jqbmhICKG\/HsNhwdjbCYE9375OW83ETGox9gGaZ9Lj69f7wR6AEYABAAFAC8ANcACwATABcAMwA7AD8AHwAnACsARwBPAFAAzADkAMgA4AArAA8ANwAjAEgAWABMACQAVABIAAwAIABQAEQD\/AQAAQAALAAQDAAECAAoANAAyAA4ADQAZAAsADAAYAAkACgAWABcACAAGAAcAFAAVAAQABQASABMAAQACAAMADwAQABE="}
00743{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":61,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1430069030121,"flow_last_seen":1430069030171,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":216,"flow_tot_l4_payload_len":216,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":37821,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00423{"flow_id":20,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":62,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":201514,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgbNgNJn8A8KGFK8AbuTvWC6rQyv6iGkYBClZGRQAAABAQEB"}
00419{"flow_id":20,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":219794,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgcBkAAjwawftJn8A8KGFK8AbuTvWC6rQyv6iJ8UBCkjHZWAAA="}
02147{"flow_id":20,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":296057,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSgcB0AAjwarfdJn8A8KGFK8AbuTvWC6rQyv6iJ8UBCkjCrpAAAWAwEAUQIAAE0DAVU9HybSxelSaq+pzmyJ9iH7XTYBi90VegBpgRmAoaXMIG1yJoOhsfxA3WeIW6NaHJC+xs4pmCDhwQX3Hd61kRPCAC8AAAX\/AQABABYDAQ1cCwANWAANVQAEkzCCBI8wggN3oAMCAQICEHBxAlA9e78ophcAJA6JZewwDQYJKoZIhvcNAQEFBQAwPDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDFRoYXd0ZSwgSW5jLjEWMBQGA1UEAxMNVGhhd3RlIFNTTCBDQTAeFw0xNDA0MTgwMDAwMDBaFw0xNjA0MTcyMzU5NTlaMGUxCzAJBgNVBAYTAktSMRQwEgYDVQQIEwtHeWVvbmdnaS1kbzEUMBIGA1UEBxQLU2VvbmduYW0tc2kxFDASBgNVBAoUC0tha2FvIENvcnAuMRQwEgYDVQQDFAsqLmtha2FvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMdBgTNDUchcOlqz4AjXSOi\/BcjY+nqEiKfppHMuXJO3yGAFmWhd9O+QBCm8FcKZId9u+XO\/um9F0vmt2qfDKgWEZzJg9B6SDfGolTUXhgk+nFdcE+S86ZtHITX7kSDXzmWcPrT6RJ0PN551hp\/GdJ+xmFbpNL2nv+CJCtbz92qR+yKEPTqSSnlzR89VsAXsBFgk4O0PitPyU2Xtqz+5c\/enf99utZy\/VMz7gvdC\/aVXMBorKXtqwbf1dxYqtxp6htoLhcZBYya6Lxnd54fIw4rshOg27mE5Bn7MAbOHc0PO94q1KalkWJCTnyw3svUS+OZW13LZpEW5Hgu\/jjQaMR8CAwEAAaOCAWIwggFeMBYGA1UdEQQPMA2CCyoua2FrYW8uY29tMAkGA1UdEwQCMAAwQgYDVR0gBDswOTA3BgpghkgBhvhFAQc2MCkwJwYIKwYBBQUHAgEWG2h0dHBzOi8vd3d3LnRoYXd0ZS5jb20vY3BzLzAOBgNVHQ8BAf8EBAMCBaAwHwYDVR0jBBgwFoAUp6KDuzRFQD381TBPErk+oQGf9tswOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL3N2ci1vdi1jcmwudGhhd3RlLmNvbS9UaGF3dGVPVi5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGkGCCsGAQUFBwEBBF0wWzAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTA1BggrBgEFBQcwAoYpaHR0cDovL3N2ci1vdi1haWEudGhhd3RlLmNvbS9UaGF3dGVPVi5jZXIwDQYJKoZIhvcNAQEFBQADggEBAEvk4yJ5GQZJjDzFLUrMFlBcD5uqP2DKwtFXXOSxaOkky94i9Uhfy7m06\/v4+iOEZVwfFAhpzoTNlly1sPZpMgJyCJ9X4jAYQgiUFyR8fKM\/armugJYR4o3GxrpmZILs6uldpFhtPBRUKSKU0yMcXueyHm\/2X+ml5UR1JeYCWg8gFnncL\/IN7BuZa9Gf6J0+hJSZeIXsEPg15pir43Yi0sJuk7IYfyqYMnMjaGDs7p8Ad+KYYTNX0gD8K9dUkSsuPJJaD9fOM2mjg5ypvUtvrvd6E\/aWowgetkckYpQ9D\/YTqpvJ4IELD8pwbZBD9NSYbX1EPo0PjwPS0vsgCoPcqFkABHAwggRsMA=="}
00813{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":64,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":7,"flow_first_seen":1430069030121,"flow_last_seen":1430069030296,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1496,"flow_avg_l4_payload_len":213,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":37821,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"4192c0a946c5bd9b544b4656d9f624a4","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_128_CBC_SHA"}}
00646{"flow_id":20,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":300360,"pkt_caplen":224,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":224,"pkt_l4_len":188,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAANAcCEAAjwav1NJn8A8KGFK8AbuTvWC6sgyv6iJ8UBikjBF9AACCA1SgAwIBAgIQTV8sNAiyTCDNbVB+JE3J7DANBgkqhkiG9w0BAQUFADCBqTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIwMDYgdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcmk="}
02143{"flow_id":20,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":301276,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSgcCUAAjware9Jn8A8KGFK8AbuTvWC6srSv6iJ8UBCkjBhFAAB6ZWQgdXNlIG9ubHkxHzAdBgNVBAMTFnRoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EwHhcNMTAwMjA4MDAwMDAwWhcNMjAwMjA3MjM1OTU5WjA8MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMRYwFAYDVQQDEw1UaGF3dGUgU1NMIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmeSFW3ZJfS8F2MWsyMip09yY5tc0pi8M8iIm2KPJFEyPBaRF6BQMWJAFGrfFwQalgK+7HUlrUjSIw1nn72vEJ0GMK2Yd0OCjl5gZNEtB1ZjVxwWtouTX7QytT8G1sCH9PlBTssSQ0NQwZ2ya8Q50xMLciuiX\/8mSrgGKVgqYMrAAI+yQGmDD7bs6yw9jnw1EyVLhJZa\/7VCViX9WFLG3YR0cB4w6LPf\/gN45RdWvGtF42MdxaqMZpzJQIenyDqHGEwNESNFmqFJX1xG0k4vlmZ9d53hR5U32t1m0drUJN00GOBN6HAiYXMRISstSoKn4sZ2Oe3mwIC88lqgRYke7EQIDAQABo4H7MIH4MDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTASBgNVHRMBAf8ECDAGAQH\/AgEAMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQQ0EuY3JsMA4GA1UdDwEB\/wQEAwIBBjAoBgNVHREEITAfpB0wGzEZMBcGA1UEAxMQVmVyaVNpZ25NUEtJLTItOTAdBgNVHQ4EFgQUp6KDuzRFQD381TBPErk+oQGf9tswHwYDVR0jBBgwFoAUe1tFz6\/Oy3r9MZIaarbzRutXSFAwDQYJKoZIhvcNAQEFBQADggEBAIAigOBsyJUW11cmh\/NyNNvGclYnPtOW9i4lkaU+M5enS+Uv+yV9Lwdh+m+DdExMU3IgpHrPUVFWgYiwbR82LMgrsYiZwf5Eq0hRfNjyRGQq2HGn+xov+RmNNLIjv8RMVR2OROiqXZrdn\/0Dx7okQ40tR0Tb9tiYyLL52u\/tKVxpEvrRI5YPv5wN8nlFUzeaVi\/oVxBw9u6JDEmJmsEj9cIqzEHPIqtlbreUgm0vQF9Y3uuVK6ZyaFIZkSqudZ1OkubK3lTqGKslPOZkpnkfJn1h7X3S5XFV2JMXfBQ4MDzfhuNMrUnjl1nOG5srztxl1Asoa06ERlFE9zMILViXIa4ABEkwggRFMIIDrqADAgECAhAzZVAIea1z4jC54B0Nf6yRMA0GCSqGSIb3DQEBBQUAMIHOMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xHTAbBgNVBAoTFFRoYXd0ZSBDb25zdWx0aW5nIGNjMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSEwHwYDVQQDExhUaGF3dGUgUHJlbWl1bSBTZXJ2ZXIgQ0ExKDAmBgkqhkiG9w0BCQEWGXByZW1pdW0tc2VydmVyQHRoYXd0ZS5jb20wHhcNMDYxMTE3MDAwMDAwWhcNMjAxMjMwMjM1OTU5WjCBqTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDA=="}
00422{"flow_id":20,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":304267,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgrgEAAPwbxBAoYUrzSZ\/APk70Bu6\/qInxgurIMUBBBANTiAAA="}
00422{"flow_id":20,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":304419,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgrgUAAPwbxAwoYUrzSZ\/APk70Bu6\/qInxgurK0UBBLAMo6AAA="}
00422{"flow_id":20,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":304541,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgrgkAAPwbxAgoYUrzSZ\/APk70Bu6\/qInxgure0UBBVALs6AAA="}
01491{"flow_id":20,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":336219,"pkt_caplen":848,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":848,"pkt_l4_len":812,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAA0AcCkAAjwatYtJn8A8KGFK8AbuTvWC6t7Sv6iJ8UBikjPhiAAB0aGF3dGUsIEluYy4xKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xODA2BgNVBAsTLyhjKSAyMDA2IHRoYXd0ZSwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MR8wHQYDVQQDExZ0aGF3dGUgUHJpbWFyeSBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKDw+4BZ1JzHpM+doVlzCRBFDA0sbmjxbFtIaElZN\/wLMxnCd3\/MEC2VNBzm600JpxzSuMmXNgK3idQkXwbAzESUlI0CYm\/rWt0RjSiaXISQEHoNvXRmL2o4oOLVVETrHQefB7pv7un9Tgsp9T6EoAHxnKv4HH6JpOih2HFlDaNRe+680iJgDblbnd+6\/FFbC6+Ysuku6QToYofeK8jXTsFMZB7dz4dYukpPymgHHRydSsbVL5HMfHFyHMXAZ+sy\/cmSXJTahcCbv1N9Kwn0jJ2RH5dqUsveCTakd9h7h1BE1T5uKWn7OUkmHgmlgHtALevoJ4XJ\/mH9fuZ8lx3VnQIDAQABo4HCMIG\/MA8GA1UdEwEB\/wQFMAMBAf8wOwYDVR0gBDQwMjAwBgRVHSAAMCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LnRoYXd0ZS5jb20vY3BzMA4GA1UdDwEB\/wQEAwIBBjAdBgNVHQ4EFgQUe1tFz6\/Oy3r9MZIaarbzRutXSFAwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVByZW1pdW1TZXJ2ZXJDQS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAhKhMyT4qvJrizI8LsiV3xGGJiWNa1KMVQNT7Xj+0Q+pjFytrmXSeCajd1FYVLnp5MV9jllMbNNkV6k9tcMq+9oKp7dqFd8x2HGqBCiHYQZl\/Xi6Cweiq95OBBaqStB+3msAHF\/XLxrRMDtdW3HEgdDjWdMbWj2uvi42gbCkLYeAWAwEABA4AAAA="}
01068{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":70,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":13,"flow_first_seen":1430069030121,"flow_last_seen":1430069030336,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":3736,"flow_avg_l4_payload_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":37821,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)","8":"Weak TLS cipher"},"proto":"TLS.KakaoTalk","breed":"Acceptable","category":"Chat"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.kakao.com","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"4192c0a946c5bd9b544b4656d9f624a4","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_128_CBC_SHA","issuerDN":"C=US, O=Thawte, Inc., CN=Thawte SSL CA","issuerDN":"C=KR, ST=Gyeonggi-do, L=Seongnam-si, O=Kakao Corp., CN=*.kakao.com","fingerprint":"0D:14:6D:8D:5E:EB:F5:F5:42:87:CD:AB:AE:A1:DC:AA:5A:76:6F:E4"}}
00422{"flow_id":20,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":338782,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgrg0AAPwbxAQoYUrzSZ\/APk70Bu6\/qInxgurrMUBBfAK4iAAA="}
00671{"flow_id":15,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":435553,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":240,"pkt_l4_len":204,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAODmu0AAPwboiQoYUryt\/GECiq8Bu\/wa79FgIqtGUBg5CCTlAAAWAwEAswEAAK8DAVU9HySXfmPaSP66Sz+6k6Z\/7zxfemNbfoeAqoBY5ktfAABGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
00872{"flow_id":20,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":469611,"pkt_caplen":382,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":382,"pkt_l4_len":346,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAW4rhEAAPwbvugoYUrzSZ\/APk70Bu6\/qInxgurrMUBhfAMGpAAAWAwEBBhAAAQIBADHdbtJlVbXP2Me7Ma38p8XS6wSYh+\/vRpK9j6DRf1Em2AM+p7cPSuHY5QUwZ\/vwXG2x7mxyFDwbjTwb2PkmLKI0Ump3aTqTXtuVvVcmhMuWwXk\/DYR4pH2OX1XBOeo\/Pl5TLZglBYU+GsVJLft7PxMPGUXzRakDmG1RVyWwtRalnuwhD\/2Wl\/d1cIBeHJgGzssBXyvaiJaQBQltboVO3gfTXEKif8kN82LDfp7K9ACWYOf4VJAJao0vd3J\/3TvD6jcRgL4U61zLvcOB3Q4flQVIgizBtDjwsIjlNTLEqD0a5DQSjhsPbnCyYELZRdQqR5Xfu5wCvBQnnYeZBa4Y\/EMUAwEAAQEWAwEAMF6qtHnfxQkE14fW7bitUio1+IL\/sCxOok+D\/0MblfYd\/OMJ36oREYUVEOQtHf30uw=="}
00420{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":480017,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACheakAAjwYhk638YQIKGFK8AbuKr2Aiq0b8GvCJUBCkrBrdAAA="}
00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":75,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1430069030508,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37553,"dst_port":80,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":508795,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADz6+UAAPwaAjQoYUrwfDURUkrEAUI6+8f0AAAAAoAI5CDAyAAACBAV4BAIICgALCwQAAAAAAQMDBw=="}
00423{"flow_id":21,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":549536,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACy6BkAA+AYIkB8NRFQKGFK8AFCSsWQ58S+OvvH+YBIRHF3ZAAACBAV4"}
00419{"flow_id":21,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":552619,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACj6+kAAPwaAoAoYUrwfDURUkrEAUI6+8f5kOfEwUBA5CE1uAAA="}
00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":79,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1430069030557,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":1,"l3_proto":"ip4","src_ip":"31.13.68.73","dst_ip":"10.24.82.188","src_port":443,"dst_port":47007,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00455{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":557074,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":83,"pkt_l4_len":47,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAEMbkEAAjgYQ+x8NREkKGFK8Abu3n2dAc1oKhoE3UBigBOCLAAAVAwEAFgdiLTjhEFi+7He1g59CCs5hRzaz7rI="}
00419{"flow_id":22,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":557379,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgOyEAAQAZr3goYUrwfDURJt58BuwqGgTdnQHN1UBBuKMBEAAA="}
00420{"flow_id":22,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":557410,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgbkUAAjgYRFR8NREkKGFK8Abu3n2dAc3UKhoE3UBGgBC\/XAAA="}
00419{"flow_id":22,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":591071,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgOyUAAQAZr3QoYUrwfDURJt58BuwqGgTdnQHN2UBBuKMBEAAA="}
00671{"flow_id":21,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":600501,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":243,"pkt_l4_len":207,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAOP6+0AAPwZ\/5AoYUrwfDURUkrEAUI6+8f5kOfEwUBg5CLGLAABHRVQgL21vYmlsZS9zdGF0dXMucGhwIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBEYWx2aWsvMS42LjAgKExpbnV4OyBVOyBBbmRyb2lkIDQuNC40OyBNSSAzVyBNSVVJL1Y2LjQuMy4wLktYRE1JQ0IpDQpIb3N0OiB3d3cuZmFjZWJvb2suY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCg0K"}
00740{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":86,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1430069030508,"flow_last_seen":1430069030600,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37553,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Facebook","breed":"Fun","category":"SocialNetwork"},"http": {"hostname":"www.facebook.com","url":"www.facebook.com\/mobile\/status.php","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.4; MI 3W MIUI\/V6.4.3.0.KXDMICB)"}}
00425{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":600684,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAArAYOlx8NRFQKGFK8AFCSsWQ58TCOvvH+YBD\/\/3RwAAABAQEB"}
00421{"flow_id":21,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":639655,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACif30AArQZtnx8NRFQKGFK8AFCSsWQ58TCOvvK5UBD\/\/4W7AAA="}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":90,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1430069030703,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":24596,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":703253,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":78,"pkt_l4_len":42,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAD4AAEAAQBHSHgoYUrwKvAEBYBQANQAqICQnwAEAAAEAAAAAAAADYXBpCGZhY2Vib29rA2NvbQAAAQAB"}
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":90,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1430069030703,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":24596,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"api.facebook.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
02139{"flow_id":15,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":731635,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShea0AAjwYckq38YQIKGFK8AbuKr2Aiq0b8GvCJUBCkrNGhAAAWAwEAWQIAAFUDAcFMnoqnHL28zylfQXnHbXmp7QB2K0I4OCMnBtyhT5SjIFTmkW2W6o96+hlbztXJU76jJJdvgLhMP+5whOTkeNqTwAcAAA3\/AQABAAALAAQDAAECFgMBDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9jYTMtZzI5LmNybDBCBgNVHQ=="}
00812{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":91,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":11,"flow_first_seen":1430069026370,"flow_last_seen":1430069030731,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1648,"flow_avg_l4_payload_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35503,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}}
00422{"flow_id":15,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":92,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":734564,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjmvEAAPwbpQAoYUryt\/GECiq8Bu\/wa8IlgIrBGUBBBAHmJAAA="}
02145{"flow_id":15,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":736182,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShebEAAjwYcka38YQIKGFK8AbuKr2AisEb8GvCJUBikrPVJAAAgBDswOTA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB7BggrBgEFBQcBAQRvMG0wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUNBLTMuY3J0MAwGA1UdEwEB\/wQCMAAwDQYJKoZIhvcNAQEFBQADggEBAH+E197NT+uv3Gl8Ww0Hto52ip4HI8J9GUO31fXVPsBGGztPmX3vZUA9efuefcpD+c2QQNKsmEtaGlR+Pq2Ym7KusJlTkLZFL0HEeHlPMlC7JkqP3K\/+DkhpxjoDBHNmeFnn45su154px8ew83Ei9w0gkLUTjRJHdw135yyAdeFyLcpRVBaExOCS5rUMN2SxBjQlAqoaeMNHcqm61B\/TRBodNw2f2GV45V33ZCjqHQZ4orzOuwKHpoiBLcUbRodTiFMpead9ct0m\/MnY+4rDyDD+Nd\/OS40p2kN1mfylJsFxllg98sOS0J+KuLubjD1CJFuBsekpEiWyV2GwDB6GLpQABlwwggZYMIIFQKADAgECAhAKXxFNA1sXkRfS79QDjD87MA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMDgwNDAyMTIwMDAwWhcNMjIwNDAzMDAwMDAwWjBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2EKKRAfXv40N1EI+B77Iu1hvgsNcExQYyZ1FblBiJe28KAVuwhg4ELoBSkQhzaKKGWo7zEHdG02ly8oRmYExyp5JnqZ1Y7DbU+gXq28PZHCWXteNmzAU88ACDI+EGRYEBNpxwzunEJRAPkFRO4kznof7YwRvRKo8xX0HHoxaQEbp+ZdwJpsfgme51JEShA6I+SbtgOvqJy0W5\/US62SjM61ESqqNxiNtMK42FwGjPj\/I701XtR8Pn6DDpGWBZjDsh\/jyGXrqXtdoCzM\/DzZbe3M+ktDjMnUuKVhHLJAtigS37n4X\/7TssnvPbQeS3wcTJk2nj3r7KdoXh3fZ25e+wIDAQABo4IC+jCCAvYwDgYDVR0PAQH\/BAQDAgGGMIIBxgYDVR0gBIIBvTCCAbkwggG1BgtghkgBhv1sAQMAAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdA=="}
00422{"flow_id":15,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":738959,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjmvUAAPwbpPwoYUryt\/GECiq8Bu\/wa8IlgIrVGUBBLAGqJAAA="}
01758{"flow_id":15,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":740271,"pkt_caplen":1043,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1043,"pkt_l4_len":1007,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABANebUAAjwYdta38YQIKGFK8AbuKr2AitUb8GvCJUBikrC7tAAAAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMBIGA1UdEwEB\/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAWgBSxPsNpA\/i\/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTeeZlIg\/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA\/vphoqrOIDQ+2avD6OdRvw\/S4iWawTwGHi5\/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2jCwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6XdF3XcZpCdF\/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTEJiiNeXf1L\/BXunwH1OH8zVowV36GEEfdMR\/X\/KLCvzB8XSSq6PmuX2p0ws5rs0bYIb4p1I5eFdZCSucyb6Sxa1GDWL4\/bcf72gMhy2oWGU4K8K2Eyl2Us1p292EWAwEAkQwAAI0DABdBBCtei6pkF7Ihh30IlrkbI+Jxsm\/uAJzeAG6PzBdnOYxE93dfr7QSlu6Nhr9NHU6o1tSsjje+a+kR8pWVe5KLt7wARjBEAiAujbLM+nBgQ9DDXGA8FkGLsmIMEPacaLMIplt6Au\/T6wIgL0KqIWGzS1CoXQgv8AKWMtRyntVQDAdRrg\/X2+gj5\/oWAwEABA4AAAA="}
01600{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":95,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":15,"flow_first_seen":1430069026370,"flow_last_seen":1430069030740,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":3915,"flow_avg_l4_payload_len":261,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35503,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00505{"flow_id":23,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":748175,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":118,"pkt_l4_len":82,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGbtpgAANREvUAq8AQEKGFK8ADVgFABSeRsnwIGAAAEAAgAAAAADYXBpCGZhY2Vib29rA2NvbQAAAQABwAwABQABAAAD6wAMBHN0YXIEYzEwcsAQwC4AAQABAAAACQAEHw1EVA=="}
00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":98,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1430069030703,"flow_last_seen":1430069030748,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":74,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":24596,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"api.facebook.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"31.13.68.84"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":99,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1430069030751,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45209,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":751746,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwzN0AAPwZIUAoYUrwfDURUsJkBu9qbOCoAAAAAoAI5CH68AAACBAV4BAIICgALCx0AAAAAAQMDBw=="}
00448{"flow_id":24,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":835761,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADwAAEAAjgYshx8NRFQKGFK8AbuwmcDC6aramzgroBKpsCsUAAACBAV4BAIICqKRlfAACwsdAQMDBg=="}
00436{"flow_id":24,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":839087,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADQzOEAAPwZIVwoYUrwfDURUsJkBu9qbOCvAwumrgBAAcwLZAAABAQgKAAsLJaKRlfA="}
01197{"flow_id":24,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":840583,"pkt_caplen":631,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":631,"pkt_l4_len":595,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAmczOUAAPwZGIwoYUrwfDURUsJkBu9qbOCvAwumrgBgAc240AAABAQgKAAsLJqKRlfAWAwECLgEAAioDA76a6q0ypg3ba+OWWVF7gyjIWE3lPvKUJBMV6IUnlGQhIC1U45RULLPMlKvTAlYh5N+zhv6zM+AEAVT4gI6fleVZAJbAMMAswCjAJMAUwAoApQCjAKEAnwBrAGoAaQBoADkAOAA3ADbAMsAuwCrAJsAPwAUAnQA9ADXAL8ArwCfAI8ATwAkApACiAKAAngBnAEAAPwA+ADMAMgAxADDAMcAtwCnAJcAOwAQAnAA8AC\/AEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAFLAAAAFQATAAAQYXBpLmZhY2Vib29rLmNvbQALAAQDAAECAAoAOgA4AA4ADQAZABwACwAMABsAGAAJAAoAGgAWABcACAAGAAcAFAAVAAQABQASABMAAQACAAMADwAQABEAIwDAKdJiRItdg1e+9Bh8mODTmhuNTVrAqzJ9keCZS7TuZRivHCP304LlPhe+Djs0yurEPgdumukZ4o6zhpa97CMdhZbDbGPi\/1oo0xHsOzHJxu\/l+8GmyAwoVErUBObVx\/AWLW579VOCdf65nCc1eSeef2ueP9+1qDRIbGJ4ntKWe8U7odCyfHta0Xnuf\/K5YCgRDMzTWl4lwXV\/pVqfdtCRCsiJzp5RXj5iwNyPz5kZ+GoBBhp+n5MdnpToY3cxvhxHAA0AIAAeBgEGAgYDBQEFAgUDBAEEAgQDAwEDAgMDAgECAgIDM3QAAA=="}
00784{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":103,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1430069030751,"flow_last_seen":1430069030840,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":563,"flow_tot_l4_payload_len":563,"flow_avg_l4_payload_len":140,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45209,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00801{"flow_id":21,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":855597,"pkt_caplen":339,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":339,"pkt_l4_len":303,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcAUOf4EAArQZsgx8NRFQKGFK8AFCSsWQ58TCOvvK5UBj\/\/wX6AABIVFRQLzEuMSAyMDQgTm8gQ29udGVudA0KQ2FjaGUtQ29udHJvbDogcHJpdmF0ZSwgbm8tc3RvcmUsIG5vLWNhY2hlLCBtdXN0LXJldmFsaWRhdGUNCkVkZ2UtY29udHJvbDogY2FjaGUtbWF4YWdlPTI4ZA0KWC1GQi1EZWJ1ZzogM3o2a2UxVXU0SHNpbnZIcU5ha1JSUXdtUU5ZQUd1Z0NwV2Y5Yk5CNE9velJSYk1aa3FhSXh6Y2puazc5R3VzZTJQQXN4c0M0QTVRRmd5RlQ1ZStBV1E9PQ0KRGF0ZTogU3VuLCAyNiBBcHIgMjAxNSAxNzoyMzo1MCBHTVQNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCg0K"}
00421{"flow_id":21,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":106,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":860297,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACj6\/EAAPwaAngoYUrwfDURUkrEAUI6+8rlkOfJLUBA8uEfoAAA="}
00436{"flow_id":24,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":108,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":955695,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADSZL0AAjwaSXx8NRFQKGFK8AbuwmcDC6avamzpegBACnv4AAAABAQgKopGWaQALCyY="}
00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":109,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1430069030978,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":19582,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00452{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":109,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069030,"pkt_ts_usec":978614,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":80,"pkt_l4_len":44,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEAAAEAAQBHSHAoYUrwKvAEBTH4ANQAsPIiqhwEAAAEAAAAAAAAFZ3JhcGgIZmFjZWJvb2sDY29tAAABAAE="}
00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":109,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1430069030978,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":19582,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"graph.facebook.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
02297{"flow_id":24,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":111,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":1044,"pkt_caplen":1456,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1456,"pkt_l4_len":1420,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABaCZMEAAjwaM8h8NRFQKGFK8AbuwmcDC6avamzpegBACnocNAAABAQgKopGWjQALCyYWAwMAbgIAAGoDAz6PGiorbDHMQHs5iFsOrmaGleqKpFcEfDumbgtfeVQNAMArAABCAAAAAP8BAAEAAAsABAMAAQIAIwAAM3QAKQ9zcGR5LzMuMS1mYi0wLjUIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xFgMDDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9jYTMtZzI5LmNybDBCBgNVHSAEOzA5MDcGCWCGSAGG\/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMHsGCCsGAQUFBwEBBG8wbTAkBggrBgEFBQ=="}
00842{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":111,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":6,"flow_first_seen":1430069030751,"flow_last_seen":1430069031001,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":1951,"flow_avg_l4_payload_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45209,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}}
00434{"flow_id":24,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":4584,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADQzOkAAPwZIVQoYUrwfDURUsJkBu9qbOl7Awu8XgBAAiPp2AAABAQgKAAsLNqKRlo0="}
02303{"flow_id":24,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":9040,"pkt_caplen":1456,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1456,"pkt_l4_len":1420,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABaCZMUAAjwaM8R8NRFQKGFK8AbuwmcDC7xfamzpegBgCnhv7AAABAQgKopGWjQALCyYHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUNBLTMuY3J0MAwGA1UdEwEB\/wQCMAAwDQYJKoZIhvcNAQEFBQADggEBAH+E197NT+uv3Gl8Ww0Hto52ip4HI8J9GUO31fXVPsBGGztPmX3vZUA9efuefcpD+c2QQNKsmEtaGlR+Pq2Ym7KusJlTkLZFL0HEeHlPMlC7JkqP3K\/+DkhpxjoDBHNmeFnn45su154px8ew83Ei9w0gkLUTjRJHdw135yyAdeFyLcpRVBaExOCS5rUMN2SxBjQlAqoaeMNHcqm61B\/TRBodNw2f2GV45V33ZCjqHQZ4orzOuwKHpoiBLcUbRodTiFMpead9ct0m\/MnY+4rDyDD+Nd\/OS40p2kN1mfylJsFxllg98sOS0J+KuLubjD1CJFuBsekpEiWyV2GwDB6GLpQABlwwggZYMIIFQKADAgECAhAKXxFNA1sXkRfS79QDjD87MA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMDgwNDAyMTIwMDAwWhcNMjIwNDAzMDAwMDAwWjBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2EKKRAfXv40N1EI+B77Iu1hvgsNcExQYyZ1FblBiJe28KAVuwhg4ELoBSkQhzaKKGWo7zEHdG02ly8oRmYExyp5JnqZ1Y7DbU+gXq28PZHCWXteNmzAU88ACDI+EGRYEBNpxwzunEJRAPkFRO4kznof7YwRvRKo8xX0HHoxaQEbp+ZdwJpsfgme51JEShA6I+SbtgOvqJy0W5\/US62SjM61ESqqNxiNtMK42FwGjPj\/I701XtR8Pn6DDpGWBZjDsh\/jyGXrqXtdoCzM\/DzZbe3M+ktDjMnUuKVhHLJAtigS37n4X\/7TssnvPbQeS3wcTJk2nj3r7KdoXh3fZ25e+wIDAQABo4IC+jCCAvYwDgYDVR0PAQH\/BAQDAgGGMIIBxgYDVR0gBIIBvTCCAbkwggG1BgtghkgBhv1sAQMAAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAgAA=="}
00435{"flow_id":24,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":13587,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADQzO0AAPwZIVAoYUrwfDURUsJkBu9qbOl7AwvSDgBAAnvTzAAABAQgKAAsLN6KRlo0="}
01518{"flow_id":24,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":13770,"pkt_caplen":863,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":863,"pkt_l4_len":827,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAA0+ZMkAAjwaPQR8NRFQKGFK8AbuwmcDC9IPamzpegBgCni8TAAABAQgKopGWjQALCyZhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMBIGA1UdEwEB\/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAWgBSxPsNpA\/i\/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTeeZlIg\/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA\/vphoqrOIDQ+2avD6OdRvw\/S4iWawTwGHi5\/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2jCwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6XdF3XcZpCdF\/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTEJiiNeXf1L\/BXunwH1OH8zVowV36GEEfdMR\/X\/KLCvzB8XSSq6PmuX2p0ws5rs0bYIb4p1I5eFdZCSucyb6Sxa1GDWL4\/bcf72gMhy2oWGU4K8K2Eyl2Us1p292EWAwMAlAwAAJADABdBBGm4zcsstg3auPHD1vdv0v9zoOXpds1P25+xqK5yCQtDE6tF6H\/OV\/4sbb3rseYzB1as7RbzKnR9pNthjjbDshMGAwBHMEUCIQCAQKI8S1BxyyJSxK7c9z5gYr\/d82OAaicB\/y\/h2bcwTQIgWQktUXH6zkB0\/oslyKb7oecmcL8fdG\/Jh6bbvg+2vRoWAwMABA4AAAA="}
01631{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":115,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":10,"flow_first_seen":1430069030751,"flow_last_seen":1430069031013,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":4134,"flow_avg_l4_payload_len":413,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45209,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.facebook.com","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00436{"flow_id":24,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":116,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":16944,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADQzPEAAPwZIUwoYUrwfDURUsJkBu9qbOl7AwveegBAAtPHCAAABAQgKAAsLN6KRlo0="}
00530{"flow_id":25,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":117,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":17096,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":138,"pkt_l4_len":102,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAHocCwAANREA2Aq8AQEKGFK8ADVMfgBmmjSqh4GAAAEAAwAAAAAFZ3JhcGgIZmFjZWJvb2sDY29tAAABAAHADAAFAAEAAAVxAAYDYXBpwBLAMAAFAAEAAAV2AAwEc3RhcgRjMTBywBLAQgABAAEAAAARAAQfDURG"}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":117,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1430069030978,"flow_last_seen":1430069031017,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":130,"flow_avg_l4_payload_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":19582,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"graph.facebook.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"31.13.68.70"}}
02242{"flow_id":24,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":118,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":42670,"pkt_caplen":1401,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1401,"pkt_l4_len":1365,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUABWkzPUAAPwZDHQoYUrwfDURUsJkBu9qbOl7AwveegBgAtB0AAAABAQgKAAsLOqKRlo0WAwMARhAAAEJBBDG34c7NydBVRf6mVQzi\/MwMXnUoOd0JvS1otngBVuiN7hS4zUuR30\/zhdtJJxzSSeM9VE5LTcff8eLYgzMoit8UAwMAAQEWAwMAPOTjOPIureyonxmEtL5pzsQRqFdVWUjvrA30RhsCUinFLfuLw6CiFVROC6aSF2Q+Q9x1j\/\/K0sywjsSjGxYDAwAo5OM48i6t7Klm1eGphEvyxwgHXv2\/1TpAFUXIQFgUOE7wWdAWUQPAqxcDAwRx5OM48i6t7KomCmHgEq3wqFBvtbWuM7Ywyxm7Fd9dqS2fFNJbJikaMij5AfSj7adTQtHIHDB9Vng5PJUjNZBIb+10PmUudcmdd3onbG7\/10KhuKfjOg8f60BIie9ygplKEtbwupfKMKjn761f\/7+L0375WBrGgdhw6nwj1uzH5dpc7FfwlMM+F0rFFuhXV5+BI23skk74iuc+um\/iFwsgz5MlBkue5HmpfEAgLxZerCuQpIuZyvDwhD+0Xpu+s+GlwABfVPta0ipXAAYD6XhOWkWm2VHm5EdhhFhdTEp82P2isqLO9bQitnF19DIFqIYdoNdV\/\/Xdgw5Irb4aSca0VRzZQ3yCtuzZ6gNB32qoDQaikxX8ERyLeXK3sgxD9rcxMYgjTlahVUrZXQbXs3FfZnFi9lBSdExo7V7P3XuthuYj15wRy9Inzv90D89GPf1Fz6WpJARCuhexY6iyUlK627t4HnHof\/JWDb1Kv+dHvHtMBenxvSBbsKoe6PIM88JiVeL7bmJlgwq+eIpJHgsWURcJ\/7fAz8oa6CjRFA+XnJay4Z4FVYzaOAwwLlXdO4Mp4QamJN2e2hflftb59C5eEwLBPkrZQrM5EO7I8rSGhGfhKKllgPXhWQtzWt1ssEmF4GdhocuBnvnCbRi7Mr\/krl5lB2oBw4fbHHvIU3ME\/g\/cFFaQ1lxVBRRNhpNcGeFlmpj5jVySoqXle7l0FTxR7jfnvvBoA6BNeSWqICL9DVejAytwJYK62Kf4kQVNPfC6vXq19CBsbjsG3WxZuVZ\/BPhZXbPmAmEProUWlyTgooiIq8QBRmbTJ9X3lBwvaKfmPh4tXAGrDXxDdOEv4BaUQzeK6U4ghv9emooym688U\/VCtARBQBfHb8Fckj4CFPtg7UgAi81lzg+HtRyG11OrNbyRjv3wfmMtk2p4DGQxCptdBMfZiGNJ8b8wRknwaJ6qHi4KKjhwyAz41OI65PSpM0vQE+MWxaz83qWfo8rnp3ltYIpCuJTJFHD4XBA8PE0jcHgHNpny3eOIc2crMSCNkIDRDMmLHaoQ2gIG58IJQG9bsNAqbyR8KAM8o4SM3Nwc4QLvBjhJK3O5mSUIZzmzHaYFL\/wOt3aG30tT+71Q7Wlkvx7kjGYpbexA9FrI9KqSkfDGI+N0oAva+CjNFMg1AmexNMRDZf9K1D8X+P3EsC2wyx1K8KbkjkGHMame9D8hkR4PVDzcFea88UrFc1DhvH\/0luy5q2a7oSC3zK\/tpGeZh2NE7t5h4NWoTcUUI\/HofVaf7svok4P3XilByfZjto2rcvqY9Q4BY1XslLcZ3oUq1o02eix9Yxbvm\/P71dlvwcquOQ4Syw6HF4BoIPkfWU+z+l61FTYWmXGAw2+kbxAjS7LjtHXE9PN9V5DtTIggNSnLMq4z0F75gwHAKwPdQ3zsKyr\/XjvTIuvU5R6+ZAQTOFr3DK1J65yCk37BGPvf\/0dqV6PHb3ndYwshVqZYX1F8EWRTMDI4fdukwwMIQvvX"}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":119,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1430069031042,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.70","src_port":43581,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00447{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":119,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":42945,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADx6qUAAPwYA7AoYUrwfDURGqj0Bu4p9cZMAAAAAoAI5CJu+AAACBAV4BAIICgALCzoAAAAAAQMDBw=="}
00423{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":121,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":79901,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwwtUAA+AaR7x8NREYKGFK8AbuqPWAZ05aKfXGUYBIRHOtUAAACBAV4"}
00420{"flow_id":26,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":122,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":83289,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACh6qkAAPwYA\/woYUrwfDURGqj0Bu4p9cZRgGdOXUBA5CNrpAAA="}
01181{"flow_id":26,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":123,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":83594,"pkt_caplen":621,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":621,"pkt_l4_len":585,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAl16q0AAPwb+yAoYUrwfDURGqj0Bu4p9cZRgGdOXUBg5CM7tAAAWAwECMAEAAiwDAzthSakX6Nys0EmE1wPJQXQGNb7fzUO2auSBp3pzzdruINH9Cd3eMOIjz4Amf0HcxZLKnDb5BWXRj6aZ8z64ZOOBAJbAMMAswCjAJMAUwAoApQCjAKEAnwBrAGoAaQBoADkAOAA3ADbAMsAuwCrAJsAPwAUAnQA9ADXAL8ArwCfAI8ATwAkApACiAKAAngBnAEAAPwA+ADMAMgAxADDAMcAtwCnAJcAOwAQAnAA8AC\/AEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAFNAAAAFwAVAAASZ3JhcGguZmFjZWJvb2suY29tAAsABAMAAQIACgA6ADgADgANABkAHAALAAwAGwAYAAkACgAaABYAFwAIAAYABwAUABUABAAFABIAEwABAAIAAwAPABAAEQAjAMBPW8XYuWXc4wYgZOQ6d0T60VO\/cyNe14Z5IjVgMFekE6dQ7u4U9FnQj9Gdy1GUVunfKf6noZBglfKqBP\/YL5CHT93Ljqw5QntaaNZ5kvi+qnkAbVlF3Ab+szOzcduxUvTGYEZP5N4eYbzBK0XGbgzpW6gNtQzHAZ4wCELvRkl\/I\/OlcBgG6SRo\/Rnk4jB4P3zWj7gq\/CUy2yxPClj1804ftHYBJ1lTdWKJLEjp5LhGRTLFHNFFHZzp8G9wkcJTX3IADQAgAB4GAQYCBgMFAQUCBQMEAQQCBAMDAQMCAwMCAQICAgMzdAAA"}
00786{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":123,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1430069031042,"flow_last_seen":1430069031083,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":565,"flow_tot_l4_payload_len":565,"flow_avg_l4_payload_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.70","src_port":43581,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"graph.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00424{"flow_id":26,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":127600,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgYspR8NREYKGFK8AbuqPWAZ05eKfXGUYBClZFyHAAABAQEB"}
00420{"flow_id":26,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":131598,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACjeLEAAjwZNfB8NREYKGFK8AbuqPWAZ05eKfXPJUBCjUm5qAAA="}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":127,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1430069031167,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":4017,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00461{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":167395,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":85,"pkt_l4_len":49,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEUAAEAAQBHSFwoYUrwKvAEBD7EANQAxznCJ\/wEAAAEAAAAAAAAKZGV2ZWxvcGVycwhmYWNlYm9vawNjb20AAAEAAQ=="}
00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":127,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1430069031167,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":4017,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"developers.facebook.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00793{"flow_id":24,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":128,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":168158,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":326,"pkt_l4_len":290,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAATaZM0AAjwaRWR8NRFQKGFK8AbuwmcDC957amz+TgBgClXT0AAABAQgKopGXNgALCzoWAwMAygQAAMYAAU\/wAMBVHjamp1t+k3aO+5WCeTt+f0Mn4qniaX\/FZd\/VQ2Tp46vrWFw57jV912dRcSdO8HzZQNIm6laX4t1LURyW0VCf46c1zE9Vzp9xa\/X+dr2du3yuL7BfmnzfuI9r5LpQP+4s1t92fSkjv8w2xSWFQtxM+q88564Ji4ONs\/QHo+VjZKQsG403b14UPkQjBg2dtn0ClHdmFrCsiwuOFJh2y0YnLgOAZD7ae\/TYAuVLKJPntFrqj4LBqCnU0j21wE6LGu8UAwMAAQEWAwMAKJruu5VbafH3STS42RhL4saKJbcTH\/lsE1g5BxcgBJ8dk160d\/X\/VM0="}
00516{"flow_id":24,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":129,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":168738,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":125,"pkt_l4_len":89,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAG2ZNEAAjwaSIR8NRFQKGFK8AbuwmcDC+KDamz+TgBgClWBVAAABAQgKopGXNgALCzoXAwMANJruu5VbafH4HCo2Lued2HtDNlUR3bKRAfTGJJefp5xx\/jRoAHPtVYTMzij7PRWD+9jgkws="}
00499{"flow_id":24,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":130,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":169409,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":113,"pkt_l4_len":77,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAGGZNUAAjwaSLB8NRFQKGFK8AbuwmcDC+Nnamz+TgBgClQuqAAABAQgKopGXNwALCzoXAwMAKJruu5VbafH5sQRaWN1yXAIV2NGtD21PaTBD2ciGilS4h+QCr8Qyf28="}
02141{"flow_id":26,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":132,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":203681,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSjeLUAAjwZIex8NREYKGFK8AbuqPWAZ05eKfXPJUBCjUo5yAAAWAwMAbgIAAGoDA6\/\/Ua4c\/Z49ONq5ISaENIdBubestbYRwJXDwjnGTSRlAMArAABCAAAAAP8BAAEAAAsABAMAAQIAIwAAM3QAKQ9zcGR5LzMuMS1mYi0wLjUIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xFgMDDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0Lg=="}
00844{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":132,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":7,"flow_first_seen":1430069031042,"flow_last_seen":1430069031203,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1845,"flow_avg_l4_payload_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.70","src_port":43581,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"graph.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}}
00579{"flow_id":26,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":204383,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":174,"pkt_l4_len":138,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAJ7eLkAAjwZNBB8NREYKGFK8AbuqPWAZ2JeKfXPJUBijUuZWAABjb20vY2EzLWcyOS5jcmwwQgYDVR0gBDswOTA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB7BggrBgEFBQcBAQRvMG0wJAYIKwYBBQUHMAGGGGh0dHA6"}
00421{"flow_id":26,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":134,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":207587,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACh6rEAAPwYA\/QoYUrwfDURGqj0Bu4p9c8lgGdiXUBBBAMu8AAA="}
00422{"flow_id":26,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":135,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":207740,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACh6rUAAPwYA\/AoYUrwfDURGqj0Bu4p9c8lgGdkNUBBBAMtGAAA="}
02146{"flow_id":26,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":137,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":220252,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSjeL0AAjwZIeR8NREYKGFK8AbuqPWAZ2Q2KfXPJUBCjUsrRAAAvL29jc3AuZGlnaWNlcnQuY29tMEUGCCsGAQUFBzAChjlodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlQ0EtMy5jcnQwDAYDVR0TAQH\/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAf4TX3s1P66\/caXxbDQe2jnaKngcjwn0ZQ7fV9dU+wEYbO0+Zfe9lQD15+559ykP5zZBA0qyYS1oaVH4+rZibsq6wmVOQtkUvQcR4eU8yULsmSo\/cr\/4OSGnGOgMEc2Z4Wefjmy7XninHx7DzcSL3DSCQtRONEkd3DXfnLIB14XItylFUFoTE4JLmtQw3ZLEGNCUCqhp4w0dyqbrUH9NEGh03DZ\/YZXjlXfdkKOodBniivM67AoemiIEtxRtGh1OIUyl5p31y3Sb8ydj7isPIMP41385LjSnaQ3WZ\/KUmwXGWWD3yw5LQn4q4u5uMPUIkW4Gx6SkSJbJXYbAMHoYulAAGXDCCBlgwggVAoAMCAQICEApfEU0DWxeRF9Lv1AOMPzswDQYJKoZIhvcNAQEFBQAwbDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2UgRVYgUm9vdCBDQTAeFw0wODA0MDIxMjAwMDBaFw0yMjA0MDMwMDAwMDBaMGYxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJTAjBgNVBAMTHERpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIENBLTMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC\/YQopEB9e\/jQ3UQj4Hvsi7WG+Cw1wTFBjJnUVuUGIl7bwoBW7CGDgQugFKRCHNoooZajvMQd0bTaXLyhGZgTHKnkmepnVjsNtT6Berbw9kcJZe142bMBTzwAIMj4QZFgQE2nHDO6cQlEA+QVE7iTOeh\/tjBG9EqjzFfQcejFpARun5l3Ammx+CZ7nUkRKEDoj5Ju2A6+onLRbn9RLrZKMzrURKqo3GI20wrjYXAaM+P8jvTVe1Hw+foMOkZYFmMOyH+PIZeupe12gLMz8PNlt7cz6S0OMydS4pWEcskC2KBLfufhf\/tOyye89tB5LfBxMmTaePevsp2heHd9nbl77AgMBAAGjggL6MIIC9jAOBgNVHQ8BAf8EBAMCAYYwggHGBgNVHSAEggG9MIIBuTCCAbUGC2CGSAGG\/WwBAwACMIIBpDA6BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAA=="}
01627{"flow_id":26,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":138,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":220923,"pkt_caplen":949,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":949,"pkt_l4_len":913,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAA6XeMEAAjwZJ+x8NREYKGFK8AbuqPWAZ3g2KfXPJUBijUjWMAABlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wEgYDVR0TAQH\/BAgwBgEB\/wIBADA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTCBjwYDVR0fBIGHMIGEMECgPqA8hjpodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB0GA1UdDgQWBBRQ6nOJ2yn7EI+e5QEg1N55mUiD9zANBgkqhkiG9w0BAQUFAAOCAQEAHuKlSJ5s21M4D++mGiqs4gND7Zq8Po51G\/D9LiJZrBPAYeLn+umZzYcJdVQov0Zg3L5RLJLzG5F8MQhw4je5wVuovaMLAPsaFf0DrVhqxcckmUhHRjEeku+0X040x5C\/McH4sYSG0JwBqt+KVgbOOukOrpd0XddxmkJ0X96NQ3ze6VXtaQDLBeB6YWEz0RlN+QjuoDnFJTW3K8QPst3xpbcOJMQmKI15d\/Uv8Fe6fAfU4fzNWjBXfoYQR90xH9f8osK\/MHxdJKro+a5fanTCzmuzRtghvinUjl4V1kJK5zJvpLFrUYNYvj9tx\/vaAyHLahYZTgrwrYTKXZSzWnb3YRYDAwCUDAAAkAMAF0EEAnf\/MI5+jKoj2RjAXe7n+UOKFFv2nwCt5DQRSL\/ffuk0zKWw5j9DPoNRUaiV668HOp42y8u6+2feJyVsq1j2bwYDAEcwRQIgS9BdwFdYQuZNFXXSW1PFn+v5MIPRFbsAxT+bEy6eA5YCIQCqwUK6Q87Kr\/wKZ9Jsj1QH7DKouuKR6D8Od\/n5Y6QVJRYDAwAEDgAAAA=="}
01633{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":138,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":12,"flow_first_seen":1430069031042,"flow_last_seen":1430069031220,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":4136,"flow_avg_l4_payload_len":344,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.70","src_port":43581,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"graph.facebook.com","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00540{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":139,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":221686,"pkt_caplen":144,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":144,"pkt_l4_len":108,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAIDtrgAANREvLgq8AQEKGFK8ADUPsQBsjjKJ\/4GAAAEAAwAAAAAKZGV2ZWxvcGVycwhmYWNlYm9vawNjb20AAAEAAcAMAAUAAQAAA+oABwRzdGFywBfANQAFAAEAAAPqAAwEc3RhcgRjMTBywBfASAABAAEAAAAIAAQfDURU"}
00693{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":139,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1430069031167,"flow_last_seen":1430069031221,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":141,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":4017,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Facebook","breed":"Fun","category":"SocialNetwork"},"dns": {"query":"developers.facebook.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"31.13.68.84"}}
00421{"flow_id":26,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":141,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":224372,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACh6rkAAPwYA+woYUrwfDURGqj0Bu4p9c8lgGd4NUBBLALxGAAA="}
00421{"flow_id":26,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":142,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":224524,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACh6r0AAPwYA+goYUrwfDURGqj0Bu4p9c8lgGeGKUBBVAK7JAAA="}
00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":144,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1430069031230,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":14650,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00460{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":144,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":230994,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":87,"pkt_l4_len":51,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAEcAAEAAQBHSFQoYUrwKvAEBOToANQAzWvOyogEAAAEAAAAAAAABMgI5NwMyNTIDMTczB2luLWFkZHIEYXJwYQAADAAB"}
00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":144,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1430069031230,"flow_last_seen":0,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":43,"flow_tot_l4_payload_len":43,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":14650,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"2.97.252.173.in-addr.arpa","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
01772{"flow_id":26,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":145,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":236731,"pkt_caplen":1053,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1053,"pkt_l4_len":1017,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUABA16sEAAPwb9EwoYUrwfDURGqj0Bu4p9c8lgGeGKUBhVAI3tAAAWAwMARhAAAEJBBD2hR1ZxSpq\/s2bE\/jEuVnHZhLsOfXDeW8kA5Vf7lk9JzGTsKpqTz8WcksKfffMvnDRskqK2mDmAm0lNTEbtVsUUAwMAAQEWAwMAPDgatczmcEzE+jBZypW7PvgvPfOYO3SnL4HX\/HbuPNa4Ou2KRWwdFRkakJ+FOn7WvKfMRb1s4C3UMd\/UwhYDAwAoOBq1zOZwTMXQ4JIUcIi0BL3fDVH2BZhsR2W2hrP9cDDIppHu4MM6uxcDAwMhOBq1zOZwTMaJo5seZy5725DDkdN6vFi40cW56kBpjWhZIhTaflCGbAf7jvOuihh+BI\/IOe\/yA9nVbXeJaLGnftSgB00+D+OilsDAoKyLtHxaKhLxH5JwurOk7ZcaHUYvO33rP4ph0CKrAObpqGfBLmD8yxRunBcVPimHXmeRx\/JvQ3gSLxFHw46iVFEgvk57HnAdKl0UpJnQLqeLdbxepSBOwvEyzL2En5zxYzhx1fAxCHQopLPF5GyhBoFvanULTIEm6pPDSeg7wg8Pc7aq7Fkr6ZJOQ8E4ixAkYEzCQfoyoaYEKbQ0biaQLxljr43RJa\/eLFMIAE9c8Hb1XB6\/MXeEi4ha7O3t+7HOdoRA2ky3OOuPNUH5aod8qNn03NFZR0LPQ5XsIVEz+r1rvpsa6EmM5oDIbCKfilvML1vufSR\/42\/CzbR6QpYEXousSC22JJwtv1p3kiioQqV7fYAEtgLuEjNNkwcOU7L139H5kPiOSBQnhGfjrfEvBOZxMRQ2Z3QK9BVMpjI7OaVAgEDrhQC5Q1+uRF2uCOOajPmgHvOKP1Gs8tvTmims1NOW7lfwLEGzEciEmeJ41uXtHGzUlHbMY7r6pEwXuUrGfALOAVMBo8GgRzFLm1FTOUJkFiGUhihPSZaBelN+sQEtwTxQs8CrOGld40GUtQPxYlfOYQ27WComeVqvuCn4lCwfsbcANeFlAomWyAujVoFS7fdjWKxauy5b86PRe0tGVNtfgTRca7y4uIe+D7ze\/fWoHGqBMkDWn6v4Dngwgl8QZDc6PRAYq0fZxoNWqk9rdGCRPCj8iQi2WiDGjEskePU1dWhd1GZJ+OKe52ePGBbf3Zx0PA2GkYC\/q\/1YteAS9Cvqj2c3m5XOUY5lgT1TPE7vKAcTT7exl+T1rNy4kumHQrXEYtm0IhwVqrMfj2UPgpt4qk7Zzaxl9aOBRJjW7GjsMTifs35uWXCubklLcnXB4Xe7WXqaEPNpj5Se3baN95\/XTIQmTa\/4QeS8EBc0nGYLybSUATF2T5daX0VirdX75zqNMnnOIx2SFD\/gRp2DkreMIkNN"}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":146,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1430069031236,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45211,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00448{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":146,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":236945,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADxjDkAAPwYYeQoYUrwfDURUsJsBu8tPaEMAAAAAoAI5CF29AAACBAV4BAIICgALC00AAAAAAQMDBw=="}
00522{"flow_id":28,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":147,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":281714,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":130,"pkt_l4_len":94,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAHLtrwAANREvOwq8AQEKGFK8ADU5OgBeI2eyooGAAAEAAQAAAAABMgI5NwMyNTIDMTczB2luLWFkZHIEYXJwYQAADAABwAwADAABAAAEYQAfEG1xdHQtc2h2LTE0LWZyYzEIZmFjZWJvb2sDY29tAA=="}
00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":147,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1430069031230,"flow_last_seen":1430069031281,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":129,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":14650,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"2.97.252.173.in-addr.arpa","num_queries":1,"num_answers":1,"reply_code":0,"query_type":12,"rsp_type":12,"rsp_addr":"0.0.0.0"}}
00424{"flow_id":29,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":148,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":281867,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACw2WEAA+AaMPh8NRFQKGFK8Abuwm2JwnlDLT2hEYBIRHOBVAAACBAV4"}
00421{"flow_id":29,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":149,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":284186,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAChjD0AAPwYYjAoYUrwfDURUsJsBu8tPaERicJ5RUBA5CM\/qAAA="}
01190{"flow_id":29,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":150,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":286444,"pkt_caplen":626,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":626,"pkt_l4_len":590,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAmJjEEAAPwYWUQoYUrwfDURUsJsBu8tPaERicJ5RUBg5CFQRAAAWAwECNQEAAjEDA12sDwIlRYC4S\/u\/dLxpbC6fU+Gnpw4b5dMA4lzwGxvDIALfpkN5Ks6\/c20IdWd3iDdbXn8wiPGMx1jMuQOUjsRtAJbAMMAswCjAJMAUwAoApQCjAKEAnwBrAGoAaQBoADkAOAA3ADbAMsAuwCrAJsAPwAUAnQA9ADXAL8ArwCfAI8ATwAkApACiAKAAngBnAEAAPwA+ADMAMgAxADDAMcAtwCnAJcAOwAQAnAA8AC\/AEcAHwAzAAgAFAATAEsAIABYAEwAQAA3ADcADAAoAFQASAA8ADAAJAP8BAAFSAAAAHAAaAAAXZGV2ZWxvcGVycy5mYWNlYm9vay5jb20ACwAEAwABAgAKADoAOAAOAA0AGQAcAAsADAAbABgACQAKABoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAARACMAwCnSYkR7dyZSlmb2OdeQwfPHqvffGwuUL3PG+4Ewg5bwNedBkyV9v8C8pmhV4nqSLTQbulzvcpBBfLcpfQowvk79MtWhUv2WuTp5rwjXPWPci4lxJKzgph0ts51Py\/3dLrTAZ0QTg1HN7u4u1p3C80B86yaPTNKffxSBZsLfL4fUayH2i9ace\/qM96Tac8qFgVAl24B\/JZxcKhjC1EOsRIlPerZpBoaXHxVbVixsGvq98+nTjVWCnQKrtJcwlv25jQANACAAHgYBBgIGAwUBBQIFAwQBBAIEAwMBAwIDAwIBAgICAzN0AAA="}
00791{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":150,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":4,"flow_first_seen":1430069031236,"flow_last_seen":1430069031286,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":570,"flow_tot_l4_payload_len":570,"flow_avg_l4_payload_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"developers.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00424{"flow_id":29,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":153,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":320197,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgYslx8NRFQKGFK8Abuwm2JwnlHLT2hEYBClZFGIAAABAQEB"}
00420{"flow_id":29,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":157,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":341162,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACjTSEAAjwZYUh8NRFQKGFK8Abuwm2JwnlHLT2p+UBCkxGH0AAA="}
02139{"flow_id":29,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":161,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":391516,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSjTSUAAjwZTUR8NRFQKGFK8Abuwm2JwnlHLT2p+UBCkxN7TAAAWAwMAbgIAAGoDA8C8sU+4sP7tT3CKYvhEo\/qSTcQI4WbvTwFIUXjcfkAWAMArAABCAAAAAP8BAAEAAAsABAMAAQIAIwAAM3QAKQ9zcGR5LzMuMS1mYi0wLjUIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xFgMDDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0Lg=="}
00849{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":161,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":7,"flow_first_seen":1430069031236,"flow_last_seen":1430069031391,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1850,"flow_avg_l4_payload_len":264,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"developers.facebook.com","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}}
00420{"flow_id":29,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":162,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":393286,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAChjEUAAPwYYigoYUrwfDURUsJsBu8tPan5icKNRUBBBAMC4AAA="}
02145{"flow_id":29,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":163,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":408515,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABSjTSkAAjwZTUB8NRFQKGFK8Abuwm2Jwo1HLT2p+UBikxPFIAABjb20vY2EzLWcyOS5jcmwwQgYDVR0gBDswOTA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB7BggrBgEFBQcBAQRvMG0wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUNBLTMuY3J0MAwGA1UdEwEB\/wQCMAAwDQYJKoZIhvcNAQEFBQADggEBAH+E197NT+uv3Gl8Ww0Hto52ip4HI8J9GUO31fXVPsBGGztPmX3vZUA9efuefcpD+c2QQNKsmEtaGlR+Pq2Ym7KusJlTkLZFL0HEeHlPMlC7JkqP3K\/+DkhpxjoDBHNmeFnn45su154px8ew83Ei9w0gkLUTjRJHdw135yyAdeFyLcpRVBaExOCS5rUMN2SxBjQlAqoaeMNHcqm61B\/TRBodNw2f2GV45V33ZCjqHQZ4orzOuwKHpoiBLcUbRodTiFMpead9ct0m\/MnY+4rDyDD+Nd\/OS40p2kN1mfylJsFxllg98sOS0J+KuLubjD1CJFuBsekpEiWyV2GwDB6GLpQABlwwggZYMIIFQKADAgECAhAKXxFNA1sXkRfS79QDjD87MA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMDgwNDAyMTIwMDAwWhcNMjIwNDAzMDAwMDAwWjBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2EKKRAfXv40N1EI+B77Iu1hvgsNcExQYyZ1FblBiJe28KAVuwhg4ELoBSkQhzaKKGWo7zEHdG02ly8oRmYExyp5JnqZ1Y7DbU+gXq28PZHCWXteNmzAU88ACDI+EGRYEBNpxwzunEJRAPkFRO4kznof7YwRvRKo8xX0HHoxaQEbp+ZdwJpsfgme51JEShA6I+SbtgOvqJy0W5\/US62SjM61ESqqNxiNtMK42FwGjPj\/I701XtR8Pn6DDpGWBZjDsh\/jyGXrqXtdoCzM\/DzZbe3M+ktDjMnUuKVhHLJAtigS37n4X\/7TssnvPbQeS3wcTJk2nj3r7KdoXh3fZ25e+wIDAQABo4IC+jCCAvYwDgYDVR0PAQH\/BAQDAgGGMIIBxgYDVR0gBIIBvTCCAbkwggG1BgtghkgBhv1sAQMAAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAA=="}
01791{"flow_id":29,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":408850,"pkt_caplen":1067,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1067,"pkt_l4_len":1031,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABBvTS0AAjwZUXB8NRFQKGFK8Abuwm2JwqFHLT2p+UBikxKuaAABhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMBIGA1UdEwEB\/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAWgBSxPsNpA\/i\/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTeeZlIg\/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA\/vphoqrOIDQ+2avD6OdRvw\/S4iWawTwGHi5\/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2jCwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6XdF3XcZpCdF\/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTEJiiNeXf1L\/BXunwH1OH8zVowV36GEEfdMR\/X\/KLCvzB8XSSq6PmuX2p0ws5rs0bYIb4p1I5eFdZCSucyb6Sxa1GDWL4\/bcf72gMhy2oWGU4K8K2Eyl2Us1p292EWAwMAlAwAAJADABdBBLqTQNJNU36ZQWb8HeASPcp0WN1Rk4KDJvBxVzB10Jd4+P\/JPbK+vtohJwIS0YYBJvFwto2+iZ+\/rcILUXt2mRMGAwBHMEUCIEMUDwjj2qLKmC3WwO\/lTl0MPMIzWL05LJ1COe36qWcXAiEAg2V0m0767p57whXPk83nVJXKEyr73YpOd8\/yNfVshnEWAwMABA4AAAA="}
01638{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":164,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":10,"flow_first_seen":1430069031236,"flow_last_seen":1430069031408,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":4141,"flow_avg_l4_payload_len":414,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45211,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"developers.facebook.com","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"051d20e8adbe8dac78945de300764d5e","ja3s":"6806b8fe92d7d465715d771eb102ff04","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00421{"flow_id":29,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":165,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":410895,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAChjEkAAPwYYiQoYUrwfDURUsJsBu8tPan5icKhRUBBLALG4AAA="}
00421{"flow_id":29,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":166,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":410956,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAChjE0AAPwYYiAoYUrwfDURUsJsBu8tPan5icKxEUBBVAKPFAAA="}
02043{"flow_id":29,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":167,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":425727,"pkt_caplen":1257,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1257,"pkt_l4_len":1221,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUABNljFEAAPwYT1goYUrwfDURUsJsBu8tPan5icKxEUBhVAJopAAAWAwMARhAAAEJBBPON\/LJqBr6qw7RzueZWdveH9RPDKIh0taTOaFM3l3OAde7h9Djd2tDgsIIINv3z09StvnD4Ph6OT2kafg+cKTYUAwMAAQEWAwMAPCwS+j2T0BmMYu44G7vYhClL6WUsbXbIjtRbfAnve+HDw2rVFjj6HECBr4cseaIL4ewKMLUqCzSKe\/Q8fhYDAwAoLBL6PZPQGY1xRCv\/MFccwmSU1tfDnnMr4gw3uYP7IkY1RioDkLjdUBcDAwPtLBL6PZPQGY6B8r6UGDXRbNsCCbsyRUcauQJQAmyiKg1VzXwdC8G1EhBGayJ2RPnxqfrO\/PjmM5tQU7jgiBRdsclpbRBi+EwNhS5AruPWrJ\/yiif9Ctpgx+7vdVMbMyi\/vlVNB7zBUdwjyQbYShVRS48KJdLrttXnToVlUNS2QdLmvPsAYJ8mSMYYiE1zxK7MX2gv8YWMv7au821PnB+oj6rcBimlhPAO455i\/j07QwBh+4ftQgV3lkRDicOM2tRRLxjw5hU1zelvd7ZtOSJNQruYzAKcGriBNJpMsJpul62PGvwupCEZP5sjOs3KMV1Cr9CfYhuux+jQRT5mfj6vX3NKX6iJ3O\/IrLW\/FlhcKbgeU+fsBYGA6v9PT82VDCG5+ILyHYmHYf7cfnPt8WPHeSWeWDJ8f8AmUsNEafgoZ01npr8SUtPh13C7wNutcn7NsuxykOD2vXslWkWWyiu84+c+Trf5hM3WkYcE7p28kUonAF1tpBdGwISKw6ooenbxWbbqv2lsOPVNERLYXTZ18eSCJm\/goP48GtDUjcBfM9FCUsFY3tZt6k9oLe8Z77YUN1nKtxQWRzDqksGUfEe37VXcLV4Mjd+G4Wk8bTRNIgxsVLb6Cv3OSKR2HpUi3Ga3+9G9XfkHbKlJDDTaXmzCYUKqJ58kdKdjTpwdtddpKdDsgdBisnDJWJwF78eTpSvYCe259g0EFsE1thdwwLRCRibBc\/IgHwtZdrh+cf5rdDxQv3HfLo+V7TP0T50DDJUmGA\/4uysW6AOfNxTzVDS4A6WpxKrSzS13Oe1CtS0ZbAE5VkUXHMyHbdK2LBK5wCEgTyXObcCFtUl905nORIodohxUeA11r18OnnXjqu7KF12JXWkL9kvYWAmUJy+X+oWnA6LQXh0WtnF2SEN6ikR8vVfXoWFFCUvKCG5OUXCEZL+XiO3X0bjZe1\/E2g9Ke4lMf4PNhB0aOZHflkv4xdQwsYbNLeu7gvIh7onn+l1HiszXua0fkDui4zGZAvd\/KwoKNNlctWtwX1jlctJmgTfXacPh7dXIfievhDkfORC2DjaLuWCG\/CWtPvhIKNlpNqw5JOqOFdQiLP3iBX66mKVYCwP4johGeG95utDAfRDgvwtCu4Bg1BgXcnZvCon7n0RrbBotXiS5ecufwm7UBfZ+I43ytPe3rjdlv8vnG7fsaNSfcMJxIb97jr2HotKcRl\/3Za8RzptvZNsSIYP16rjO6giF5VuOe6+oIaz+9xS3z49ockgUXT+p5UM4Zk9cvdoivxdwDEe8ehPZvHnfYhQCX4bWbp6IZKctRr4jPllvCsicbaviQVruzJboPcbE"}
00421{"flow_id":29,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":480384,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACjTTEAAjwZYTh8NRFQKGFK8Abuwm2JwrETLT28vUBCkxE9QAAA="}
00770{"flow_id":29,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":513282,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":314,"pkt_l4_len":278,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAASrTTUAAjwZXSx8NRFQKGFK8Abuwm2JwrETLT28vUBikxOXaAAAWAwMAygQAAMYAAU\/wAMBVHjamON2Im1HS1Mx3WG+MHqQdzgVj909oJkB2\/cL96uQcX2PfrbyBj2+2oCYfHZ91Urggzu6eStTIoM9Tx0y+L5fn4iO7UemYhseBRZgQPMeOhtjrP7Ay2eCf3jw6sB7lBQ3ZcpiCWpWxN+zLU1AVf1JRJ2kh83AYgCsYOkJGnI0JglWBDAlI6RTp6SysSqxSLyEbEgg6TRJ5xWMmmo6sYo0KSmzNienpjIAH1B453woar3mtJnA1SQQQ9xtf72wUAwMAAQEWAwMAKBb8yUXEQnm1GVxYXWHBTfz7BtrCKB8SKDo3bRG3+B+IlvOJH6rcA04="}
00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":186,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1430069031611,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00502{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069031,"pkt_ts_usec":611243,"pkt_caplen":113,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":113,"pkt_l4_len":77,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAGHTnUAAQAbVXgoYUrw2\/\/3H5i8UZ+uf0VkGiXPCgBgCYxkQAAABAQgKAAKTKDTnT0kXAwEAKNOo\/lFrrxEtj1oyrBEybZXAvF7754xqLjvuYfV0gCpDpumAA3\/lW60="}
00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":202,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1430069031611,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","ndpi": {"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"}}
00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":202,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1430069031611,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":202,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1430069028075,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"120.28.26.242","dst_ip":"10.24.82.188","src_port":80,"dst_port":34503,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":202,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1430069028075,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"120.28.26.242","dst_ip":"10.24.82.188","src_port":80,"dst_port":34503,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00461{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":202,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1430069030119,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","l4_proto":"icmp","flow_datalink":113,"flow_max_packets":15}
00422{"flow_id":14,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":206,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069032,"pkt_ts_usec":164282,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq80AArAYRp9g63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00422{"flow_id":14,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":207,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069032,"pkt_ts_usec":171576,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":210,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1430069035398,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":42332,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00421{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":210,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":398200,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAChV8UAAQAbFkwoYUrzSZ\/APpVwBu+YrTKNirTiWUBFpAB9mAAA="}
00420{"flow_id":31,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":211,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":537940,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgkaUAAjgapG9Jn8A8KGFK8AbulXGKtOJbmK0ykUBCkj3bOAAA="}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":212,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1430069035840,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37557,"dst_port":80,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00448{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":212,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":840522,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADytk0AAPwbN8woYUrwfDURUkrUAUM0qoIsAAAAAoAI5CEEgAAACBAV4BAIICgALDRgAAAAAAQMDBw=="}
00424{"flow_id":32,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":213,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":877814,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACxm7kAA+AZbqB8NRFQKGFK8AFCStWTibgPNKqCMYBIRHPNeAAACBAV4"}
00420{"flow_id":32,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":214,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":880866,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACitlEAAPwbOBgoYUrwfDURUkrUAUM0qoIxk4m4EUBA5COLzAAA="}
00426{"flow_id":32,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":215,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":917823,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAArAYOlx8NRFQKGFK8AFCStWTibgTNKqCMYBD\/\/wn2AAABAQEB"}
00671{"flow_id":32,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":216,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":921179,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":243,"pkt_l4_len":207,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAOOtlUAAPwbNSgoYUrwfDURUkrUAUM0qoIxk4m4EUBg5CEcRAABHRVQgL21vYmlsZS9zdGF0dXMucGhwIEhUVFAvMS4xDQpVc2VyLUFnZW50OiBEYWx2aWsvMS42LjAgKExpbnV4OyBVOyBBbmRyb2lkIDQuNC40OyBNSSAzVyBNSVVJL1Y2LjQuMy4wLktYRE1JQ0IpDQpIb3N0OiB3d3cuZmFjZWJvb2suY29tDQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCg0K"}
00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":216,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":5,"flow_first_seen":1430069035840,"flow_last_seen":1430069035921,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37557,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Facebook","breed":"Fun","category":"SocialNetwork"},"http": {"hostname":"www.facebook.com","url":"www.facebook.com\/mobile\/status.php","code":0,"content_type":"","user_agent":"Dalvik\/1.6.0 (Linux; U; Android 4.4.4; MI 3W MIUI\/V6.4.3.0.KXDMICB)"}}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":217,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1430069035967,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45213,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00449{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":967627,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADzw1UAAPwaKsQoYUrwfDURUsJ0Bu3W4\/fMAAAAAoAI5CBvJAAACBAV4BAIICgALDSYAAAAAAQMDBw=="}
00422{"flow_id":32,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069035,"pkt_ts_usec":973456,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiiUEAArQZrLh8NRFQKGFK8AFCStWTibgTNKqFHUBD\/\/xtBAAA="}
00422{"flow_id":33,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":220,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":8002,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACxGQkAA+AZ8VB8NRFQKGFK8AbuwnWIYU8F1uP30YBIRHOshAAACBAV4"}
00420{"flow_id":33,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":221,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":10596,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjw1kAAPwaKxAoYUrwfDURUsJ0Bu3W4\/fRiGFPCUBA5CNq2AAA="}
00670{"flow_id":33,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":222,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":12946,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":240,"pkt_l4_len":204,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAODw10AAPwaKCwoYUrwfDURUsJ0Bu3W4\/fRiGFPCUBg5CMwfAAAWAwEAswEAAK8DAVU9Hy2pPPfpWbhIjMHHKuGu\/26IDUvEFU2avrf56FfmAABGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
00759{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":222,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":4,"flow_first_seen":1430069035967,"flow_last_seen":1430069036012,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":184,"flow_tot_l4_payload_len":184,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45213,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00423{"flow_id":33,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":225,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":49811,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgYslx8NRFQKGFK8AbuwnWIYU8J1uP30YBClZFxUAAABAQEB"}
00419{"flow_id":33,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":226,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":50513,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAChrjUAAjwbADR8NRFQKGFK8AbuwnWIYU8J1uP6sUBCkrG5aAAA="}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":228,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1430069036068,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35511,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00448{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":228,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":68122,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwqSkAAPwalnwoYUryt\/GECircBu1PEJ3oAAAAAoAI5CI51AAACBAV4BAIICgALDTAAAAAAAQMDBw=="}
00424{"flow_id":34,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":109870,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACzrl0AA+AYrYa38YQIKGFK8AbuKt2bo6WFTxCd7YBIRHMNnAAACBAV4"}
00421{"flow_id":34,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":113928,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgqS0AAPwalsgoYUryt\/GECircBu1PEJ3tm6OliUBA5CLL8AAA="}
00670{"flow_id":34,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":116156,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":240,"pkt_l4_len":204,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAOAqTEAAPwak+QoYUryt\/GECircBu1PEJ3tm6OliUBg5CCGEAAAWAwEAswEAAK8DAVU9Hy3lr9PhuC3NcwOeJGoglIkRSauG++7JURnxbEvJAABGAAQABQAvADXAAsAEwAXADMAOwA\/AB8AJwArAEcATwBQAMwA5ADIAOAAKwAPADcAIwBIAFgATAAkAFQASAAMACAAUABEA\/wEAAEAACwAEAwABAgAKADQAMgAOAA0AGQALAAwAGAAJAAoAFgAXAAgABgAHABQAFQAEAAUAEgATAAEAAgADAA8AEAAR"}
00760{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":231,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1430069036068,"flow_last_seen":1430069036116,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":184,"flow_tot_l4_payload_len":184,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35511,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02141{"flow_id":33,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":121375,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShrjkAAjwa7DB8NRFQKGFK8AbuwnWIYU8J1uP6sUBCkrFqtAAAWAwEAWQIAAFUDAa6R6RRKXfxddbtVAoidxSBrGSP+zxabD35QT5IWWmgIIEx+M4v6kMYdK9rfFgx\/4oOFoeXKuOJVavGbS+sm\/keqwAcAAA3\/AQABAAALAAQDAAECFgMBDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9jYTMtZzI5LmNybDBCBgNVHQ=="}
00811{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":232,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":7,"flow_first_seen":1430069035967,"flow_last_seen":1430069036121,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1464,"flow_avg_l4_payload_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45213,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}}
00580{"flow_id":33,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":122016,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":174,"pkt_l4_len":138,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAJ5rj0AAjwa\/lR8NRFQKGFK8AbuwnWIYWMJ1uP6sUBikrOyQAAAgBDswOTA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB7BggrBgEFBQcBAQRvMG0wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBF"}
00421{"flow_id":33,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":125067,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjw2EAAPwaKwgoYUrwfDURUsJ0Bu3W4\/qxiGFjCUBBBAM0GAAA="}
00422{"flow_id":33,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":235,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":125220,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjw2UAAPwaKwQoYUrwfDURUsJ0Bu3W4\/qxiGFk4UBBBAMyQAAA="}
02146{"flow_id":33,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":236,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":125464,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShrkEAAjwa7Ch8NRFQKGFK8AbuwnWIYWTh1uP6sUBCkrLAOAAAGCCsGAQUFBzAChjlodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlQ0EtMy5jcnQwDAYDVR0TAQH\/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAf4TX3s1P66\/caXxbDQe2jnaKngcjwn0ZQ7fV9dU+wEYbO0+Zfe9lQD15+559ykP5zZBA0qyYS1oaVH4+rZibsq6wmVOQtkUvQcR4eU8yULsmSo\/cr\/4OSGnGOgMEc2Z4Wefjmy7XninHx7DzcSL3DSCQtRONEkd3DXfnLIB14XItylFUFoTE4JLmtQw3ZLEGNCUCqhp4w0dyqbrUH9NEGh03DZ\/YZXjlXfdkKOodBniivM67AoemiIEtxRtGh1OIUyl5p31y3Sb8ydj7isPIMP41385LjSnaQ3WZ\/KUmwXGWWD3yw5LQn4q4u5uMPUIkW4Gx6SkSJbJXYbAMHoYulAAGXDCCBlgwggVAoAMCAQICEApfEU0DWxeRF9Lv1AOMPzswDQYJKoZIhvcNAQEFBQAwbDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2UgRVYgUm9vdCBDQTAeFw0wODA0MDIxMjAwMDBaFw0yMjA0MDMwMDAwMDBaMGYxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJTAjBgNVBAMTHERpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIENBLTMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC\/YQopEB9e\/jQ3UQj4Hvsi7WG+Cw1wTFBjJnUVuUGIl7bwoBW7CGDgQugFKRCHNoooZajvMQd0bTaXLyhGZgTHKnkmepnVjsNtT6Berbw9kcJZe142bMBTzwAIMj4QZFgQE2nHDO6cQlEA+QVE7iTOeh\/tjBG9EqjzFfQcejFpARun5l3Ammx+CZ7nUkRKEDoj5Ju2A6+onLRbn9RLrZKMzrURKqo3GI20wrjYXAaM+P8jvTVe1Hw+foMOkZYFmMOyH+PIZeupe12gLMz8PNlt7cz6S0OMydS4pWEcskC2KBLfufhf\/tOyye89tB5LfBxMmTaePevsp2heHd9nbl77AgMBAAGjggL6MIIC9jAOBgNVHQ8BAf8EBAMCAYYwggHGBgNVHSAEggG9MIIBuTCCAbUGC2CGSAGG\/WwBAwACMIIBpDA6BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABpAHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABhAGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdA=="}
00422{"flow_id":33,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":127997,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjw2kAAPwaKwAoYUrwfDURUsJ0Bu3W4\/qxiGF44UBBLAL2QAAA="}
00424{"flow_id":34,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":238,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":149329,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":60,"pkt_l4_len":24,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACwAAEAAjgaA+a38YQIKGFK8AbuKt2bo6WJTxCd7YBClZDSaAAABAQEB"}
00420{"flow_id":34,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":239,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":160590,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAChRFkAAjwYu5638YQIKGFK8AbuKt2bo6WJTxCgzUBCkrEagAAA="}
01596{"flow_id":33,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":240,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":179969,"pkt_caplen":926,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":926,"pkt_l4_len":890,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAA45rkUAAjwa8ox8NRFQKGFK8AbuwnWIYXjh1uP6sUBikrNHEAAAAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wEgYDVR0TAQH\/BAgwBgEB\/wIBADA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTCBjwYDVR0fBIGHMIGEMECgPqA8hjpodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB0GA1UdDgQWBBRQ6nOJ2yn7EI+e5QEg1N55mUiD9zANBgkqhkiG9w0BAQUFAAOCAQEAHuKlSJ5s21M4D++mGiqs4gND7Zq8Po51G\/D9LiJZrBPAYeLn+umZzYcJdVQov0Zg3L5RLJLzG5F8MQhw4je5wVuovaMLAPsaFf0DrVhqxcckmUhHRjEeku+0X040x5C\/McH4sYSG0JwBqt+KVgbOOukOrpd0XddxmkJ0X96NQ3ze6VXtaQDLBeB6YWEz0RlN+QjuoDnFJTW3K8QPst3xpbcOJMQmKI15d\/Uv8Fe6fAfU4fzNWjBXfoYQR90xH9f8osK\/MHxdJKro+a5fanTCzmuzRtghvinUjl4V1kJK5zJvpLFrUYNYvj9tx\/vaAyHLahYZTgrwrYTKXZSzWnb3YRYDAQCSDAAAjgMAF0EExrvVjJmskxsxl7za+fyJjy8jLZ01HW0zf5npTx\/6GWLGRG3SXO5Gg1gOG8smi\/NyV\/PxGGRbia0CMA7d76Yv2ABHMEUCIHzwDcwFMpxVP\/8am4nZhxz0QnCrvWisp422CWpoZBYUAiEA6zngcC34dn3Gt0qUcGhAjS8GTzhESSBXNqyC\/12rLOcWAwEABA4AAAA="}
01600{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":240,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":13,"flow_first_seen":1430069035967,"flow_last_seen":1430069036179,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":3732,"flow_avg_l4_payload_len":287,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45213,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00422{"flow_id":33,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":241,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":183936,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjw20AAPwaKvwoYUrwfDURUsJ0Bu3W4\/qxiGGGeUBBVALAqAAA="}
00801{"flow_id":32,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":242,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":184027,"pkt_caplen":339,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":339,"pkt_l4_len":303,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcAUOiUUAArQZqEh8NRFQKGFK8AFCStWTibgTNKqFHUBj\/\/1uiAABIVFRQLzEuMSAyMDQgTm8gQ29udGVudA0KQ2FjaGUtQ29udHJvbDogcHJpdmF0ZSwgbm8tc3RvcmUsIG5vLWNhY2hlLCBtdXN0LXJldmFsaWRhdGUNCkVkZ2UtY29udHJvbDogY2FjaGUtbWF4YWdlPTI4ZA0KWC1GQi1EZWJ1ZzogbnRKRXA0ZXcwOHRBWkdWd2J0SHdUZzhPVFBDbGd3RHI1V1FlTXJkYitCazA1eEpaZkMxaXVjb1NpaWd3RG94NUZzcjJjQ2txSmN3MHBUN1FMS1dUY0E9PQ0KRGF0ZTogU3VuLCAyNiBBcHIgMjAxNSAxNzoyMzo1NiBHTVQNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCg0K"}
00420{"flow_id":32,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":243,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":185828,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACitlkAAPwbOBAoYUrwfDURUkrUAUM0qoUdk4m8fUBA8uN1tAAA="}
00589{"flow_id":33,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":244,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":247321,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":178,"pkt_l4_len":142,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAKLw3EAAPwaKRAoYUrwfDURUsJ0Bu3W4\/qxiGGGeUBhVAPcpAAAWAwEARhAAAEJBBKEasiyUo2ANNASkr2uadAhqkbscFf9u1KOWllAbNFBDhtdLmgUrZUpTT7pczUwTMUMatVuEPWFyZE1dHeDqmuYUAwEAAQEWAwEAJGIfRucykgPyI9pqoL2jesB+lmMfcHzlLfb88ABcRl7sHSXOIg=="}
02140{"flow_id":34,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":258,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":608985,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShRF0AAjgYq5q38YQIKGFK8AbuKt2bo6WJTxCgzUBCkrMtIAAAWAwEAWQIAAFUDAbZyuIuZl37RA6xhj4YdGRy7e\/k0fSBIfmPHpvdYA0LwIGHGz3CMoqyAqySUoSyZbEmdkTnwkbEEIcyIOcde2TVPwAcAAA3\/AQABAAALAAQDAAECFgMBDNkLAAzVAAzSAAZwMIIGbDCCBVSgAwIBAgIQBnjbTdvaLb44isb+B0TcyDANBgkqhkiG9w0BAQUFADBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMB4XDTE0MDgyODAwMDAwMFoXDTE1MTAyODEyMDAwMFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpNZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5mYWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATY0d01veJZtvubH1QVjNu\/Tli9R764EPwi6dKemPhJKiX7lEbkQpmEUBxfAf0UJTFcTtlk\/cUMs0bSobxwtIeOo4ID5DCCA+AwHwYDVR0jBBgwFoAUUOpzidsp+xCPnuUBINTeeZlIg\/cwHQYDVR0OBBYEFEMJk0D6EUswM+zyh26NcRjPiryOMIICOwYDVR0RBIICMjCCAi6CDiouZmFjZWJvb2suY29tggxmYWNlYm9vay5jb22CCyouZmJzYnguY29tggsqLmZiY2RuLm5ldIIOKi54eC5mYmNkbi5uZXSCDioueHkuZmJjZG4ubmV0ggZmYi5jb22CCCouZmIuY29tghgqLmZhY2Vib29rY29yZXd3d2kub25pb26CFmZhY2Vib29rY29yZXd3d2kub25pb26CGCouZmJjZG4yM2Rzc3IzanFucS5vbmlvboIWZmJjZG4yM2Rzc3IzanFucS5vbmlvboIYKi5mYnNieDJxNG12Y2w2M3B3Lm9uaW9ughZmYnNieDJxNG12Y2w2M3B3Lm9uaW9ughAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDW1lc3Nlbmdlci5jb22CGioubS5mYWNlYm9va2NvcmV3d3dpLm9uaW9ughsqLnh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGXh4LmZiY2RuMjNkc3NyM2pxbnEub25pb26CGyoueHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIZeHkuZmJjZG4yM2Rzc3IzanFucS5vbmlvboIOKi54ei5mYmNkbi5uZXSCDHh6LmZiY2RuLm5ldIIbKi54ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughl4ei5mYmNkbjIzZHNzcjNqcW5xLm9uaW9ughhtLmZhY2Vib29rY29yZXd3d2kub25pb24wDgYDVR0PAQH\/BAQDAgOIMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBhBgNVHR8EWjBYMCqgKKAmhiRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vY2EzLWcyOS5jcmwwKqAooCaGJGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9jYTMtZzI5LmNybDBCBgNVHQ=="}
00812{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":258,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":7,"flow_first_seen":1430069036068,"flow_last_seen":1430069036608,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":1464,"flow_avg_l4_payload_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35511,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"}}
02145{"flow_id":34,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":259,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":609168,"pkt_caplen":1336,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1336,"pkt_l4_len":1300,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABShRGEAAjgYq5a38YQIKGFK8AbuKt2bo7mJTxCgzUBCkrCEVAAAgBDswOTA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzB7BggrBgEFBQcBAQRvMG0wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBFBggrBgEFBQcwAoY5aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUNBLTMuY3J0MAwGA1UdEwEB\/wQCMAAwDQYJKoZIhvcNAQEFBQADggEBAH+E197NT+uv3Gl8Ww0Hto52ip4HI8J9GUO31fXVPsBGGztPmX3vZUA9efuefcpD+c2QQNKsmEtaGlR+Pq2Ym7KusJlTkLZFL0HEeHlPMlC7JkqP3K\/+DkhpxjoDBHNmeFnn45su154px8ew83Ei9w0gkLUTjRJHdw135yyAdeFyLcpRVBaExOCS5rUMN2SxBjQlAqoaeMNHcqm61B\/TRBodNw2f2GV45V33ZCjqHQZ4orzOuwKHpoiBLcUbRodTiFMpead9ct0m\/MnY+4rDyDD+Nd\/OS40p2kN1mfylJsFxllg98sOS0J+KuLubjD1CJFuBsekpEiWyV2GwDB6GLpQABlwwggZYMIIFQKADAgECAhAKXxFNA1sXkRfS79QDjD87MA0GCSqGSIb3DQEBBQUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMDgwNDAyMTIwMDAwWhcNMjIwNDAzMDAwMDAwWjBmMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSUwIwYDVQQDExxEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2EKKRAfXv40N1EI+B77Iu1hvgsNcExQYyZ1FblBiJe28KAVuwhg4ELoBSkQhzaKKGWo7zEHdG02ly8oRmYExyp5JnqZ1Y7DbU+gXq28PZHCWXteNmzAU88ACDI+EGRYEBNpxwzunEJRAPkFRO4kznof7YwRvRKo8xX0HHoxaQEbp+ZdwJpsfgme51JEShA6I+SbtgOvqJy0W5\/US62SjM61ESqqNxiNtMK42FwGjPj\/I701XtR8Pn6DDpGWBZjDsh\/jyGXrqXtdoCzM\/DzZbe3M+ktDjMnUuKVhHLJAtigS37n4X\/7TssnvPbQeS3wcTJk2nj3r7KdoXh3fZ25e+wIDAQABo4IC+jCCAvYwDgYDVR0PAQH\/BAQDAgGGMIIBxgYDVR0gBIIBvTCCAbkwggG1BgtghkgBhv1sAQMAAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cuZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdA=="}
01755{"flow_id":34,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":260,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":612036,"pkt_caplen":1043,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1043,"pkt_l4_len":1007,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABANRGUAAjgYsCa38YQIKGFK8AbuKt2bo82JTxCgzUBikrEovAAAAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMAZQAuMBIGA1UdEwEB\/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSBhzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSMEGDAWgBSxPsNpA\/i\/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUBINTeeZlIg\/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA\/vphoqrOIDQ+2avD6OdRvw\/S4iWawTwGHi5\/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2jCwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6XdF3XcZpCdF\/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTEJiiNeXf1L\/BXunwH1OH8zVowV36GEEfdMR\/X\/KLCvzB8XSSq6PmuX2p0ws5rs0bYIb4p1I5eFdZCSucyb6Sxa1GDWL4\/bcf72gMhy2oWGU4K8K2Eyl2Us1p292EWAwEAkQwAAI0DABdBBF6hk1Yewa00uIJUS1f8EGQdfuetE3UDgcfK1KuF8DJSBKJSEPoE6VPxncMmJsPNt5F\/a0hmJ8KTbudHBxzPJocARjBEAiANHy3l9Wg1jYhXx6qsp9jjZzbvcPiJcvxfW51qSwHb9gIgMOMuVzo3DjBChuJlhLhS4A5pSe4rOcJyYLqIsIe8xbAWAwEABA4AAAA="}
01600{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":260,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":9,"flow_first_seen":1430069036068,"flow_last_seen":1430069036612,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":3731,"flow_avg_l4_payload_len":414,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35511,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.facebook.com,facebook.com,*.fbsbx.com,*.fbcdn.net,*.xx.fbcdn.net,*.xy.fbcdn.net,fb.com,*.fb.com,*.facebookcorewwwi.onion,facebookcorewwwi.onion,*.fbcdn23dssr3jqnq.onion,fbcdn23dssr3jqnq.onion,*.fbsbx2q4mvcl63pw.onion,fbsbx2q4mvcl63pw.onion,*.m.facebook.com,*.messenger.com,messenger.com,*.m.facebookcorewwwi.onion,*.xx.fbcdn23dssr3jqnq.onion,xx.fbcdn23dssr3jqnq.onion,*.xy.fbcdn23dssr3jqnq.onion,xy.fbcdn23dssr3jqnq.onion,*.xz.fbcdn.net,xz.fbcdn.net,*.xz.fbcdn23dssr3jqnq.onion,xz.fbcdn23dssr3jqnq.onion,m.facebookcorewwwi.onion","ja3":"dff8a0aa1c904aaea76c5bf624e88333","ja3s":"6c13ac74a6f75099ef2480748e5d94d2","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance CA-3","issuerDN":"C=US, ST=CA, L=Menlo Park, O=Facebook, Inc., CN=*.facebook.com","fingerprint":"A4:FB:65:F8:A1:57:FE:0D:C0:17:C1:B5:51:62:63:3A:18:73:A0:B4"}}
00422{"flow_id":34,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":261,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":614905,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgqTUAAPwalsAoYUryt\/GECircBu1PEKDNm6O5iUBBBAKVMAAA="}
00422{"flow_id":34,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":262,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":615088,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgqTkAAPwalrwoYUryt\/GECircBu1PEKDNm6PNiUBBLAJZMAAA="}
00422{"flow_id":34,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":263,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":615210,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgqT0AAPwalrgoYUryt\/GECircBu1PEKDNm6Pc9UBBVAIhxAAA="}
00593{"flow_id":34,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":264,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":652137,"pkt_caplen":178,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":178,"pkt_l4_len":142,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAKIqUEAAPwalMwoYUryt\/GECircBu1PEKDNm6Pc9UBhVAIPUAAAWAwEARhAAAEJBBCZZ2wh0b7p+4q5eEO79DW58Pvc4nyT0xrNL3bCO2plbKHFGdyRmMh0ZcHNEB\/lKFQGaH\/L\/PtM0\/SAirYCEtroUAwEAAQEWAwEAJDsdVT0taM9UGHOwQMYlU0bNX7fcATICi5AHNvPXOMvzdoQzew=="}
00421{"flow_id":34,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":265,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":736212,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAChRGkAAjgYv4638YQIKGFK8AbuKt2bo9z1TxCitUBCkrDhLAAA="}
00487{"flow_id":34,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":268,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069036,"pkt_ts_usec":966132,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":103,"pkt_l4_len":67,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAFdRG0AAjgYvs638YQIKGFK8AbuKt2bo9z1TxCitUBikrHPzAAAUAwEAAQEWAwEAJKwdKZ2NDt5ze7yUKw10pzowgyKHfU+iDmCTOpdSftiIYUx5uA=="}
00423{"flow_id":14,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":284,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069038,"pkt_ts_usec":595954,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq9EAArAYRptg63QoKGFK8AFCMUmKi4jFDN+TzUBH\/\/6QYAAA="}
00422{"flow_id":14,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":285,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069038,"pkt_ts_usec":654608,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00525{"flow_id":13,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069040,"pkt_ts_usec":829291,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":130,"pkt_l4_len":94,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAHLzXUAAPwZJYwoYUrxn9jn7x00fkMsN9wYrPwQwgBgAexO3AAABAQgKAAsPCpj2bmU6AAAAolkC\/4gP\/deLY5qAl+gvk1q6sKo+Dj8NmSA2rJYEww7CAFaSnbB0cHHjCEGbHgWAm+O6R5DcVbzucA=="}
00700{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":289,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069041,"pkt_ts_usec":829810,"pkt_caplen":258,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":258,"pkt_l4_len":222,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAPJbIkAALgbyHmf2OfsKGFK8H5DHTSs\/BDDLDfdEgBgADk6wAAABAQgKmPajHgALDwq6AAAAolkC\/4gP\/deLY5qAl+gvk1q6MKo+Dr8NmSA0vIoEwzL52Zrr6RjF9Bu994wavboL+YbRyGuQnqzGjRX38N1zyfNe61lkzc0IHKVWxcnKyjmNl6oQX9Lrf+xWf9zOhkCznR4qsQb0obZXCGNou9W\/BEdEWcdYd1s\/XQjToOKZQOS9aYSCHzCyUVerS7tvJBIcs5grGAgJ\/\/0j1kplCt6fp\/H15W5dVAQmBKJAFTBRqD7ubEPdwOIZpkw4"}
00437{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069041,"pkt_ts_usec":937537,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADTzXkAAPwZJoAoYUrxn9jn7x00fkMsN90QrPwTugBAAg1J8AAABAQgKAAsPe5j2ox4="}
00566{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":291,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069044,"pkt_ts_usec":568854,"pkt_caplen":157,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":157,"pkt_l4_len":121,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAI3zX0AAPwZJRgoYUrxn9jn7x00fkMsN90QrPwTugBgAg\/lWAAABAQgKAAsQgJj2ox5VAAAApVkC\/4gP6c2DY5DOxadg3j3uOFk37WQtu31WeByENvnH+DX\/S7DVK6u8apgllsOoljhTv0Bpj3w8hcD\/X\/f\/nc5qUppaWqWFC3vtb1GieZeOb5kg9A=="}
00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":293,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1430069044758,"flow_last_seen":0,"flow_min_l4_payload_len":247,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":247,"flow_avg_l4_payload_len":247,"midstream":1,"l3_proto":"ip4","src_ip":"139.150.0.125","dst_ip":"10.24.82.188","src_port":443,"dst_port":46947,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00761{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":293,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069044,"pkt_ts_usec":758795,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":303,"pkt_l4_len":267,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAR8KJUAAjgb4zIuWAH0KGFK8Abu3Y2Ij0KVRKAPiUBigLueuAADzAAAApDlIVrVdqRc+Gkt7POZ3i2OlkuY4MMfPTZY9G4U0YFfr\/Io7pOCQe3JDBNAmPdEpHGIlOOWztPzNgfmCZdfJbXa\/FjyLrCbe\/cKrmuhEYDyIPsoQcOHY3YFPdOkSmKChheXsyu06po9uQ1CWTJDZfqoByGUY9M3+\/torvsssHclmFyrgMhiQBPDR+\/p96Y\/\/sK6VRP8W+SfBO5i7Jg3brhWvS81m7IbytFR73ZERAlFn0QejuZzhem715ywfbXU8ySrwRBK2cs3ywClzqW\/s7h0teJNcn45XHRR+Z0ZTPA29+kHM57k5C1faf1I\/3jeLMDw\/"}
00420{"flow_id":35,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":295,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069044,"pkt_ts_usec":836371,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjTekAAQAZ+bgoYUryLlgB9t2MBu1EoA+JiI9GcUBCIgOkBAAA="}
00477{"flow_id":35,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":296,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069044,"pkt_ts_usec":940863,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":98,"pkt_l4_len":62,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFLTe0AAQAZ+QwoYUryLlgB9t2MBu1EoA+JiI9GcUBiIgH9kAAAmAAAApDlIVrVdqRc+Gkt7POZ3i2OlX+Y4MArPTZYlBp4hfXC7UiHVW\/8="}
00420{"flow_id":35,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":297,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069044,"pkt_ts_usec":982337,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgKJkAAjwb4wouWAH0KGFK8Abu3Y2Ij0ZxRKAQMUBCgBOTVAAA="}
00420{"flow_id":31,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":298,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069048,"pkt_ts_usec":642493,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgkakAAjgapGtJn8A8KGFK8AbulXNdU3uvmK0ykUBSkj1vNAAA="}
00421{"flow_id":31,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":299,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069048,"pkt_ts_usec":642676,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAQAYbhQoYUrzSZ\/APpVwBu+YrTKRirTiWUBBpALJdAAA="}
00420{"flow_id":31,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":300,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069048,"pkt_ts_usec":679969,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUoACgAAEAAjgbNXNJn8A8KGFK8AbulXGKtOJYAAAAAUAQAAE46AAA="}
00755{"flow_id":35,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":303,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069048,"pkt_ts_usec":920172,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":303,"pkt_l4_len":267,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAR8KJ0AAjwb3youWAH0KGFK8Abu3Y2Ij0ZxRKAQMUBigBA+QAADzAAAAFuBuaLVdqRc+Gkt7POZ3i9iwE0OUcIt6Wdo7FYv6P+oilGFY3dWOKarP+MAtPaIe7D4hJ6euSyPoLY02ayhtG6t6hjgo0J+3mmd2rWibbgn7vgALgNP+pPunSUEX0JXO1FBdWyEY1hTl2P1ityWpPqC+7EsELHBJIRlK+qytu2G1YDO1EC3LK85VDdZrB5iRO11q\/l+hBAqej\/BKXOYYSGrN9au2EIR2Ot+AlK\/Qjtu0OP1vjPCzsOrqf4xtuZg5q4ODFnVhg7n5wqCHN3shjUv0TKYl6uhcpZF5VHuJ0LQvT1qmfU8F0MfXxOK\/kWj6y7Wr"}
00420{"flow_id":35,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":304,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069048,"pkt_ts_usec":920600,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjTfEAAQAZ+bAoYUryLlgB9t2MBu1EoBAxiI9KTUBCRCOkBAAA="}
00476{"flow_id":35,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":306,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069049,"pkt_ts_usec":179969,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":98,"pkt_l4_len":62,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFLTfUAAQAZ+QQoYUryLlgB9t2MBu1EoBAxiI9KTUBiRCF0ZAAAmAAAAFuBuaLVdqRc+Gkt7POZ3i9iw3kOUcEZ6WdojCJDvIs0xtYwNzYg="}
00420{"flow_id":35,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":307,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069049,"pkt_ts_usec":230536,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgKKEAAjwb4wIuWAH0KGFK8Abu3Y2Ij0pNRKAQ2UBCf2uPeAAA="}
00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":308,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1430069049770,"flow_last_seen":0,"flow_min_l4_payload_len":96,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":96,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.194.72.188","src_port":34686,"dst_port":5228,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00567{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":308,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069049,"pkt_ts_usec":770087,"pkt_caplen":164,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":164,"pkt_l4_len":128,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAJSUZ0AAQAZSqgoYUrytwki8h34UbGWkOWcyCtXvgBgB12cmAAABAQgKAAKaQHWhBxYXAwEAW9BJTUK7bhQDJS6M4k2xveYn3KZ2THpi3b2p1WnyM44nZ0651+YzJehbLb+jV4nNEd4GZbKLQU+P8abQYninXFhPSKcNuFppnDwsImxNyj3HrOvurwOWRZpYp3o="}
00423{"flow_id":14,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":309,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069051,"pkt_ts_usec":671393,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiq9UAArAYRpdg63QoKGFK8AFCMUtPmE5BDN+TzUBH\/\/wF2AAA="}
00422{"flow_id":14,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":310,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069051,"pkt_ts_usec":765998,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACgAAEAAPwYptwoYUrzYOt0KjFIAUEM35dFioucAUBA+dl\/2AAA="}
00422{"flow_id":21,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069052,"pkt_ts_usec":223609,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACif4UAArAZunR8NRFQKGFK8AFCSsWQ58kuOvvK5UBH\/\/4SfAAA="}
00422{"flow_id":21,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069052,"pkt_ts_usec":317694,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACj6\/UAAPwaAnQoYUrwfDURUkrEAUI6+8rlkOfJMUBA8uEfnAAA="}
00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":313,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1430069049770,"flow_last_seen":0,"flow_min_l4_payload_len":96,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":96,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.194.72.188","src_port":34686,"dst_port":5228,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":313,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1430069049770,"flow_last_seen":0,"flow_min_l4_payload_len":96,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":96,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.194.72.188","src_port":34686,"dst_port":5228,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00760{"flow_id":35,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":314,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069055,"pkt_ts_usec":712958,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":303,"pkt_l4_len":267,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAR8KKUAAjgb4yIuWAH0KGFK8Abu3Y2Ij0pNRKAQ2UBif2g\/UAADzAAAADm0Ga7VdqRc+Gkt7POZ3i+5tzFY41M0fMnZ5G+m2Vfmrg\/zv7j0hw0EYHJWzK5vm\/yh4v2HJS83EDXIAXU2bjamkVNJvnppe0xZ5dVZ87ou5\/qGH6LaceT8u59MyUCQvylTi4YEzvDS9zVBR8mlLXoh1YM2wq9pcWvX2q\/mybRcS2fxHzLHJJpFYQpXKfnNGugL7Wx\/EBHURohcuMoPwedtdn3tHj0aCstecuAcqjgGrRkrqpBRh\/NLh33y+h1qkuo9\/WREg5Tpgd83vHtfKtQ78Z7vZ4TSawOTHx9k\/8rk1O3mx++HEjz58cnZa448oyarm"}
00421{"flow_id":35,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":315,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069055,"pkt_ts_usec":713507,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjTfkAAQAZ+agoYUryLlgB9t2MBu1EoBDZiI9OKUBCZkOkBAAA="}
00477{"flow_id":35,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069055,"pkt_ts_usec":909095,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":98,"pkt_l4_len":62,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFLTf0AAQAZ+PwoYUryLlgB9t2MBu1EoBDZiI9OKUBiZkLHVAAAmAAAADm0Ga7VdqRc+Gkt7POZ3i+5tAVY41AAfMnZhBvKjSN7EqKqW+N8="}
00760{"flow_id":35,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":319,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069056,"pkt_ts_usec":34613,"pkt_caplen":303,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":303,"pkt_l4_len":267,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAR8KKkAAjgb4x4uWAH0KGFK8Abu3Y2Ij0pNRKAQ2UBif2g\/UAADzAAAADm0Ga7VdqRc+Gkt7POZ3i+5tzFY41M0fMnZ5G+m2Vfmrg\/zv7j0hw0EYHJWzK5vm\/yh4v2HJS83EDXIAXU2bjamkVNJvnppe0xZ5dVZ87ou5\/qGH6LaceT8u59MyUCQvylTi4YEzvDS9zVBR8mlLXoh1YM2wq9pcWvX2q\/mybRcS2fxHzLHJJpFYQpXKfnNGugL7Wx\/EBHURohcuMoPwedtdn3tHj0aCstecuAcqjgGrRkrqpBRh\/NLh33y+h1qkuo9\/WREg5Tpgd83vHtfKtQ78Z7vZ4TSawOTHx9k\/8rk1O3mx++HEjz58cnZa448oyarm"}
00420{"flow_id":35,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":320,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069056,"pkt_ts_usec":34796,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACjTgEAAQAZ+aAoYUryLlgB9t2MBu1EoBGBiI9OKUBCZkOkBAAA="}
00420{"flow_id":35,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":321,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069056,"pkt_ts_usec":74683,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAACgKK0AAjwb4vYuWAH0KGFK8Abu3Y2Ij04pRKARgUBCfsOLnAAA="}
00423{"flow_id":32,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069057,"pkt_ts_usec":684973,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiiUkAArAZsLB8NRFQKGFK8AFCStWTibx\/NKqFHUBH\/\/xolAAA="}
00424{"flow_id":32,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069057,"pkt_ts_usec":685950,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAACEgAAAAAAAAAAAAAIAEUcACiiU0AArAZsKx8NRFQKGFK8AFCStWTibx\/NKqFHUBH\/\/xolAAA="}
00421{"flow_id":32,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069057,"pkt_ts_usec":806708,"pkt_caplen":56,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":56,"pkt_l4_len":20,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAACitl0AAPwbOAwoYUrwfDURUkrUAUM0qoUdk4m8gUBA8uN1sAAA="}
00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":325,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1430069060011,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"216.58.220.174","src_port":49217,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00455{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069060,"pkt_ts_usec":11328,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":83,"pkt_l4_len":47,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAENCkUAAQAbmZgoYUrzYOtyuwEEBuxTXAEVlWZivUBiMAAFrAAAVAwEAFnnuS9reX0mqADPiihp3NglZFsDnKQA="}
00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":334,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1430069060011,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"216.58.220.174","src_port":49217,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":334,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1430069060011,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"216.58.220.174","src_port":49217,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00758{"flow_id":35,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":335,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069068,"pkt_ts_usec":839972,"pkt_caplen":301,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":301,"pkt_l4_len":265,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAAR0KLEAAjgb4x4uWAH0KGFK8Abu3Y2Ij04pRKARgUBifsO6FAADxAAAA9OvkaLVdqRc+Gkt7POZ3i3B\/cSs8hz\/Y+A61mP+SPxO\/R3DGac2sjPnDCuKsrSfTbaTpC1QCK\/upe0ARxdejVurhNuCPA1SnywVLdu4Zw4wElJdvhX7T69mP5x8qI1Azfzl6NQhOIOdbeNjsORgh1vdsQSIm8PTjvEbCs2HlI1ijsi3aryyOYLECufcgZQh+GJ5ecJsfSD+F7fO9n1i5nft96BRdO1V4rNOFmTnrppJbI93qmZXgStBGfcB+qtk0Xvm+VYsDKwNq2vUgN+UkKJNvJyo8rCIYXzs\/GuzAG6FP1IczSONX8\/ceTFUNZIdxfw=="}
00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":341,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1430069072945,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00438{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":341,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069072,"pkt_ts_usec":945990,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADTTnkAAQAbVigoYUrw2\/\/3H5i8UZ+uf0YYGiXPCgBQCY5HBAAABAQgKAAKjTTTnT0k="}
00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":342,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1430069072986,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58964,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00450{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":342,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069072,"pkt_ts_usec":986762,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADwsMEAAQAZ88QoYUrw2\/\/3H5lQUZzqvj2AAAAAAoAI2sJHJAAACBAV4BAIICgACo1AAAAAAAQMDBQ=="}
00450{"flow_id":39,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":343,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":186194,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":76,"pkt_l4_len":40,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADwAAEAALQa8ITb\/\/ccKGFK8FGfmVG+Fj0U6r49hoBJF6jkFAAACBAV4BAIICjTom84AAqNQAQMDCA=="}
00438{"flow_id":39,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":344,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":186682,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAADQsMUAAQAZ8+AoYUrw2\/\/3H5lQUZzqvj2FvhY9GgBABtpHBAAABAQgKAAKjZTTom84="}
00547{"flow_id":39,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":201697,"pkt_caplen":146,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":146,"pkt_l4_len":110,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAIIsMkAAQAZ8qQoYUrw2\/\/3H5lQUZzqvj2FvhY9GgBgBtpi\/AAABAQgKAAKjZzTom84WAwEASQEAAEUDAVFRUVESVPKV5Ej6iE0e+b\/OK2fBD2XxGFd+RBJAtWh8AAAeAAQABQAvADMAMgAKABYAEwAJABUAEgADAAgAFAARAQA="}
00798{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":345,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":4,"flow_first_seen":1430069072986,"flow_last_seen":1430069073201,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":78,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58964,"dst_port":5223,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port","7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Amazon","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1","client_requested_server_name":"","ja3":"d9ce50c62ab1fd5932da3c6b6d406c65","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00439{"flow_id":39,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":346,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":294684,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":68,"pkt_l4_len":32,"pkt":"AAACEgAAAAAAAAAAAAAIAEUAADQUukAALgambzb\/\/ccKGFK8FGfmVG+Fj0Y6r4+vgBAARqynAAABAQgKNOib\/AACo2c="}
02306{"flow_id":39,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1430069073,"pkt_ts_usec":299933,"pkt_caplen":1456,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":1456,"pkt_l4_len":1420,"pkt":"AAACEgAAAAAAAAAAAAAIAEUABaAUu0AALgahAjb\/\/ccKGFK8FGfmVG+Fj0Y6r4+vgBAARqHKAAABAQgKNOib\/AACo2cWAwEGtQIAAEYDAVU9H1Gb\/qiDm98eXfIJxb4shEK1GhPjZeBEv8P67\/0aIFU9H1G382hmASwGnCuJDP0Mh2TynvUtxumEykegoF7eAAQACwAGYwAGYAADPjCCAzowggKjoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwgaQxCzAJBgNVBAYTAktSMRQwEgYDVQQIDAtHeWVvbmdnaSBkbzEOMAwGA1UEBwwFU3V3b24xJTAjBgNVBAoMHFNBTVNVTkcgRUxFQ1RST05JQ1MgQ08uLCBMVEQxHjAcBgNVBAMMFSoucHVzaC5zYW1zdW5nb3NwLmNvbTEoMCYGCSqGSIb3DQEJARYZYWRtaW5AcHVzaC5zYW1zdW5nb3NwLmNvbTAeFw05OTEyMzExNTA1MDRaFw00OTEyMTgxNTA1MDRaMIGUMQswCQYDVQQGEwJLUjEUMBIGA1UECAwLR3llb25nZ2kgZG8xJTAjBgNVBAoMHFNBTVNVTkcgRUxFQ1RST05JQ1MgQ08uLCBMVEQxHjAcBgNVBAMMFSoucHVzaC5zYW1zdW5nb3NwLmNvbTEoMCYGCSqGSIb3DQEJARYZYWRtaW5AcHVzaC5zYW1zdW5nb3NwLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsyrNiMIXJ++fpsiI08sYxPZbKOY56a37f6J9ViQReAUe3UWF2fdOff49ukAjUISbhahOinbZux+ildb7qUyHJVHQXanBrQsLoODvfOiws0bRofk+EjA3+puR1KI8EgNDCJfkzYF40k16LBiMv6fKIGXOV6sbZciKSSDD+AX5+08CAwEAAaOBiTCBhjAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUHQ6IKqRzfLkHpPDYYWaWWRoHaGswHwYDVR0jBBgwFoAUWMjZPBPgzaBussvwASa64F2DMFEwCwYDVR0PBAQDAgXgMA0GCSqGSIb3DQEBBQUAA4GBALo4j8DvDTq0WR5v2UJovDtyilA1Zel1mK2n\/GtzjEjxAUkMxaGxxxnaEWdSVH0\/0pG7jG3ieJSWSLWW4HdJJ+ZytoamKq2k87O5sF5LkM+ZGg+UlFyFpcvLuYXtbZHa4CFAnYmBZ5nQNz06gzWDYU9\/yRhZSf2unf7zNha\/BodKAAMcMIIDGDCCAoGgAwIBAgIJAPMld7YDENSnMA0GCSqGSIb3DQEBBQUAMIGkMQswCQYDVQQGEwJLUjEUMBIGA1UECAwLR3llb25nZ2kgZG8xDjAMBgNVBAcMBVN1d29uMSUwIwYDVQQKDBxTQU1TVU5HIEVMRUNUUk9OSUNTIENPLiwgTFREMR4wHAYDVQQDDBUqLnB1c2guc2Ftc3VuZ29zcC5jb20xKDAmBgkqhkiG9w0BCQEWGWFkbWluQHB1c2guc2Ftc3VuZ29zcC5jb20wHhcNOTkxMjMxMTUwMjEwWhcNNDkxMjE4MTUwMjEwWjCBpDELMAkGA1UEBhMCS1IxFDASBgNVBAgMC0d5ZW9uZ2dpIGRvMQ4wDAYDVQQHDAVTdXdvbjElMCMGA1UECgwcU0FNU1VORyBFTEVDVFJPTklDUyBDTy4sIExURDEeMBwGA1UEAwwVKi5wdXNoLnNhbXN1bmdvc3AuY29tMSgwJgYJKoZIhvcNAQkBFhlhZG1pbkBwdXNoLnNhbXN1bmdvc3AuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS\/wx087bX6AA7bz\/rPd\/AOtm8g1ebRfENevGCnMrnUw=="}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1430069022058,"flow_last_seen":1430069022094,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":126,"flow_avg_l4_payload_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":41909,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":10,"flow_first_seen":1430069030508,"flow_last_seen":1430069052317,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":283,"flow_tot_l4_payload_len":470,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37553,"dst_port":80,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":11,"flow_first_seen":1430069035840,"flow_last_seen":1430069057806,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":283,"flow_tot_l4_payload_len":470,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":37557,"dst_port":80,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":2,"flow_first_seen":1430069030978,"flow_last_seen":1430069031017,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":130,"flow_avg_l4_payload_len":65,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":19582,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":34,"flow_first_seen":1430069031042,"flow_last_seen":1430069032022,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":7723,"flow_avg_l4_payload_len":227,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.70","src_port":43581,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":38,"flow_first_seen":1430069026370,"flow_last_seen":1430069037135,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":5411,"flow_avg_l4_payload_len":142,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35503,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":36,"flow_first_seen":1430069036068,"flow_last_seen":1430069065046,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":5108,"flow_avg_l4_payload_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"173.252.97.2","src_port":35511,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1430069072945,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","ndpi": {"proto":"Amazon","breed":"Acceptable","category":"Web"}}
00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1430069072945,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58927,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":6,"flow_first_seen":1430069072986,"flow_last_seen":1430069073299,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":1466,"flow_avg_l4_payload_len":244,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"54.255.253.199","src_port":58964,"dst_port":5223,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_first_seen":1430069022059,"flow_last_seen":1430069022093,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":58810,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1430069022105,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":56820,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1430069021959,"flow_last_seen":1430069022041,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":102,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":38448,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":2,"flow_first_seen":1430069030083,"flow_last_seen":1430069030119,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.191.1","src_port":61011,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1430069030083,"flow_last_seen":1430069030115,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":61011,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1430069022100,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":5929,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1430069031167,"flow_last_seen":1430069031221,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":141,"flow_avg_l4_payload_len":70,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":4017,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":2,"flow_first_seen":1430069030703,"flow_last_seen":1430069030748,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":74,"flow_tot_l4_payload_len":108,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":24596,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_first_seen":1430069022252,"flow_last_seen":1430069022295,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":43077,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":26,"flow_first_seen":1430069022297,"flow_last_seen":1430069069068,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":589,"flow_tot_l4_payload_len":2142,"flow_avg_l4_payload_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"103.246.57.251","src_port":51021,"dst_port":8080,"l4_proto":"tcp","ndpi": {"proto":"HTTP_Proxy","breed":"Acceptable","category":"Web"}}
00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":26,"flow_first_seen":1430069022297,"flow_last_seen":1430069069068,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":589,"flow_tot_l4_payload_len":2142,"flow_avg_l4_payload_len":82,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"103.246.57.251","src_port":51021,"dst_port":8080,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":27,"flow_first_seen":1430069030121,"flow_last_seen":1430069041457,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":5586,"flow_avg_l4_payload_len":206,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":37821,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":2,"flow_first_seen":1430069031230,"flow_last_seen":1430069031281,"flow_min_l4_payload_len":43,"flow_max_l4_payload_len":86,"flow_tot_l4_payload_len":129,"flow_avg_l4_payload_len":64,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":14650,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1430069022249,"flow_last_seen":1430069022282,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":29029,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1430069022007,"flow_last_seen":1430069022042,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":122,"flow_tot_l4_payload_len":156,"flow_avg_l4_payload_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":57816,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":2,"flow_first_seen":1430069022252,"flow_last_seen":1430069022295,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":82,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":25117,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1430069030557,"flow_last_seen":1430069030591,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":6,"midstream":1,"l3_proto":"ip4","src_ip":"31.13.68.73","dst_ip":"10.24.82.188","src_port":443,"dst_port":47007,"l4_proto":"tcp","ndpi": {"proto":"TLS.Facebook","breed":"Fun","category":"SocialNetwork"}}
00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1430069030557,"flow_last_seen":1430069030591,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":6,"midstream":1,"l3_proto":"ip4","src_ip":"31.13.68.73","dst_ip":"10.24.82.188","src_port":443,"dst_port":47007,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_first_seen":1430069022059,"flow_last_seen":1430069022094,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":12908,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":5,"flow_first_seen":1430069035398,"flow_last_seen":1430069048679,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":42332,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":5,"flow_first_seen":1430069035398,"flow_last_seen":1430069048679,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"210.103.240.15","src_port":42332,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_first_seen":1430069022006,"flow_last_seen":1430069022041,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":127,"flow_avg_l4_payload_len":63,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":35603,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":19,"flow_first_seen":1430069030751,"flow_last_seen":1430069031522,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1388,"flow_tot_l4_payload_len":6399,"flow_avg_l4_payload_len":336,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45209,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":29,"flow_first_seen":1430069031236,"flow_last_seen":1430069031782,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":7425,"flow_avg_l4_payload_len":256,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45211,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":28,"flow_first_seen":1430069035967,"flow_last_seen":1430069036831,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1280,"flow_tot_l4_payload_len":5965,"flow_avg_l4_payload_len":213,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"31.13.68.84","src_port":45213,"dst_port":443,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":14,"flow_first_seen":1430069026012,"flow_last_seen":1430069051765,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"216.58.221.10","dst_ip":"10.24.82.188","src_port":80,"dst_port":35922,"l4_proto":"tcp","ndpi": {"proto":"HTTP.Google","breed":"Tracker\/Ads","category":"Web"},"http": {}}
00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":14,"flow_first_seen":1430069026012,"flow_last_seen":1430069051765,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"216.58.221.10","dst_ip":"10.24.82.188","src_port":80,"dst_port":35922,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":18,"flow_first_seen":1430069044758,"flow_last_seen":1430069069274,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":1401,"flow_avg_l4_payload_len":77,"midstream":1,"l3_proto":"ip4","src_ip":"139.150.0.125","dst_ip":"10.24.82.188","src_port":443,"dst_port":46947,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":18,"flow_first_seen":1430069044758,"flow_last_seen":1430069069274,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":247,"flow_tot_l4_payload_len":1401,"flow_avg_l4_payload_len":77,"midstream":1,"l3_proto":"ip4","src_ip":"139.150.0.125","dst_ip":"10.24.82.188","src_port":443,"dst_port":46947,"l4_proto":"tcp","flow_datalink":113,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1430069022104,"flow_last_seen":1430069022234,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":117,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"10.188.1.1","src_port":9094,"dst_port":53,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":15}
00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":347,"source":"KakaoTalk_chat.pcap","alias":"nDPId-test"}