1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
00561{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":7560000000,"max-packets-per-flow-to-send":5,"max-packets-per-flow-to-process":32,"max-packets-per-flow-to-analyse":32,"global_ts_usec":0}
00624{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-payload-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_usec":1614768020788858}
00765{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1614768020789512,"flow_src_last_pkt_time":1614768020789512,"flow_dst_last_pkt_time":1614768020789512,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020789512,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":1614768020789512,"flow_dst_last_pkt_time":1614768020789512,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020789512,"pkt":"5kBKB+riApXG95NLCABFAAAwnOsAAIAGAAAKZQACCmYAAiIWA4SwjQfnAAAAAHACgAEU8QAAAgQFtAMDAQA="}
00534{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1614768020789512,"flow_dst_last_pkt_time":1614768020790963,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020790963,"pkt":"ApXG95NL5kBKB+riCABFAAAwnN4AAH8GihsKZgACCmUAAgOEIhawjRxgsI0H6HASgAFEQgAAAgQFtAMDAQA="}
00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1614768020790969,"flow_dst_last_pkt_time":1614768020790963,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1614768020790969,"pkt":"5kBKB+riApXG95NLCABFAAAonOwAAIAGAAAKZQACCmYAAiIWA4SwjQfosI0cYVAQgAEU6QAAAAAAAAAA"}
00885{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_src_last_pkt_time":1614768020790989,"flow_dst_last_pkt_time":1614768020790963,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":322,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":322,"pkt_l4_len":288,"thread_ts_usec":1614768020790989,"pkt":"5kBKB+riApXG95NLCABFAAE0nO0AAIAGAAAKZQACCmYAAiIWA4SwjQfosI0cYVAYgAEV9QAAR0lPUAEAAAAAAAEAAAAAAwAAABEAAAACAAIAAE5FTwAAAAACABQAAAAAAAYAAACuAAAAAAAAAChJREw6b21nLm9yZy9TZW5kaW5nQ29udGV4dC9Db2RlQmFzZToxLjAAAAAAAQAAAAAAAAByAAECAAAAAA8xOTIuMTY4LjEwLjIwOAAAws8AAAAAABmvq8sAAAAAAgM1RmIAAAAIAAAAAAAAAAAUAAAAAAAAAgAAAAEAAAAgAAAAAAABAAEAAAACBQEAAQABACAAAQEJAAAAAQABAQAAAAAmAAAAAgACAAAAAAAFAQAAAAAAAARJTklUAAAABGdldAAAAAAAAAAADE5hbWVTZXJ2aWNlAA=="}
00916{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1614768020789512,"flow_src_last_pkt_time":1614768020790989,"flow_dst_last_pkt_time":1614768020790963,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":268,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":268,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020790989,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
01185{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_src_last_pkt_time":1614768020790989,"flow_dst_last_pkt_time":1614768020792073,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":548,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":548,"pkt_l4_len":514,"thread_ts_usec":1614768020792073,"pkt":"ApXG95NL5kBKB+riCABFAAIWnN8AAH8GiDQKZgACCmUAAgOEIhawjRxhsI0I9FAYgAHIawAAR0lPUAEAAAEAAAHiAAAAAk5FTwAAAAACABQAAAAAAAYAAADSAAAAAAAAAChJREw6b21nLm9yZy9TZW5kaW5nQ29udGV4dC9Db2RlQmFzZToxLjAAAAAAAQAAAAAAAACWAAECAAAAAA8xOTIuMTY4LjEwLjExMAAABBkAAAAAABmvq8sAAAAAAgAAA+gAAAAIAAAAAgAAAAAUAAAAAAAAAwAAAAEAAAAgAAAAAAABAAEAAAACBQEAAQABACAAAQEJAAAAAQABAQAAAAAmAAAAAgACAAAAAAADAAAAGgAAAAAAAAAPMTkyLjE2OC4xMC4xMTAAAAOEAAAAAAAFAAAAAAAAAChJREw6b21nLm9yZy9Db3NOYW1pbmcvTmFtaW5nQ29udGV4dDoxLjAAAAAAAQAAAAAAAAC2AAECAAAAAA8xOTIuMTY4LjEwLjExMAAABBkAAAAAADyvq8sAAAAAIgAAA+gAAAABAAAAAAAAAAIAAAAIUm9vdFBPQQAAAAAMTmFtZVNlcnZpY2UAAAAAA05DMBQAAAADAAAAAQAAACAAAAAAAAEAAQAAAAIFAQABAAEAIAABAQkAAAABAAEBAAAAACYAAAACAAIAAAAAAAMAAAAaAAAAAAAAAA8xOTIuMTY4LjEwLjExMAAAA4Q="}
00767{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1614768020792107,"flow_src_last_pkt_time":1614768020792107,"flow_dst_last_pkt_time":1614768020792107,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020792107,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_src_last_pkt_time":1614768020792107,"flow_dst_last_pkt_time":1614768020792107,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020792107,"pkt":"5kBKB+riApXG95NLCABFAAAwnO8AAIAGAAAKZQACCmYAAiIXBBmwjThoAAAAAHACgAEU8QAAAgQFtAMDAQA="}
00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_src_last_pkt_time":1614768020792107,"flow_dst_last_pkt_time":1614768020793092,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020793092,"pkt":"ApXG95NL5kBKB+riCABFAAAwnOEAAH8GihgKZgACCmUAAgQZIhewjUFJsI04aXASgAHuQQAAAgQFtAMDAQA="}
00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_src_last_pkt_time":1614768020793094,"flow_dst_last_pkt_time":1614768020793092,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1614768020793094,"pkt":"5kBKB+riApXG95NLCABFAAAonPAAAIAGAAAKZQACCmYAAiIXBBmwjThpsI1BSlAQgAEU6QAAAAAAAAAA"}
01038{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_src_last_pkt_time":1614768020793098,"flow_dst_last_pkt_time":1614768020793092,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":437,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":437,"pkt_l4_len":403,"thread_ts_usec":1614768020793098,"pkt":"5kBKB+riApXG95NLCABFAAGnnPEAAIAGAAAKZQACCmYAAiIXBBmwjThpsI1BSlAYgAEWaAAAR0lPUAECAAAAAAFzAAAABQMAAAAAAAACAAAAPK+rywAAAAAiAAAD6AAAAAEAAAAAAAAAAgAAAAhSb290UE9BAAAAAAxOYW1lU2VydmljZQAAAAADTkMwFAAAAAZfaXNfYQAAAQAAAAQAAAARAAAAAgACAA8AAAABAAAADAAAAAAAAQABAAEBCU5FTwAAAAACABQAAgAAAAYAAACuAAAAAAAAAChJREw6b21nLm9yZy9TZW5kaW5nQ29udGV4dC9Db2RlQmFzZToxLjAAAAAAAQAAAAAAAAByAAECAAAAAA8xOTIuMTY4LjEwLjIwOAAAws8AAAAAABmvq8sAAAAAAgM1RmIAAAAIAAAAAAAAAAAUAAAAAAAAAgAAAAEAAAAgAAAAAAABAAEAAAACBQEAAQABACAAAQEJAAAAAQABAQAAAAAmAAAAAgACAAAAAAAAAAAAK0lETDpvbWcub3JnL0Nvc05hbWluZy9OYW1pbmdDb250ZXh0RXh0OjEuMAA="}
00918{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1614768020792107,"flow_src_last_pkt_time":1614768020793098,"flow_dst_last_pkt_time":1614768020793092,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":383,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":383,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020793098,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
00870{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_src_last_pkt_time":1614768020793098,"flow_dst_last_pkt_time":1614768020793906,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":311,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":311,"pkt_l4_len":277,"thread_ts_usec":1614768020793906,"pkt":"ApXG95NL5kBKB+riCABFAAEpnOIAAH8GiR4KZgACCmUAAgQZIhewjUFKsI056FAYgAEiDAAAR0lPUAECAAEAAAD1AAAABQAAAAAAAAACTkVPAAAAAAIAFADSAAAABgAAANIAAAAAAAAAKElETDpvbWcub3JnL1NlbmRpbmdDb250ZXh0L0NvZGVCYXNlOjEuMAAAAAABAAAAAAAAAJYAAQIAAAAADzE5Mi4xNjguMTAuMTEwAAAEGQAAAAAAGa+rywAAAAACAAAD6AAAAAgAAAACAAAAABQAAAAAAAADAAAAAQAAACAAAAAAAAEAAQAAAAIFAQABAAEAIAABAQkAAAABAAEBAAAAACYAAAACAAIAAAAAAAMAAAAaAAAAAAAAAA8xOTIuMTY4LjEwLjExMAAAA4QAAAE="}
00768{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1614768020794508,"flow_src_last_pkt_time":1614768020794508,"flow_dst_last_pkt_time":1614768020794508,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020794508,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_src_last_pkt_time":1614768020794508,"flow_dst_last_pkt_time":1614768020794508,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020794508,"pkt":"5kBKB+riApXG95NLCABFAAAwnPQAAIAGAAAKZQACCmYAAiIY7wewjV4NAAAAAHACgAEU8QAAAgQFtAMDAQA="}
00535{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_src_last_pkt_time":1614768020794508,"flow_dst_last_pkt_time":1614768020795311,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"thread_ts_usec":1614768020795311,"pkt":"ApXG95NL5kBKB+riCABFAAAwnOUAAH8GihQKZgACCmUAAu8HIhiwjWV0sI1eDnASgAG5gQAAAgQFtAMDAQA="}
00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_src_last_pkt_time":1614768020795313,"flow_dst_last_pkt_time":1614768020795311,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1614768020795313,"pkt":"5kBKB+riApXG95NLCABFAAAonPUAAIAGAAAKZQACCmYAAiIY7wewjV4OsI1ldVAQgAEU6QAAAAAAAAAA"}
00958{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_src_last_pkt_time":1614768020795316,"flow_dst_last_pkt_time":1614768020795311,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":376,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":376,"pkt_l4_len":342,"thread_ts_usec":1614768020795316,"pkt":"5kBKB+riApXG95NLCABFAAFqnPYAAIAGAAAKZQACCmYAAiIY7wewjV4OsI1ldVAYgAEWKwAAR0lPUAECAAAAAAE2AAAABQMAAAAAAAACAAAAMa+rywAAAAAgAy2q8AAAAAEAAAAAAAAAAQAAAAhSb290UE9BAAAAAAgAAAABAAAAABRjZQAAAAAIZ2V0X21zZwAAAAAEAAAAEQAAAAIAAgARAAAAAQAAAAwAAAAAAAEAAQABAQlORU8AAAAAAgAUTwAAAAAGAAAArgAAAAAAAAAoSURMOm9tZy5vcmcvU2VuZGluZ0NvbnRleHQvQ29kZUJhc2U6MS4wAAAAAAEAAAAAAAAAcgABAgAAAAAPMTkyLjE2OC4xMC4yMDgAAMLPAAAAAAAZr6vLAAAAAAIDNUZiAAAACAAAAAAAAAAAFAAAAAAAAAIAAAABAAAAIAAAAAAAAQABAAAAAgUBAAEAAQAgAAEBCQAAAAEAAQEAAAAAJgAAAAIAAg=="}
00919{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":23,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1614768020794508,"flow_src_last_pkt_time":1614768020795316,"flow_dst_last_pkt_time":1614768020795311,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":322,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":322,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1614768020795316,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
00882{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":5,"flow_src_last_pkt_time":1614768020795316,"flow_dst_last_pkt_time":1614768020795900,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":320,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":320,"pkt_l4_len":286,"thread_ts_usec":1614768020795900,"pkt":"ApXG95NL5kBKB+riCABFAAEynOYAAH8GiREKZgACCmUAAu8HIhiwjWV1sI1fUFAYgAHWKgAAR0lPUAECAAEAAAD+AAAABQAAAAAAAAACTkVPAAAAAAIAFAAAAAAABgAAAK4AAAAAAAAAKElETDpvbWcub3JnL1NlbmRpbmdDb250ZXh0L0NvZGVCYXNlOjEuMAAAAAABAAAAAAAAAHIAAQIAAAAADzE5Mi4xNjguMTAuMTEwAADvBwAAAAAAGa+rywAAAAACAy2q8AAAAAgAAAAAAAAAABQAAAAAAAACAAAAAQAAACAAAAAAAAEAAQAAAAIFAQABAAEAIAABAQkAAAABAAEBAAAAACYAAAACAAIAAAAAAAAAAAAmSGVsbG8gd29ybGQhIG15IHRpbWUgaXM6IDExOjMzOjE2OjcyOAA="}
00959{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":3,"flow_first_seen":1614768020789512,"flow_src_last_pkt_time":1614768020792090,"flow_dst_last_pkt_time":1614768020792457,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":268,"flow_dst_max_l4_payload_len":494,"flow_src_tot_l4_payload_len":268,"flow_dst_tot_l4_payload_len":494,"midstream":0,"thread_ts_usec":1614768020795904,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8726,"dst_port":900,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
00960{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":5,"flow_dst_packets_processed":4,"flow_first_seen":1614768020792107,"flow_src_last_pkt_time":1614768020794502,"flow_dst_last_pkt_time":1614768020794733,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":383,"flow_dst_max_l4_payload_len":257,"flow_src_tot_l4_payload_len":564,"flow_dst_tot_l4_payload_len":483,"midstream":0,"thread_ts_usec":1614768020795904,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8727,"dst_port":1049,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
00961{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":25,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","flow_id":3,"flow_state":"finished","flow_src_packets_processed":4,"flow_dst_packets_processed":2,"flow_first_seen":1614768020794508,"flow_src_last_pkt_time":1614768020795904,"flow_dst_last_pkt_time":1614768020795900,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":322,"flow_dst_max_l4_payload_len":266,"flow_src_tot_l4_payload_len":322,"flow_dst_tot_l4_payload_len":266,"midstream":0,"thread_ts_usec":1614768020795904,"l3_proto":"ip4","src_ip":"10.101.0.2","dst_ip":"10.102.0.2","src_port":8728,"dst_port":61191,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"Corba","proto_id":"168","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":16,"category":"RPC"}}
00633{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":25,"source":"cfgs\/default\/pcap\/corba.pcap","alias":"nDPId-test","version":"1.5.0","ndpi_version":"4.9.0-4361-0db12b13","packets-captured":25,"packets-processed":22,"total-skipped-flows":0,"total-l4-payload-len":2397,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":27,"global_ts_usec":1614768020795904}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 25/22
~~ skipped flows.............: 0
~~ total layer4 data length..: 2397 bytes
~~ total detected protocols..: 3
~~ total active/idle flows...: 3/3
~~ total timeout flows.......: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 11486418 bytes
~~ total memory freed........: 11486418 bytes
~~ total allocations/frees...: 216672/216672
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json string min len.......: 535 chars
~~ json string max len.......: 1190 chars
~~ json string avg len.......: 861 chars
|