1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
00575{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4834-92507c0","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":7560000000,"max-packets-per-flow-to-send":5,"max-packets-per-flow-to-process":32,"max-packets-per-flow-to-analyse":32,"global_ts_usec":0}
00799{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4834-92507c0","packets-captured":1,"packets-processed":0,"pfring_active":false,"pfring_recv":0,"pfring_drop":0,"pfring_shunt":0,"total-skipped-flows":0,"total-l4-payload-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"global-alloc-count":0,"global-free-count":0,"global-alloc-bytes":0,"global-free-bytes":0,"total-events-serialized":2,"global_ts_usec":1598333619339961}
00786{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1598333619339961,"flow_src_last_pkt_time":1598333619339961,"flow_dst_last_pkt_time":1598333619339961,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1598333619339961,"l3_proto":"ip4","src_ip":"172.16.99.201","dst_ip":"64.227.107.71","src_port":1732,"dst_port":4444,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00553{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":1598333619339961,"flow_dst_last_pkt_time":1598333619339961,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1598333619339961,"pkt":"QM4kHluGABxCsmFuCABFAAA0Y\/NAAIAG2sysEGPJQONrRwbEEVy3KsGDAAAAAIAC+vAnTQAAAgQFtAEDAwgBAQQC"}
00552{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1598333619339961,"flow_dst_last_pkt_time":1598333619669445,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1598333619669445,"pkt":"ABxCsmFuQM4kHluGCABFAAA0AABAADAGjsBA42tHrBBjyRFcBsRoGQadtyrBhIASchBCMwAAAgQE6AEBBAIBAwMH"}
00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1598333619669726,"flow_dst_last_pkt_time":1598333619669445,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1598333619669726,"pkt":"QM4kHluGABxCsmFuCABFAAAoY\/RAAIAG2tesEGPJQONrRwbEEVy3KsGEaBkGnlAQBAHwSAAAAABAEX26"}
00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_src_last_pkt_time":1598333619669726,"flow_dst_last_pkt_time":1598333620067844,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_usec":1598333620067844,"pkt":"ABxCsmFuQM4kHluGCABFAAAsekVAADAGFINA42tHrBBjyRFcBsRoGQaetyrBhFAYAOWtqAAAQ7ACAA=="}
02231{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_src_last_pkt_time":1598333619669726,"flow_dst_last_pkt_time":1598333620067868,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1310,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1310,"pkt_l4_len":1276,"thread_ts_usec":1598333620067868,"pkt":"ABxCsmFuQM4kHluGCABFAAUQekZAADAGD55A42tHrBBjyRFcBsRoGQaityrBhFAQAOUlbwAATVroAAAAAFtSRVWJ5YHD1kIAAP\/TgcMjaQIAiTtTagRQ\/9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC7RahV\/yTGBv8kxgb\/JMYGuXUnBtskxga5dRkG6CTGBrl1JgZ8JMYG\/yTHBj0kxgb2XFUG7iTGBvZcRQb+JMYG8nYZBv4kxgbydiYG4yTGBvJ2Ggb+JMYG8nYYBv4kxgZSaWNo\/yTGBgAAAAAAAAAAAAAAAAAAAABQRQAATAEEADau9l4AAAAAAAAAAOAAAiELAQwAAPYBAADqAAAAAAAAFTkBAAAQAAAAEAIAAAAAEAAQAAAAAgAABQAAAAAAAAAEAAAAAAAAAAAQAwAABAAAcyQDAAIAAAEAABAAABAAAAAAEAAAEAAAAAAAABAAAADwVwIAVQAAAEhYAgC0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPACAFAXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBTAgBAAAAAAAAAAAAAAAAAEAIA9AIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAATPUBAAAQAAAA9gEAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAKpYAAAAEAIAAFoAAAD6AQAAAAAAAAAAAAAAAABAAABALmRhdGEAAABkdwAAAHACAABAAAAAVAIAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAUBcAAADwAgAAGAAAAJQCAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFWL7FaLdQhXM\/85PnQXi8ZQ6DwAAABHacekAAAAWQPGgzgAdetfXl3DVYvsVot1CFcz\/zk+dBeLxlDoaQAAAEdpx6QAAABZA8aDOAB1619eXcNVi+xWV7+kAAAAV+h15gAAi\/BZhfZ1BWoIWOs2V\/91CFbo+OYAAKGgrgIQg8QMhcB0C4mwoAAAAKGgrgIQg6agAAAAAImGnAAAADPAiTWgrgIQX15dw1WL7FNWizWgrgIQu5AEAABXM\/\/rGotFCP82\/zDo9+wAAFlZhcB0Dov+i7acAAAAhfZ14uswi4acAAAAhf90CIk="}
00785{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":16,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1598333690845829,"flow_src_last_pkt_time":1598333690845829,"flow_dst_last_pkt_time":1598333690845829,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1598333690845829,"l3_proto":"ip4","src_ip":"64.227.107.71","dst_ip":"172.16.99.10","src_port":53,"dst_port":49652,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00554{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_src_last_pkt_time":1598333690845829,"flow_dst_last_pkt_time":1598333690845829,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1598333690845829,"pkt":"ABxCyWFDQM4kHluGCABFAAA0AABAADAGj39A42tHrBBjCgA1wfTp\/DSwRxCtioBSchBsxgAAAgQE6AEBBAIBAwMH"}
00545{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_src_last_pkt_time":1598333690845829,"flow_dst_last_pkt_time":1598333690846093,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1598333690846093,"pkt":"QM4kHluGABxCyWFDCABFAAAoT9dAAIAG77OsEGMKQONrR8H0ADVHEK2K6fw0sVAQAQQeGQAAid26AQAA"}
00546{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_src_last_pkt_time":1598333691208416,"flow_dst_last_pkt_time":1598333690846093,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":58,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":58,"pkt_l4_len":24,"thread_ts_usec":1598333691208416,"pkt":"ABxCyWFDQM4kHluGCABFAgAs9u9AADAGmJVA42tHrBBjCgA1wfTp\/DSxRxCtilAYAOXYewAAQ7ACAA=="}
02233{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_src_last_pkt_time":1598333691210768,"flow_dst_last_pkt_time":1598333690846093,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1310,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1310,"pkt_l4_len":1276,"thread_ts_usec":1598333691210768,"pkt":"ABxCyWFDQM4kHluGCABFAgUQ9vBAADAGk7BA42tHrBBjCgA1wfTp\/DS1RxCtilAQAOVQQgAATVroAAAAAFtSRVWJ5YHD1kIAAP\/TgcMjaQIAiTtTagRQ\/9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC7RahV\/yTGBv8kxgb\/JMYGuXUnBtskxga5dRkG6CTGBrl1JgZ8JMYG\/yTHBj0kxgb2XFUG7iTGBvZcRQb+JMYG8nYZBv4kxgbydiYG4yTGBvJ2Ggb+JMYG8nYYBv4kxgZSaWNo\/yTGBgAAAAAAAAAAAAAAAAAAAABQRQAATAEEADau9l4AAAAAAAAAAOAAAiELAQwAAPYBAADqAAAAAAAAFTkBAAAQAAAAEAIAAAAAEAAQAAAAAgAABQAAAAAAAAAEAAAAAAAAAAAQAwAABAAAcyQDAAIAAAEAABAAABAAAAAAEAAAEAAAAAAAABAAAADwVwIAVQAAAEhYAgC0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPACAFAXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBTAgBAAAAAAAAAAAAAAAAAEAIA9AIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAATPUBAAAQAAAA9gEAAAQAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAKpYAAAAEAIAAFoAAAD6AQAAAAAAAAAAAAAAAABAAABALmRhdGEAAABkdwAAAHACAABAAAAAVAIAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAAUBcAAADwAgAAGAAAAJQCAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFWL7FaLdQhXM\/85PnQXi8ZQ6DwAAABHacekAAAAWQPGgzgAdetfXl3DVYvsVot1CFcz\/zk+dBeLxlDoaQAAAEdpx6QAAABZA8aDOAB1619eXcNVi+xWV7+kAAAAV+h15gAAi\/BZhfZ1BWoIWOs2V\/91CFbo+OYAAKGgrgIQg8QMhcB0C4mwoAAAAKGgrgIQg6agAAAAAImGnAAAADPAiTWgrgIQX15dw1WL7FNWizWgrgIQu5AEAABXM\/\/rGotFCP82\/zDo9+wAAFlZhcB0Dov+i7acAAAAhfZ14uswi4acAAAAhf90CIk="}
02259{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_src_last_pkt_time":1598333691210789,"flow_dst_last_pkt_time":1598333690846093,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":1310,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1310,"pkt_l4_len":1276,"thread_ts_usec":1598333691210789,"pkt":"ABxCyWFDQM4kHluGCABFAgUQ9vFAADAGk69A42tHrBBjCgA1wfTp\/DmdRxCtilAQAOWiWwAAh5wAAADrBaOgrgIQi4acAAAAhcB0Bom4oAAAAFboleUAAFkz219ei8NbXcPrGmoA\/zWkrgIQ6LM5AABZWYXAdAdQ6BOOAABZ\/zWkrgIQ6HI5AABZhcB11sNVi+yD7BBXi30MjUXwUGgBAAEAV8dF\/AEAAADoASoAAIPEDIXAD4WyAAAAU1aLdfhW6FYDAABWi9jolgMAAIvwWVmF23U1hfZ1QlfobiUAAFk5Xyx0EmoyaAQAAgBQ6E4nAACDxAzrc1D\/dQhqMujnKwAAV+j4JQAA611XU+hpAAAAWVmFwHVChfZ0DVdW6FgAAABZWYXAdTGDfywAdStqCOjw5AAAUFf\/dQiJGGgREwAQiXAE6E6MAACDxBSFwHQaUOjqjAAAWesRV\/91CFZT6I0BAACJRfyDxBBeW4tF\/F+L5V3DM8DDM8DDVYvs\/3UM6PIoAAAz0lmLTQgrwnQUSHQIg+gJdAxIdQU5UVR1CTPAXcM5UQh08jPAQF3DVYvsg+wUVlf\/dQzouigAAFkzyYv5g\/gBdA2D+At0CItFCIPABOsGi0UIg8BQiUX8i\/GNReyJTfhQUVHrXoX\/dWmLRfyLQEiFwHQTJf\/\/\/w878HUK98YAAAAQdE4z9o1F7FD\/dQzocSgAAFlZPQAAAQB1GY1F7FDoLSgAAFmFwHQLi0X8aldfO3BIch6LRfiNTexRRkBqAIlF+FD\/dQzooygAAIPEEIXAdJOLx19ei+Vdw1WL7FaLdQiF9nUFagZY631Ti14Qhdt1BGoG6wyLRhSJRQiFwHUFag1Y62FXi34Yhf91BGoN6xmhpK4CEIXAdRPo0TYAAKOkrgIQhcB1BWoGWOs4VlDoAjgAAP91CFP\/dwT\/N+gqAAAAVv81pK4CEOjxNwAAg8QghcB0B1bozosAAFlX6AbjAABZM8BfW15dwgQAaihoYFQCEOih6gAAx0XkAQAAAItFCIlF1ItFDIlF2INl\/AAz24t1FIld4IP7Ag+DkwAAAIt8ndSF\/w+EgQAAAItFEItIIDlIHHQHUf8VSBACEFZX6GP+\/\/9ZWYXAdWJW6CEnAABZiUXci8iD6QB0G0l0CIPpCXQTSXVGi0dUhcB1EFb\/dRD\/V1DrMYtHCIXAdCONTQhRVv91EP\/Qg8QMhcB0C4N95AB0BTPAQOsCM8CJReTrDFb\/dRD\/VwRZiUUIWUPpYf\/\/\/41FyFBoAgABAFbo6SYAAIPEDItNCIXAD0RN0ItF3IP4AXQFg\/gLdRGFyXQNUVb\/dRDoxSoAAIPEDINN\/P\/rDjPAQMOLZeiDTfz\/i3UUg34sAHUHVujvIgAAWYtF5Oi\/6QAAw1WL7FYz9lc5NRBwAhB0Kb8QcAIQi8f\/dQj\/MOjT6AAAWVmFwHQYRmnGpAAAAI2AEHACEIM4AHXeM8BfXl3DacakAAAAA8fr8lWL7FaLNaCuAhDrFv91CP826JXoAABZWYXAdA+LtpwAAACF9nXmM8BeXcOLxuv5VYvsahBqAehx6gAAWVmLTQyJAYXAdQVqDlhdw4tFCMcAEAAAADPAXcNVi+yB7DAEAACDZfwAU1aLdQxXaK8BAQBWx0XsCAAAAOhbJgAAaLIBAgBWi9jolyYAAIv4aLEBAgBWiX3o6IcmAABotwECAFaJRfDoeSYAAGi4AQIAVolF+OhrJgAAg8Qoi8g="}
01107{"flow_event_id":9,"flow_event_name":"not-detected","thread_id":0,"packet_id":30,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1598333619339961,"flow_src_last_pkt_time":1598333620073445,"flow_dst_last_pkt_time":1598333620073297,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":1256,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":11308,"midstream":0,"thread_ts_usec":1598333691211662,"l3_proto":"ip4","src_ip":"172.16.99.201","dst_ip":"64.227.107.71","src_port":1732,"dst_port":4444,"l4_proto":"tcp","ndpi": {"flow_risk": {"4": {"risk":"Binary App Transfer","severity":"Severe","risk_score": {"total":150,"client":135,"server":15}},"35": {"risk":"Susp Entropy","severity":"Low","risk_score": {"total":210,"client":165,"server":45}}},"proto":"Unknown","proto_id":"0","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Unrated"}}
00796{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":11,"flow_first_seen":1598333619339961,"flow_src_last_pkt_time":1598333620073445,"flow_dst_last_pkt_time":1598333620073297,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":1256,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":11308,"midstream":0,"thread_ts_usec":1598333691211662,"l3_proto":"ip4","src_ip":"172.16.99.201","dst_ip":"64.227.107.71","src_port":1732,"dst_port":4444,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
01395{"flow_event_id":6,"flow_event_name":"guessed","thread_id":0,"packet_id":30,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":11,"flow_dst_packets_processed":4,"flow_first_seen":1598333690845829,"flow_src_last_pkt_time":1598333691211618,"flow_dst_last_pkt_time":1598333691211662,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1256,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":11308,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1598333691211662,"l3_proto":"ip4","src_ip":"64.227.107.71","dst_ip":"172.16.99.10","src_port":53,"dst_port":49652,"l4_proto":"tcp","ndpi": {"flow_risk": {"4": {"risk":"Binary App Transfer","severity":"Severe","risk_score": {"total":150,"client":135,"server":15}},"17": {"risk":"Malformed Packet","severity":"Low","risk_score": {"total":160,"client":80,"server":80}},"35": {"risk":"Susp Entropy","severity":"Low","risk_score": {"total":210,"client":165,"server":45}}},"confidence": {"1":"Match by port"},"proto":"DNS","proto_id":"5","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":14,"category":"Network","hostname":"","dns": {"num_queries":0,"num_answers":0,"reply_code":0,"query_type":0,"rsp_type":0,"rsp_addr":"0.0.0.0"}}}
00794{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":11,"flow_dst_packets_processed":4,"flow_first_seen":1598333690845829,"flow_src_last_pkt_time":1598333691211618,"flow_dst_last_pkt_time":1598333691211662,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1256,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":11308,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1598333691211662,"l3_proto":"ip4","src_ip":"64.227.107.71","dst_ip":"172.16.99.10","src_port":53,"dst_port":49652,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00809{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"cfgs\/default\/pcap\/portable_executable.pcap","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4834-92507c0","packets-captured":30,"packets-processed":30,"pfring_active":false,"pfring_recv":0,"pfring_drop":0,"pfring_shunt":0,"total-skipped-flows":0,"total-l4-payload-len":22616,"total-not-detected-flows":1,"total-guessed-flows":1,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"global-alloc-count":0,"global-free-count":0,"global-alloc-bytes":0,"global-free-bytes":0,"total-events-serialized":19,"global_ts_usec":1598333691211662}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 30/30
~~ skipped flows.............: 0
~~ total layer4 data length..: 22616 bytes
~~ total detected protocols..: 0
~~ total active/idle flows...: 2/2
~~ total timeout flows.......: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 6648741 bytes
~~ total memory freed........: 6648741 bytes
~~ total allocations/frees...: 114068/114068
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json message min len.......: 549 chars
~~ json message max len.......: 2264 chars
~~ json message avg len.......: 1405 chars
|