1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
00610{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4976-59ee1fe","ndpi_api_version":11619,"size_per_flow":1408,"max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":7560000000,"max-packets-per-flow-to-send":5,"max-packets-per-flow-to-process":32,"max-packets-per-flow-to-analyse":32,"global_ts_usec":0}
00834{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4976-59ee1fe","ndpi_api_version":11619,"size_per_flow":1408,"packets-captured":1,"packets-processed":0,"pfring_active":false,"pfring_recv":0,"pfring_drop":0,"pfring_shunt":0,"total-skipped-flows":0,"total-l4-payload-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"global-alloc-count":0,"global-free-count":0,"global-alloc-bytes":0,"global-free-bytes":0,"total-events-serialized":2,"global_ts_usec":1731420396936795}
00774{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1731420396936795,"flow_src_last_pkt_time":1731420396936795,"flow_dst_last_pkt_time":1731420396936795,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731420396936795,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"2.23.155.106","src_port":46892,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00555{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":1731420396936795,"flow_dst_last_pkt_time":1731420396936795,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1731420396936795,"pkt":"dNo47VMyYhO2esBpCABFAAA8cxdAAEAGXTjAqAxDAhebarcsAbva3WCRAAAAAKAC\/\/8PbAAAAgQFtAQCCAowkKk+AAAAAAEDAwk="}
00554{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1731420396936795,"flow_dst_last_pkt_time":1731420396938623,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1731420396938623,"pkt":"YhO2esBpdNo47VMyCABFAAA8AABAADYG2k8CF5tqwKgMQwG7tyw6TIb02t1gkqAS\/oh6cgAAAgQFaAQCCArMawkBMJCpPgEDAwc="}
00542{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1731420396940464,"flow_dst_last_pkt_time":1731420396938623,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1731420396940464,"pkt":"dNo47VMyYhO2esBpCABFAAA0cxhAAEAGXT\/AqAxDAhebarcsAbva3WCSOkyG9YAQAKymygAAAQEICjCQqUPMawkB"}
01238{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_src_last_pkt_time":1731420396955865,"flow_dst_last_pkt_time":1731420396938623,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"thread_ts_usec":1731420396955865,"pkt":"dNo47VMyYhO2esBpCABFAAI5cxlAAEAGWznAqAxDAhebarcsAbva3WCSOkyG9YAYAKymUQAAAQEICjCQqVHMawkBFgMBAgABAAH8AwNCffeD+K2cUK4j5RgMvcl79ueCaJQ7pg9OgWHZMC5IYiDxnoKw55RCtQbS+vq+GdnMBrQWNTa5DPMGZny4XrhSeQAeEwETAhMDwCvALMypwC\/AMMyowBPAFACcAJ0ALwA1AQABlQAAABIAEAAADWltZy5zaGVpbi5jb20AFwAA\/wEAAQAACgAIAAYAHQAXABgACwACAQAAIwAAABAADgAMAmgyCGh0dHAvMS4xAAUABQEAAAAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBADMAJgAkAB0AIK4zAy8E8JUwWPGSr1OkypoqibRb+3gAeRNNeIeRFp44AC0AAgEBACsABQQDBAMDABUA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
01258{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1731420396936795,"flow_src_last_pkt_time":1731420396955865,"flow_dst_last_pkt_time":1731420396938623,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731420396955865,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"2.23.155.106","src_port":46892,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Shein","proto_id":"91.434","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"img.shein.com","domainame":"img.shein.com","tls": {"version":"TLSv1.2","ja3":"f79b6bad2ad0641e1921aef10262856b","ja3s":"","ja4":"t13d1513h2_8daaf6152771_eca864cca44a","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","blocks":0}}}
00541{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_src_last_pkt_time":1731420396955865,"flow_dst_last_pkt_time":1731420396958564,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1731420396958564,"pkt":"YhO2esBpdNo47VMyCABFAAA0y81AADYGDooCF5tqwKgMQwG7tyw6TIb12t1il4AQAfqjVgAAAQEICsxrCRQwkKlR"}
01303{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":3,"flow_first_seen":1731420396936795,"flow_src_last_pkt_time":1731420396955865,"flow_dst_last_pkt_time":1731420396959572,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1448,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":1448,"midstream":0,"thread_ts_usec":1731420396959572,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"2.23.155.106","src_port":46892,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Shein","proto_id":"91.434","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"img.shein.com","domainame":"img.shein.com","tls": {"version":"TLSv1.3","ja3":"f79b6bad2ad0641e1921aef10262856b","ja3s":"15af977ce25de452b96affa2addb1036","ja4":"t13d1513h2_8daaf6152771_eca864cca44a","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2","blocks":0}}}
00841{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":14,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4976-59ee1fe","ndpi_api_version":11619,"size_per_flow":1408,"packets-captured":14,"packets-processed":13,"pfring_active":false,"pfring_recv":0,"pfring_drop":0,"pfring_shunt":0,"total-skipped-flows":0,"total-l4-payload-len":4206,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":1,"total-updates":0,"current-active-flows":1,"total-active-flows":1,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"global-alloc-count":0,"global-free-count":0,"global-alloc-bytes":0,"global-free-bytes":0,"total-events-serialized":11,"global_ts_usec":1731423286975849}
00772{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":14,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1731423286975849,"flow_src_last_pkt_time":1731423286975849,"flow_dst_last_pkt_time":1731423286975849,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731423286975849,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"20.15.0.9","src_port":47694,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00556{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_src_last_pkt_time":1731423286975849,"flow_dst_last_pkt_time":1731423286975849,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1731423286975849,"pkt":"dNo47VMyYhO2esBpCABFAAA8ewVAAEAG3rPAqAxDFA8ACbpOAbsf3889AAAAAKAC\/\/9A2gAAAgQFtAQCCAoqw1A3AAAAAAEDAwk="}
00544{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_src_last_pkt_time":1731423286975849,"flow_dst_last_pkt_time":1731423287023947,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1731423287023947,"pkt":"YhO2esBpdNo47VMyCABFAAA0AABAACoGb8EUDwAJwKgMQwG7uk5XA\/aIH9\/PPoASfXgX0AAAAgQFtAEBBAIBAwMJ"}
00526{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_src_last_pkt_time":1731423287027055,"flow_dst_last_pkt_time":1731423287023947,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_usec":1731423287027055,"pkt":"dNo47VMyYhO2esBpCABFAAAoewZAAEAG3sbAqAxDFA8ACbpOAbsf388+VwP2iVAQAKzVcAAA"}
01224{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_src_last_pkt_time":1731423287035927,"flow_dst_last_pkt_time":1731423287023947,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_usec":1731423287035927,"pkt":"dNo47VMyYhO2esBpCABFAAItewdAAEAG3MDAqAxDFA8ACbpOAbsf388+VwP2iVAYAKy6BwAAFgMBAgABAAH8AwNVTcYuphR7nVMZrFFOtjb5WGTkfyNm5qfgQFVSDYKoJyBUxOeRDHijR+7t6G+Py3wpF+fbEGTlwB4myA8Zo3BezAAiEwETAhMDwCvAL8AswDDMqcyowAnAE8AKwBQAnACdAC8ANQEAAZEAAAARAA8AAAxndG0udGVtdS5jb20AFwAA\/wEAAQAACgAIAAYAHQAXABgACwACAQAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEAMwAmACQAHQAgQOQLGZ\/lDN\/pNE+wvKk5GPImFEUpXxL+6hEL3I7cEzoALQACAQEAKwAJCAMEAwMDAgMBABUA7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
01267{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":17,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1731423286975849,"flow_src_last_pkt_time":1731423287035927,"flow_dst_last_pkt_time":1731423287023947,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731423287035927,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"20.15.0.9","src_port":47694,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Temu","proto_id":"91.435","proto_by_ip":"Azure","proto_by_ip_id":276,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"gtm.temu.com","domainame":"gtm.temu.com","tls": {"version":"TLSv1.2","ja3":"92768199641a57091d8ad9085387a16f","ja3s":"","ja4":"t13d1712h2_5b57614c22b0_3f5d972527c0","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","blocks":0}}}
01225{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_packet_id":5,"flow_src_last_pkt_time":1731423287318655,"flow_dst_last_pkt_time":1731423287023947,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_usec":1731423287318655,"pkt":"dNo47VMyYhO2esBpCABFAAItewhAAEAG3L\/AqAxDFA8ACbpOAbsf388+VwP2iVAYAKy6BwAAFgMBAgABAAH8AwNVTcYuphR7nVMZrFFOtjb5WGTkfyNm5qfgQFVSDYKoJyBUxOeRDHijR+7t6G+Py3wpF+fbEGTlwB4myA8Zo3BezAAiEwETAhMDwCvAL8AswDDMqcyowAnAE8AKwBQAnACdAC8ANQEAAZEAAAARAA8AAAxndG0udGVtdS5jb20AFwAA\/wEAAQAACgAIAAYAHQAXABgACwACAQAAEAAOAAwCaDIIaHR0cC8xLjEABQAFAQAAAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEAMwAmACQAHQAgQOQLGZ\/lDN\/pNE+wvKk5GPImFEUpXxL+6hEL3I7cEzoALQACAQEAKwAJCAMEAwMDAgMBABUA7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
01313{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":20,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":4,"flow_dst_packets_processed":3,"flow_first_seen":1731423286975849,"flow_src_last_pkt_time":1731423287318655,"flow_dst_last_pkt_time":1731423287367502,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":1034,"flow_dst_tot_l4_payload_len":1460,"midstream":0,"thread_ts_usec":1731423287367502,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"20.15.0.9","src_port":47694,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Temu","proto_id":"91.435","proto_by_ip":"Azure","proto_by_ip_id":276,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"gtm.temu.com","domainame":"gtm.temu.com","tls": {"version":"TLSv1.3","ja3":"92768199641a57091d8ad9085387a16f","ja3s":"15af977ce25de452b96affa2addb1036","ja4":"t13d1712h2_5b57614c22b0_3f5d972527c0","unsafe_cipher":0,"cipher":"TLS_AES_256_GCM_SHA384","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","blocks":0}}}
00776{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":34,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1731423358197032,"flow_src_last_pkt_time":1731423358197032,"flow_dst_last_pkt_time":1731423358197032,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731423358197032,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"59.82.122.224","src_port":43446,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
00556{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_src_last_pkt_time":1731423358197032,"flow_dst_last_pkt_time":1731423358197032,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1731423358197032,"pkt":"dNo47VMyYhO2esBpCABFAAA81l1AAEAG4UDAqAxDO1J64Km2AbsJp6rRAAAAAKAC\/\/+JpQAAAgQFtAQCCArBDhpCAAAAAAEDAwk="}
00542{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_src_last_pkt_time":1731423358197032,"flow_dst_last_pkt_time":1731423358446960,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1731423358446960,"pkt":"YhO2esBpdNo47VMyCABFAAA0fUEAACsGj2U7UnrgwKgMQwG7qbZPQaeACaeq0oASchAjOAAAAgQFoAEBBAIBAwMJ"}
00526{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":3,"flow_src_last_pkt_time":1731423358450187,"flow_dst_last_pkt_time":1731423358446960,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_usec":1731423358450187,"pkt":"dNo47VMyYhO2esBpCABFAAAo1l5AAEAG4VPAqAxDO1J64Km2AbsJp6rST0GngVAQAKzVXAAA"}
01225{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_src_last_pkt_time":1731423358450971,"flow_dst_last_pkt_time":1731423358446960,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"thread_ts_usec":1731423358450971,"pkt":"dNo47VMyYhO2esBpCABFAAIt1l9AAEAG303AqAxDO1J64Km2AbsJp6rST0GngVAYAKxWjQAAFgMBAgABAAH8AwOw4jMveuI37\/WjiDyHnQ2hsVjHV479o+4ZVl+phMB3UiD14qfyyqtTcIeH+ZFkKDc4ONPDr49jhmk6Epq\/t9xE7wAiEwETAhMDwCvALMypwC\/AMMyowAnACsATwBQAnACdAC8ANQEAAZEAAAAUABIAAA91bWRjLnRhb2Jhby5jb20AFwAA\/wEAAQAACgAIAAYAHQAXABgACwACAQAAIwAAABAACwAJCGh0dHAvMS4xAAUABQEAAAAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBADMAJgAkAB0AIOsnlJesNI2mFGjT+vmekRyUoTa0OrykWZ32SO1oh8JjAC0AAgEBACsACQgDBAMDAwIDAQAVAOkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
01278{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":37,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1731423358197032,"flow_src_last_pkt_time":1731423358450971,"flow_dst_last_pkt_time":1731423358446960,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1731423358450971,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"59.82.122.224","src_port":43446,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Taobao","proto_id":"91.436","proto_by_ip":"Alibaba","proto_by_ip_id":274,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"umdc.taobao.com","domainame":"umdc.taobao.com","tls": {"version":"TLSv1.2","ja3":"9b02ebd3a43b62d825e1ac605b621dc8","ja3s":"","ja4":"t13d1713ht_5b57614c22b0_eca864cca44a","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","advertised_alpns":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","blocks":0}}}
00526{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_packet_id":5,"flow_src_last_pkt_time":1731423358450971,"flow_dst_last_pkt_time":1731423358700774,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"thread_ts_usec":1731423358700774,"pkt":"YhO2esBpdNo47VMyCABFAAAofdUAACsGjt07UnrgwKgMQwG7qbZPQaeBCaes11AQADzTxwAA"}
01368{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":39,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":3,"flow_first_seen":1731423358197032,"flow_src_last_pkt_time":1731423358450971,"flow_dst_last_pkt_time":1731423358702659,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":1460,"midstream":0,"thread_ts_usec":1731423358702659,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"59.82.122.224","src_port":43446,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Taobao","proto_id":"91.436","proto_by_ip":"Alibaba","proto_by_ip_id":274,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"umdc.taobao.com","domainame":"umdc.taobao.com","tls": {"version":"TLSv1.2","ja3":"9b02ebd3a43b62d825e1ac605b621dc8","ja3s":"00447ab319e9d94ba2b4c1248e155917","ja4":"t13d1713ht_5b57614c22b0_eca864cca44a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","advertised_alpns":"http\/1.1","negotiated_alpn":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","blocks":0}}}
02005{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":5,"flow_first_seen":1731423358197032,"flow_src_last_pkt_time":1731423358450971,"flow_dst_last_pkt_time":1731423358702664,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":517,"flow_dst_tot_l4_payload_len":3683,"midstream":0,"thread_ts_usec":1731423358702664,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"59.82.122.224","src_port":43446,"dst_port":443,"l4_proto":"tcp","ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Taobao","proto_id":"91.436","proto_by_ip":"Alibaba","proto_by_ip_id":274,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping","hostname":"umdc.taobao.com","domainame":"umdc.taobao.com","tls": {"version":"TLSv1.2","server_names":"*.alibabachengdun.com,*.alibabachengdun.net,umdc.aliapp.org,*.ynuf.aliapp.org,sgynuf.alibaba.com,pum.m.alibaba.com,ynuf.aliapp.org,mum.hzchengdun.com,mum.m.alibaba.com,umdc.alibaba-inc.com,umidiot.aliapp.org,us-mum.alibabachengdun.com,sg-pum.alibabachengdun.com,sg-pum.alibabachengdun.net,umdc.taobao.com,umdc.tmall.com,alibabachengdun.com","ja3":"9b02ebd3a43b62d825e1ac605b621dc8","ja3s":"00447ab319e9d94ba2b4c1248e155917","ja4":"t13d1713ht_5b57614c22b0_eca864cca44a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G3","subjectDN":"C=CN, ST=ZheJiang, L=HangZhou, O=Alibaba (China) Technology Co., Ltd., CN=*.alibabachengdun.com","advertised_alpns":"http\/1.1","negotiated_alpn":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"A4:84:85:BF:7A:3D:54:C0:EE:F2:8B:39:E7:ED:56:FB:74:6B:5E:61","blocks":0}}}
00979{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":48,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":7,"flow_dst_packets_processed":6,"flow_first_seen":1731420396936795,"flow_src_last_pkt_time":1731420397022641,"flow_dst_last_pkt_time":1731420397024867,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1448,"flow_src_tot_l4_payload_len":597,"flow_dst_tot_l4_payload_len":3609,"midstream":0,"thread_ts_usec":1731423358973813,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"2.23.155.106","src_port":46892,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Shein","proto_id":"91.434","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping"}}
00978{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":48,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":10,"flow_dst_packets_processed":10,"flow_first_seen":1731423286975849,"flow_src_last_pkt_time":1731423287471416,"flow_dst_last_pkt_time":1731423287519256,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":517,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":1403,"flow_dst_tot_l4_payload_len":4808,"midstream":0,"thread_ts_usec":1731423358973813,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"20.15.0.9","src_port":47694,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Temu","proto_id":"91.435","proto_by_ip":"Azure","proto_by_ip_id":276,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping"}}
00985{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":48,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","flow_id":3,"flow_state":"info","flow_src_packets_processed":9,"flow_dst_packets_processed":6,"flow_first_seen":1731423358197032,"flow_src_last_pkt_time":1731423358973813,"flow_dst_last_pkt_time":1731423358968432,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1024,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":2286,"flow_dst_tot_l4_payload_len":3957,"midstream":0,"thread_ts_usec":1731423358973813,"l3_proto":"ip4","src_ip":"192.168.12.67","dst_ip":"59.82.122.224","src_port":43446,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"confidence": {"6":"DPI"},"proto":"TLS.Taobao","proto_id":"91.436","proto_by_ip":"Alibaba","proto_by_ip_id":274,"encrypted":1,"breed":"Acceptable","category_id":27,"category":"Shopping"}}
00844{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":48,"source":"cfgs\/default\/pcap\/sites2.pcapng","alias":"nDPId-test","version":"1.7.0","ndpi_version":"4.11.0-4976-59ee1fe","ndpi_api_version":11619,"size_per_flow":1408,"packets-captured":48,"packets-processed":48,"pfring_active":false,"pfring_recv":0,"pfring_drop":0,"pfring_shunt":0,"total-skipped-flows":0,"total-l4-payload-len":16660,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":3,"total-detection-updates":4,"total-updates":0,"current-active-flows":0,"total-active-flows":3,"total-idle-flows":3,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"global-alloc-count":0,"global-free-count":0,"global-alloc-bytes":0,"global-free-bytes":0,"total-events-serialized":32,"global_ts_usec":1731423358973813}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 48/48
~~ skipped flows.............: 0
~~ total layer4 data length..: 16660 bytes
~~ total detected protocols..: 3
~~ total active/idle flows...: 3/3
~~ total timeout flows.......: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 6715311 bytes
~~ total memory freed........: 6715311 bytes
~~ total allocations/frees...: 114253/114253
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json message min len.......: 531 chars
~~ json message max len.......: 2010 chars
~~ json message avg len.......: 1259 chars
|