1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
00476{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"drda_db2.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"drda_db2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1175543772220,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.106.1","dst_ip":"192.168.106.128","src_port":4847,"dst_port":50000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00422{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":220609,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AAwpfMZqAFBWwAABCABFAAAwIqBAAIAGglXAqGoBwKhqgBLvw1AKtGewAAAAAHAC\/\/\/kqAAAAgQFtAEBBAI="}
00420{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":221098,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"AFBWwAABAAwpfMZqCABFAAAwAABAAEAG5PXAqGqAwKhqAcNQEu\/9XlZHCrRnsXASFtB6IQAAAgQFtAEBBAI="}
00410{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":221136,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAwpfMZqAFBWwAABCABFAAAoIqFAAIAGglzAqGoBwKhqgBLvw1AKtGex\/V5WSFAQ\/\/+9tQAA"}
00651{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":338468,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"AAwpfMZqAFBWwAABCABFAADXIrhAAIAGgZbAqGoBwKhqgBLvw1AKtGex\/V5WSFAY\/\/8dAAAAAInQQQABAIMQQQA5EV6EgvKRg4NtgZeXk4mDgaOJlpVAQNHDw\/Dy8fDw8BfD8MH49sHw8UsBEbF1H\/kAAAAAAAAAAAAWEW3UqNfDYMiWoqOVgZSFQEBAQEAADBFa0cPD8PLx8PAAGBQEFAMAByQHAAckDwAHFEAABxR0AAUADBFH2MTC8mHR5dQAJtABAAIAIBBtAAYRogADABYhENToxMLyxMJAQEBAQEBAQEBAQA=="}
00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"drda_db2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1175543772220,"flow_last_seen":1175543772338,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":175,"flow_tot_l4_payload_len":175,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.106.1","dst_ip":"192.168.106.128","src_port":4847,"dst_port":50000,"l4_proto":"tcp","ndpi": {"proto":"DRDA","breed":"Acceptable","category":"Database"}}
00408{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":338790,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AFBWwAABAAwpfMZqCABFAAAoelNAAEAGaqrAqGqAwKhqAcNQEu\/9XlZICrRoYFAQGSCj5gAA"}
00557{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":339518,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"AFBWwAABAAwpfMZqCABFAACTelVAAEAGaj3AqGqAwKhqAcNQEu\/9XlZICrRoYFAYGSAErAAAAFvQQwABAFUUQwAYEV6EgvKEgvKBh4WVo\/Dw8PDww\/Tx8AAYFAQUAwAHJAcAByQPAAcUQAAHFHQABQAOEUfYxMLyYdPJ1eTnAAcRbYSC8gAMEVri2NPw+PDy9AAQ0AMAAgAKFKwABhGiAAM="}
00766{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":347614,"pkt_caplen":318,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":318,"pkt_l4_len":284,"pkt":"AAwpfMZqAFBWwAABCABFAAEwIrtAAIAGgTrAqGoBwKhqgBLvw1AKtGhg\/V5Ws1AY\/5T1dQAAADrQQQABADQQbgAGEaIAAwAWIRDU6MTC8sTCQEBAQEBAQEBAQEAAChGg1Ojk4sXZAAoRodTo5OLF2QDO0AEAAgDIIAEAFiEQ1OjEwvLEwkBAQEBAQEBAQEBAAAYhDyQHAAwRLtHDw\/Dy8fDwAHkhBHTRw8Pw8vHw8NSo18NgyJaio5WBlIVAQEBAQISC8pGDg22Bl5eTiYOBo4mWlUBA1Ojk4sXZQEA90cPD8PLx8PDUqNfDYMiWoqOVgZSFQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAfWvnffDwfQANAC\/Y48Ti2NPB4sMAFgA1AAYRnAS4AAYRnQSwAAYRngS4"}
00408{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543772,"pkt_ts_usec":382961,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AFBWwAABAAwpfMZqCABFAAAoeldAAEAGaqbAqGqAwKhqAcNQEu\/9XlazCrRpaFAQHVCeQwAA"}
00747{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":349103,"pkt_caplen":295,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":295,"pkt_l4_len":261,"pkt":"AFBWwAABAAwpfMZqCABFAAEZellAAEAGabPAqGqAwKhqAcNQEu\/9XlazCrRpaFAYHVCnbgAAABXQQgABAA8SGQAGEUkAAAAFEaQAAFDQUgACAEoiAQAGEUkAAAAMES7i2NPw+PDy9AANAC\/Y48Ti2NPn+PYACgA1AAYRnAMzAAYhAwIuABchNcPwwfj2wfDxS8XG8fIHBAIZVhIAjNADAAIAhiQIAAAAAAAwMDAwMFNRTDA4MDI0AP\/\/\/\/8CAAAAAAAAAAMAAAAAAAAAAAAAACAgICAgICAgICAgABJNWURCMkRCICAgICAgICAgICAAAAAzMf84MTn\/TVlVU0VSICD\/TVlEQjJEQv9RREIyL0xJTlVY\/zU1OP81NTj\/MP8xMjA4\/zD\/\/w=="}
00412{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":477278,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AAwpfMZqAFBWwAABCABFAAAoIzRAAIAGgcnAqGoBwKhqgBLvw1AKtGlo\/V5XpFAQ\/qO7\/gAA"}
01307{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":826559,"pkt_caplen":717,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":717,"pkt_l4_len":683,"pkt":"AAwpfMZqAFBWwAABCABFAAK\/I21AAIAGfvnAqGoBwKhqgBLvw1AKtGlo\/V5XpFAY\/qNDwQAAAFPQUQABAE0gFABEIRPU6MTC8sTCQEBAQEBAQEBAQEDV5NPTycRAQEBAQEBAQEBAQEDi6OLiyPLw8EBAQEBAQEBAQEBTWVNMVkwwMQBBAAUhDgEAKdBDAAEAIyQUAAAAABlTRVQgQ1VSUkVOVCBTQ0hFTUEgPSAnU0Mn\/wBT0FEAAgBNIBQARCET1OjEwvLEwkBAQEBAQEBAQEBA1eTT08nEQEBAQEBAQEBAQEBA4uji4sjy8PBAQEBAQEBAQEBAU1lTTFZMMDEAQQAFIQ4BACnQUwACACMkFAAAAAAZU0VUIENMSUVOVCBVU0VSSUQnY2ZmZG8xJ\/8ANNBTAAIALiQUAAAAACRTRVQgQ0xJRU5UIFdSS1NUTk5BTUUnTXlQQy1Ib3N0bmFtZSf\/AF\/QQwACAFkkFAAAAABPU0VUIENMSUVOVCBBQ0NUTkcnSkNDMDIxMDBNeVBDLUhvc3RuYW1lICAgICAgICAgICAgICAgICAgICAgICAgIGNmZmRvMSAgJyxYJzAwJ\/8AWNBRAAMAUiANAEQhE9ToxMLyxMJAQEBAQEBAQEBAQNXk09PJxEBAQEBAQEBAQEBAQOLo4uLI8vDwQEBAQEBAQEBAQFNZU0xWTDAxAAEABSEW8QAFIUYEAB7QUwADABgkUAAAAAAORk9SIFJFQUQgT05MWSD\/ADvQQwADADUkFAAAAAArc2VsZWN0IGN1cnJlbnQgc2NoZW1hIGZyb20gc3lzaWJtLnN5c2R1bW15Mf8AW9ABAAQAVSAMAEQhE9ToxMLyxMJAQEBAQEBAQEBAQNXk09PJxEBAQEBAQEBAQEBAQOLo4uLI8vDwQEBAQEBAQEBAQFNZU0xWTDAxAAEACCEUAAB\/\/wAFIV0B"}
00411{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":826736,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"AFBWwAABAAwpfMZqCABFAAAoeltAAEAGaqLAqGqAwKhqAcNQEu\/9XlekCrRr\/1AQJEKTyQAA"}
01049{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":834282,"pkt_caplen":524,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":524,"pkt_l4_len":490,"pkt":"AFBWwAABAAwpfMZqCABFAAH+el1AAEAGaMrAqGqAwKhqAcNQEu\/9XlekCrRr\/1AYJEI2HgAAAAvQUwABAAUkCP8AL9BDAAEAKSQU\/wAAAAAfU0VUIENVUlJFTlQgU0NIRU1BID0gIlNDICAgICAgIgAL0EMAAgAFJAj\/ALHQQwADAKskEQAAAAAAMDAwMDBTUUwwODAyNAAAAAAAAAAAAAEAAAABAAAAIf\/\/\/wAAAAAgICAgICAgICAgIAASTVlEQjJEQiAgICAgICAgICAgAAAAAP8AAQAAAAAAAABVAAAAAAAAAAAAAQAAAAAAgAAAAAAAAADAAQMzAAEAAAAAATEAAAAAAAAAAP8AAAAAAAAAAAAAB01ZREIyREIAAAAAAAAAAAAAAAAAAAAAACzQUgAEACYiBQAGEUkAAAAGIQIkFwAFIR\/xAAUhUAEADCFbAAAAAAAAAAAAH9BTAAQAGSQaBnbQMgCACXHgVAAB0AABBnHw4AAAABbQUwAEABAkG\/8AAAhTQyAgICAgIAAm0FIABAAgIgsABhFJAAQAFiEQ1OjEwvLEwkBAQEBAQEBAQEBAAFnQAwAEAFMkCABkAAAAMDIwMDBTUUxSSTAxRgABAASAAQAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAgICAgIAASTVlEQjJEQiAgICAgICAgICAgAAAAAP8="}
00428{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":898122,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"AAwpfMZqAFBWwAABCABFAAAyI31AAIAGgXbAqGoBwKhqgBLvw1AKtGv\/\/V5ZelAY\/M3JNgAAAArQAQABAAQgDg=="}
00485{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"drda_db2.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1175543773,"pkt_ts_usec":898676,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"AFBWwAABAAwpfMZqCABFAABeel9AAEAGamjAqGqAwKhqAcNQEu\/9Xll6CrRsCVAYJEI06gAAACvQUgABACUiDAAGEUkABAAFIRUBABYhENToxMLyxMJAQEBAQEBAQEBAQAAL0AMAAQAFJAj\/"}
00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"drda_db2.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":38,"flow_first_seen":1175543772220,"flow_last_seen":1175543810683,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":663,"flow_tot_l4_payload_len":4623,"flow_avg_l4_payload_len":121,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.106.1","dst_ip":"192.168.106.128","src_port":4847,"dst_port":50000,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"drda_db2.pcap","alias":"nDPId-test"}
|