1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
00477{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"http_auth.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":10000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1381844050222,"flow_last_seen":1381844050222,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":222515,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"TBfruiThKM\/pITwrCABFAABARSdAAEAGtjzAqAAEwP69qdRBAFCa4jGyAAAAALAC\/\/8jTAAAAgQFtAEDAwQBAQgKH38TuAAAAAAEAgAA"}
00439{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402547,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KM\/pITwrTBfruiThCABFAAA8AABAADgGA2jA\/r2pwKgABABQ1EEDZtH9muIxs6ASOJA\/hAAAAgQFtAQCCAowzbX3H38TuAEDAwc="}
00427{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402655,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0XSJAAEAGnk3AqAAEwP69qdRBAFCa4jGzA2bR\/oAQICuGBAAAAQEICh9\/FGkwzbX3"}
01418{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":402794,"pkt_caplen":805,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":805,"pkt_l4_len":771,"pkt":"TBfruiThKM\/pITwrCABFAAMXqUtAAEAGT0HAqAAEwP69qdRBAFCa4jGzA2bR\/oAYICs3TAAAAQEICh9\/FGkwzbX3R0VUIC9wYXNzd29yZC1vay5waHAgSFRUUC8xLjENCkhvc3Q6IGJyb3dzZXJzcHkuZGsNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MA0KQXV0aG9yaXphdGlvbjogQmFzaWMgZEdWemREcG1ZV2xzTWc9PQ0KQWNjZXB0OiB0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSxpbWFnZS93ZWJwLCovKjtxPTAuOA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfOF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMzAuMC4xNTk5LjY5IFNhZmFyaS81MzcuMzYNClJlZmVyZXI6IGh0dHA6Ly9icm93c2Vyc3B5LmRrL3Bhc3N3b3JkLnBocA0KQWNjZXB0LUVuY29kaW5nOiBnemlwLGRlZmxhdGUsc2RjaA0KQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuOA0KQ29va2llOiBfX3V0bWE9MTkwOTA4MjgxLjE1NjAwOTU2MTEuMTM4MTg0Mzk2OC4xMzgxODQzOTY4LjEzODE4NDM5NjguMTsgX191dG1iPTE5MDkwODI4MS4yLjEwLjEzODE4NDM5Njk7IF9fdXRtYz0xOTA5MDgyODE7IF9fdXRtej0xOTA5MDgyODEuMTM4MTg0Mzk2OS4xLjEudXRtY3NyPWdvb2dsZXx1dG1jY249KG9yZ2FuaWMpfHV0bWNtZD1vcmdhbmljfHV0bWN0cj0obm90JTIwcHJvdmlkZWQpOyBfX3VuYW09NmI2YWI2ZC0xNDFiYzUxYTgxZS00MTAyYTY2MS0yDQoNCg=="}
00815{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1381844050222,"flow_last_seen":1381844050402,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":739,"flow_tot_l4_payload_len":739,"flow_avg_l4_payload_len":184,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","ndpi": {"flow_risk": {"36":"Clear-text credentials"},"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {"hostname":"browserspy.dk","url":"browserspy.dk\/password-ok.php","code":0,"content_type":"","user_agent":"Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.69 Safari\/537.36"}}
00427{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":596540,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KM\/pITwrTBfruiThCABFAAA0Z\/RAADgGm3vA\/r2pwKgABABQ1EEDZtH+muI0loAQAH2ivAAAAQEICjDNtgoffxRp"}
02365{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":802943,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/VAADgGldLA\/r2pwKgABABQ1EEDZtH+muI0loAQAH1SGgAAAQEICjDNth8ffxRpSFRUUC8xLjEgNDAxIEF1dGhvcml6YXRpb24gUmVxdWlyZWQNCkRhdGU6IFR1ZSwgMTUgT2N0IDIwMTMgMTM6MzQ6MDIgR01UDQpTZXJ2ZXI6IEFwYWNoZQ0KV1dXLUF1dGhlbnRpY2F0ZTogQmFzaWMgcmVhbG09IkJyb3dzZXJTcHkuZGsgLSBIVFRQIFBhc3N3b3JkIFRlc3QiDQpFeHBpcmVzOiBNb24sIDI2IEp1bCAxOTk3IDA1OjAwOjAwIEdNVA0KQ2FjaGUtQ29udHJvbDogbm8tc3RvcmUsIG5vLWNhY2hlLCBtdXN0LXJldmFsaWRhdGUsIHBvc3QtY2hlY2s9MCwgcHJlLWNoZWNrPTANClByYWdtYTogbm8tY2FjaGUNCktlZXAtQWxpdmU6IHRpbWVvdXQ9NSwgbWF4PTc1DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpUcmFuc2Zlci1FbmNvZGluZzogY2h1bmtlZA0KQ29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KNWYxDQo8IURPQ1RZUEUgaHRtbCBQVUJMSUMgIi0vL1czQy8vRFREIFhIVE1MIDEuMCBTdHJpY3QvL0VOIiAiaHR0cDovL3d3dy53My5vcmcvVFIveGh0bWwxL0RURC94aHRtbDEtc3RyaWN0LmR0ZCI+CjxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIiB4bWw6bGFuZz0iZW4iIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTEiIC8+Cjx0aXRsZT5IVFRQIFBhc3N3b3JkIEluZm9ybWF0aW9uIC0gRmFpbHVyZSAtIEJyb3dzZXJTcHkuZGs8L3RpdGxlPgo8bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iRmFpbHVyZSEgWW91ciBjbGllbnQgZG9lc24ndCBzdXBwb3J0cyBIVFRQIEJhc2ljIEF1dGhlbnRpY2F0aW9uIG9yIHlvdSBwcm92aWRlIHRoZSB3cm9uZyB1c2VybmFtZSBhbmQvb3IgcGFzc3dvcmQuIEJlbG93IGFyZSBsaXN0ZWQgd2hhdCB5b3UgcHJvdmlkZWQgYXMgbG9naW4gaW5mb3JtYXRpb24uIiAvPgo8bWV0YSBuYW1lPSJrZXl3b3JkcyIgY29udGVudD0iZmFpbHVyZSxwYXNzd29yZCxodHRwLGJhc2ljLGF1dGhlbnRpY2F0aW9uLHByb3RlY3Rpb24iIC8+CjxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvZmF2aWNvbi5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiIgLz4KPGxpbmsgcmVsPSJzaG9ydGN1dCBpY29uIiBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9mYXZpY29uLmljbyIgdHlwZT0iaW1hZ2UveC1pY29uIiAvPgo8bGluayByZWw9InN0eWxlc2hlZXQiIHR5cGU9InRleHQvY3NzIiBtZWRpYT0iYWxsIiBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay90aGVtZS9yZXNldC5jc3MiIC8+CjxsaW5rIHJlbD0ic3R5bGVzaGVldCIgdHlwZT0idGV4dC9jc3MiIG1lZGlhPSJhbGwiIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL3RoZW1lL2RlZmF1bHQuY3NzIiAvPgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwOi8vYnI="}
01078{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804265,"pkt_caplen":551,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":551,"pkt_l4_len":517,"pkt":"KM\/pITwrTBfruiThCABFAAIZZ\/ZAADgGmZTA\/r2pwKgABABQ1EEDZtemmuI0loAYAH3Q5gAAAQEICjDNth8ffxRpb3dzZXJzcHkuZGsvanMvanF1ZXJ5LmpzIj48L3NjcmlwdD4KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cDovL3d3dy5nb29nbGUuY29tL2Nvb3AvY3NlL2JyYW5kP2Zvcm09Y3NlLXNlYXJjaC1ib3gmYW1wO2xhbmc9ZW4iPjwvc2NyaXB0Pgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJqcy9qcXVlcnkuYnJvd3Nlci5qcyI+PC9zY3JpcHQ+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KLy88IVtDREFUQVsKDQoJCQkkKGRvY3VtZW50KS5yZWFkeShmdW5jdGlvbigpew0KCQkJCSQoImFbcmVsPWV4dGVybmFsXSIpLmNsaWNrKGZ1bmN0aW9uKCl7DQoJCQkJCXBhZ2VUcmFja2VyLl90cmFja1BhZ2V2aWV3KCIvb3V0Z29pbmcvIisgJCh0aGlzKS5hdHRyKCJocmVmIikpOw0KCQkJCX0pOw0KCQkJfSk7DQoJCQovL11dPgo8L3NjcmlwdD4KPC9oZWFkPgo8Ym9keSBpZD0iYnJvd3NlcnNweWRrIj4KDQo="}
00426{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804299,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0JFRAAEAG1xvAqAAEwP69qdRBAFCa4jSWA2bZi4AQH+F6KAAAAQEICh9\/FfcwzbYf"}
00538{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804861,"pkt_caplen":145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":145,"pkt_l4_len":111,"pkt":"KM\/pITwrTBfruiThCABFAACDZ\/dAADgGmynA\/r2pwKgABABQ1EEDZtmLmuI0loAYAH06nAAAAQEICjDNth8ffxRpNDkNCg0KCQkJPGRpdiBpZD0iaGVhZGVyIj4NCgkJCQk8ZGl2IGNsYXNzPSJpbm5lciI+DQoJCQkJCTxkaXYgaWQ9ImxvZ28iPg0KCQkNCg=="}
00428{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":804893,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA03TRAAEAGHjvAqAAEwP69qdRBAFCa4jSWA2bZ2oAQH9x53gAAAQEICh9\/FfcwzbYf"}
00728{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":805596,"pkt_caplen":288,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":288,"pkt_l4_len":254,"pkt":"KM\/pITwrTBfruiThCABFAAESZ\/hAADgGmpnA\/r2pwKgABABQ1EEDZtnamuI0loAYAH3nAAAAAQEICjDNth8ffxRpZDgNCjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrLyIgdGl0bGU9IkJhY2sgdG8gQnJvd3NlclNweS5kayBmcm9udHBhZ2UiPjxpbWcgYWx0PSJCcm93c2VyU3B5LmRrIGxvZ28iIHdpZHRoPSIzMDAiIGhlaWdodD0iNTMiIHNyYz0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvcGljcy9sb2dvLnBuZyIgLz48L2E+DQoJCQkJCTwvZGl2Pg0KCQkJPGRpdiBpZD0iYmFubmVyLWhlYWRlciI+Cg0K"}
00428{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":805617,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0s2FAAEAGSA7AqAAEwP69qdRBAFCa4jSWA2bauIAQH855DQAAAQEICh9\/FfgwzbYf"}
02367{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":809623,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/lAADgGlc7A\/r2pwKgABABQ1EEDZtq4muI0loAQAH36uQAAAQEICjDNth8ffxRpMmQ4NA0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPgovLzwhW0NEQVRBWwp2YXIgZ29vZ2xlX2FkX2NsaWVudCA9ICJwdWItMzc4MjU5Nzk5NjIxNjI1NyI7CnZhciBnb29nbGVfYWRfc2xvdCA9ICI3NTY0NDY5MzQzIjsKdmFyIGdvb2dsZV9hZF93aWR0aCA9IDQ2ODsKdmFyIGdvb2dsZV9hZF9oZWlnaHQgPSA2MDsKLy9dXT4KPC9zY3JpcHQ+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0IiBzcmM9Imh0dHA6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvc2hvd19hZHMuanMiPjwvc2NyaXB0Pgo8L2Rpdj4KCTwvZGl2Pg0KCQkJCTxkaXYgY2xhc3M9ImNsciI+PC9kaXY+DQoJCQk8L2Rpdj4NCgkJCTxkaXYgaWQ9Im1lbnUiPg0KCQkJCTx1bCBpZD0ibWVudXRvcCI+CjxsaSBjbGFzcz0iYWN0aXZlIj48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay8iIHRpdGxlPSJCYWNrIHRvIHRoZSBmcm9udHBhZ2Ugb2YgQnJvd3NlclNweS5kayI+SG9tZTwvYT48L2xpPjxsaT48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9hYm91dC8iIHRpdGxlPSJXaGF0IGlzIEJyb3dzZXJTcHkuZGsgYWxsIGFib3V0PyI+QWJvdXQ8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYmxvZy8iIHRpdGxlPSJUaGUgQnJvd3NlclNweS5kayBibG9nIHdpdGggbmV3cyBhbmQgcmVsZXZhbnQgaW5mb3JtYXRpb24iPkJsb2c8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29udGFjdC8iIHRpdGxlPSJIb3cgZG8gSSBjb250YWN0IEJyb3dzZXJTcHkuZGsiPkNvbnRhY3Q8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvZG9uYXRlLyIgdGl0bGU9IkhvdyBkbyBJIGRvbmF0ZSBtb25leSB0byB0aGUgZGV2ZWxvcG1lbnQgb2YgQnJvd3NlclNweS5kayI+RG9uYXRlPC9hPjwvbGk+PGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2ZhcS8iIHRpdGxlPSJMaXN0IG9mIEZyZXF1ZW50bHkgQXNrZWQgUXVlc3Rpb25zIG9uIEJyb3dzZXJTcHkuZGsiPkZBUTwvYT48L2xpPjwvdWw+Cg0KCQkJCTxkaXYgaWQ9InNlYXJjaCI+PGZvcm0gYWN0aW9uPSJodHRwOi8vYnJvd3NlcnNweS5kay9zZWFyY2gvIiBpZD0iY3NlLXNlYXJjaC1taW5pIj48ZGl2PjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImN4IiB2YWx1ZT0iMDAzNDg0MTMwNzIwOTExNjg2NDI1OmItcmNkX19uYmJ3IiAvPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImNvZiIgdmFsdWU9IkZPUklEOjExIiAvPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImllIiB2YWx1ZT0iVVRGLTgiIC8+PGlucHV0IHR5cGU9InRleHQiIG5hbWU9InEiIHNpemU9IjMwIiB0aXRsZT0iU2VhcmNoIHRoZSBCcm93c2VyU3B5LmRrIHNpdGUiIC8+PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0ic2EiIGM="}
02373{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":814178,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"KM\/pITwrTBfruiThCABFAAXcZ\/pAADgGlc3A\/r2pwKgABABQ1EEDZuBgmuI0loAQAH0DVwAAAQEICjDNth8ffxRpbGFzcz0ic3ViIiB2YWx1ZT0iU2VhcmNoIFNpdGUiIHRpdGxlPSJEbyB0aGUgc2VhcmNoISIgLz48L2Rpdj48L2Zvcm0+PC9kaXY+DQoJCQk8L2Rpdj4NCgkJCTxkaXYgaWQ9ImNvbnRlbnQiPg0KCQkJCTxkaXYgaWQ9ImxlZnQiPg0KCQkJCQk8ZGl2IGNsYXNzPSJpbm5lciI+DQoJCQkJCQk8ZGl2IGlkPSJpbmZvIj48cD5Ccm93c2VyU3B5LmRrIHNob3dzIHlvdSBqdXN0IGhvdyBtdWNoIGluZm9ybWF0aW9uIGNhbiBiZSByZXRyaWV2ZWQgZnJvbSB5b3VyIGJyb3dzZXIganVzdCBieSB2aXNpdGluZyBhIHBhZ2UuPC9wPjxwPkF2YWlsYWJsZSB0ZXN0cyBhcmUgbGlzdGVkIGJlbG93LjwvcD48L2Rpdj4NCgkJCQkJCTx1bCBpZD0ibmF2Ij4KPGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2FjY2VwdC5waHAiIHRpdGxlPSJXaGF0IGZpbGV0eXBlcyBkb2VzIHlvdXIgYnJvd3NlciBhY2NlcHQ\/Ij5BY2NlcHRlZCBGaWxldHlwZXM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYWN0aXZleC5waHAiIHRpdGxlPSJEb2VzIHlvdXIgYnJvd3NlciBzdXBwb3J0IEFjdGl2ZVg\/Ij5BY3RpdmVYPC9hPjwvbGk+PGxpPjxhIGhyZWY9Imh0dHA6Ly9icm93c2Vyc3B5LmRrL2Fkb2JlcmVhZGVyLnBocCIgdGl0bGU9IklzIEFkb2JlIFJlYWRlciBpbnN0YWxsZWQ\/Ij5BZG9iZSBSZWFkZXI8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYWpheC5waHAiIHRpdGxlPSJEb2VzIHlvdXIgYnJvd3NlciBzdXBwb3J0IFhNTCByZXF1ZXN0cyBhbmQgZG9jdW1lbnRzLiBYTUxIdHRwUmVxdWVzdCBpcyB1c2VkIGluIEFqYXggYmFzZWQgd2Vic2l0ZXMiPkFqYXggU3VwcG9ydDwvYT48L2xpPjxsaT48YSBocmVmPSJodHRwOi8vYnJvd3NlcnNweS5kay9iYW5kd2lkdGgucGhwIiB0aXRsZT0iV2hhdCBpcyB5b3VyIGludGVybmV0IGNvbm5lY3Rpb24gc3BlZWQ\/Ij5CYW5kd2lkdGg8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvYnJvd3Nlci5waHAiIHRpdGxlPSJXaGF0IGlzIHRoZSBuYW1lIGFuZCB2ZXJzaW9uIG9mIHlvdXIgYnJvd3Nlcj8iPkJyb3dzZXI8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY2FwYWJpbGl0aWVzLnBocCIgdGl0bGU9IldoYXQgY2FwYWJpbGl0aWVzIGRvZXMgeW91ciBicm93c2VyIGhhdmU\/Ij5DYXBhYmlsaXRpZXM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29sb3JzLnBocCIgdGl0bGU9IldoYXQga2luZCBvZiBzeXN0ZW0gY29sb3JzIGRvZXMgeW91ciBicm93c2VyIHN1cHBvcnQ\/Ij5Db2xvcnM8L2E+PC9saT48bGk+PGEgaHJlZj0iaHR0cDovL2Jyb3dzZXJzcHkuZGsvY29tcG9uZW50LnBocCIgdGl0bGU9IldoYXQgSW50ZXJuZXQgRXhwbG9yZXIgY29tcG9uZW50cyBjYW4gYmUgYW4="}
00428{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"http_auth.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1381844050,"pkt_ts_usec":814283,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"TBfruiThKM\/pITwrCABFAAA0zHdAAEAGLvjAqAAEwP69qdRBAFCa4jSWA2bmCIAQHxluagAAAQEICh9\/FgAwzbYf"}
00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":33,"source":"http_auth.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":33,"flow_first_seen":1381844050222,"flow_last_seen":1381844057320,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1448,"flow_tot_l4_payload_len":18376,"flow_avg_l4_payload_len":556,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.4","dst_ip":"192.254.189.169","src_port":54337,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00129{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":33,"source":"http_auth.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 33/33
~~ skipped flows.............: 0
~~ total layer4 data length..: 19452 bytes
~~ total detected protocols..: 1
~~ total active/idle flows...: 1/1
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 1929185 bytes
~~ total memory freed........: 1929185 bytes
~~ total allocations/frees...: 35374/35374
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json string min len.......: 134 chars
~~ json string max len.......: 2378 chars
~~ json string avg len.......: 1329 chars
|