1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
00469{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"imo.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":3265032704,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_usec":0}
00546{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-payload-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_usec":1646579366752245}
00758{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1646579366752245,"flow_src_last_pkt_time":1646579366752245,"flow_dst_last_pkt_time":1646579366752245,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":200,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":200,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":200,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1646579366752245,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
00758{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":1646579366752245,"flow_dst_last_pkt_time":1646579366752245,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":242,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":242,"pkt_l4_len":208,"thread_ts_usec":1646579366752245,"pkt":"CL6sCxdumt9Y+uvcCABFAADkB2xAAEARIpLAqAypuZuJHsA3jrcA0NESgTwOaEjDNFXzxmxamfOGor3xFD3A7FnCXNc+hJhFKrJOPpMIHUdqj1x7ZYe+fmL104ZlZ8QSGjgMDxxGQ47M5ARZG9YmBTkKmoomp0C2r5k7+UuqXgkHofa9I06kfQJKjgPnNwBdZocQSlex2Z6G1oBdByRvxIbfLnB1AU5Z2+ssSUPzcUN05190AJa8ogAW0Cie1vmNKFuiNZVeV2v82D2eARVTcN232VacWZMHJ\/PcqQx4XLqiWe9HSh0LDQkCIZoCAAAAAAA="}
00936{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1646579366752641,"flow_dst_last_pkt_time":1646579366752245,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":371,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":371,"pkt_l4_len":337,"thread_ts_usec":1646579366752641,"pkt":"CL6sCxdumt9Y+uvcCABFAAFlB21AAEARIhDAqAypuZuJHsA3jrcBUW71gkcNAABefWxEZ6P52eWWE1NsVUgX\/f\/SEU49gh0z128SrDnndBBJ7Xzv30Qrd+KJJN6jW88s97nwOxW1SXOJ19HPmvCIhrHR5EVDIS67bqqmEITlpL2AWZxihzDdfZ9+dgCuOQIy4YhI67L+NII4MlG7p6wa+Z43u8VCM7MQ94E5SdjxWl3zDFPxVycVf7KV2xCPfzi+nLVEj6bW7qHP3SW0XSDmXsZYCq\/fkVzkG6GD9VCFwOzRvPlMFOvXxrdNScJnQTp3jwA9ixJO\/EZEvZGmxF8KX1lLWK60\/AnhsK8ResfH4lG\/M+7QsKf8h+0F6\/JreyOlSKUahDlCIMAkz9CNbMMyQvDt1lT9Ujr+5G5FKQSNp7Os7CbxgGOrC+XUDj1qcRw+csAXbivPEt1405allpHSrfAa3hDWEw734vz46COasfJjrLY="}
00502{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1646579366752641,"flow_dst_last_pkt_time":1646579366793549,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":53,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":53,"pkt_l4_len":19,"thread_ts_usec":1646579366793549,"pkt":"mt9Y+uvcCL6sCxduCABFAAAnWnIAADIRHkm5m4kewKgMqY63wDcAEwOhAAkDIZoCAAAAAAA="}
00863{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":1,"flow_first_seen":1646579366752245,"flow_src_last_pkt_time":1646579366752641,"flow_dst_last_pkt_time":1646579366793549,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":200,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":329,"flow_dst_max_l4_payload_len":11,"flow_src_tot_l4_payload_len":529,"flow_dst_tot_l4_payload_len":11,"midstream":0,"thread_ts_usec":1646579366793549,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
00750{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1646579366870607,"flow_src_last_pkt_time":1646579366870607,"flow_dst_last_pkt_time":1646579366870607,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":1,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":1,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1646579366870607,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_src_last_pkt_time":1646579366870607,"flow_dst_last_pkt_time":1646579366870607,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":43,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":43,"pkt_l4_len":9,"thread_ts_usec":1646579366870607,"pkt":"CL6sCxdumt9Y+uvcCABFAAAdWdFAAEARh1LAqAypXSEvOsA34QQACf3yBw=="}
00490{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":2,"flow_src_last_pkt_time":1646579366870607,"flow_dst_last_pkt_time":1646579366906814,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":43,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":43,"pkt_l4_len":9,"thread_ts_usec":1646579366906814,"pkt":"mt9Y+uvcCL6sCxduCABFAAAd07xAADYRF2ddIS86wKgMqeEEwDcACY7ydg=="}
00637{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_src_last_pkt_time":1646579366870607,"flow_dst_last_pkt_time":1646579366927729,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":149,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":149,"pkt_l4_len":115,"thread_ts_usec":1646579366927729,"pkt":"mt9Y+uvcCL6sCxduCABFAACH071AADYRFvxdIS86wKgMqeEEwDcAc11kag0AAJobOdZhqhsqD3t\/ZsLZznm6P+VojS4Ym286bkA4KafGXg3iLF\/wjB8hr6WLuR7MT5lbl5UGnsPZptwcvPKKbJmOyY4TOPC9kAo6L6kDDYE4iSyFwPlyWfdtSAheyL2rRrc\/cATh7Qs="}
00859{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":28,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"info","flow_src_packets_processed":2,"flow_dst_packets_processed":2,"flow_first_seen":1646579366870607,"flow_src_last_pkt_time":1646579366939802,"flow_dst_last_pkt_time":1646579366927729,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":1,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":10,"flow_dst_max_l4_payload_len":107,"flow_src_tot_l4_payload_len":11,"flow_dst_tot_l4_payload_len":108,"midstream":0,"thread_ts_usec":1646579366939802,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
01326{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":62,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1646579366870607,"flow_src_last_pkt_time":1646579367998159,"flow_dst_last_pkt_time":1646579367589404,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":1,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":100,"flow_dst_max_l4_payload_len":107,"flow_src_tot_l4_payload_len":241,"flow_dst_tot_l4_payload_len":239,"midstream":0,"thread_ts_usec":1646579367998159,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":22,"flow_avg":58121.3,"flow_max":463846,"flow_stddev":118788.2,"c_to_s_min":89,"c_to_s_avg":71317.8,"c_to_s_max":463846,"c_to_s_stddev":140812.8,"s_to_c_min":22,"s_to_c_avg":44924.8,"s_to_c_max":379036,"s_to_c_stddev":89692.4},"pktlen": {"c_to_s_min":43,"c_to_s_avg":57.1,"c_to_s_max":142,"c_to_s_stddev":22.0,"s_to_c_min":43,"s_to_c_avg":56.9,"s_to_c_max":149,"s_to_c_stddev":24.0}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
01359{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":67,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":17,"flow_dst_packets_processed":15,"flow_first_seen":1646579366752245,"flow_src_last_pkt_time":1646579368878172,"flow_dst_last_pkt_time":1646579368918568,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":182,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1224,"flow_dst_max_l4_payload_len":224,"flow_src_tot_l4_payload_len":11806,"flow_dst_tot_l4_payload_len":720,"midstream":0,"thread_ts_usec":1646579368918568,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"flow_min":24,"flow_avg":18090860.0,"flow_max":574615269,"flow_stddev":99955184.0,"c_to_s_min":275,"c_to_s_avg":33925952.0,"c_to_s_max":574615269,"c_to_s_stddev":135172640.0,"s_to_c_min":24,"s_to_c_avg":144421.5,"s_to_c_max":1002553,"s_to_c_stddev":311646.2},"pktlen": {"c_to_s_min":224,"c_to_s_avg":736.5,"c_to_s_max":1266,"c_to_s_stddev":500.8,"s_to_c_min":52,"s_to_c_avg":90.0,"s_to_c_max":266,"s_to_c_stddev":60.9}},"ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
00908{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","flow_id":2,"flow_state":"finished","flow_src_packets_processed":28,"flow_dst_packets_processed":37,"flow_first_seen":1646579366870607,"flow_src_last_pkt_time":1646579370069590,"flow_dst_last_pkt_time":1646579370091576,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":1,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1052,"flow_dst_max_l4_payload_len":1039,"flow_src_tot_l4_payload_len":6713,"flow_dst_tot_l4_payload_len":11506,"midstream":0,"thread_ts_usec":1646579370091576,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"93.33.47.58","src_port":49207,"dst_port":57604,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
00911{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":19,"flow_dst_packets_processed":16,"flow_first_seen":1646579366752245,"flow_src_last_pkt_time":1646579369944784,"flow_dst_last_pkt_time":1646579369921382,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":182,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":1224,"flow_dst_max_l4_payload_len":224,"flow_src_tot_l4_payload_len":12230,"flow_dst_tot_l4_payload_len":731,"midstream":0,"thread_ts_usec":1646579370091576,"l3_proto":"ip4","src_ip":"192.168.12.169","dst_ip":"185.155.137.30","src_port":49207,"dst_port":36535,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"confidence": {"6":"DPI"},"proto":"IMO","proto_id":"216","encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
00559{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":100,"source":"imo.pcap","alias":"nDPId-test","packets-captured":100,"packets-processed":100,"total-skipped-flows":0,"total-l4-payload-len":31180,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":2,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":2,"total-idle-flows":2,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":17,"global_ts_usec":1646579370091576}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 100/100
~~ skipped flows.............: 0
~~ total layer4 data length..: 31180 bytes
~~ total detected protocols..: 2
~~ total active/idle flows...: 2/2
~~ total timeout flows.......: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 6036724 bytes
~~ total memory freed........: 6036724 bytes
~~ total allocations/frees...: 121544/121544
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json string min len.......: 474 chars
~~ json string max len.......: 1364 chars
~~ json string avg len.......: 911 chars
|