1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
00474{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"modbus.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1223541953927,"flow_last_seen":0,"flow_min_l4_payload_len":12,"flow_max_l4_payload_len":12,"flow_tot_l4_payload_len":12,"flow_avg_l4_payload_len":12,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00423{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541953,"pkt_ts_usec":927963,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0i\/1AAIAGEGjAqG6DwKhuiggaAfZB0urG4RU6zlAY\/MYAMgAAANEAAAAGAQMAAQAB"}
00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1223541953927,"flow_last_seen":0,"flow_min_l4_payload_len":12,"flow_max_l4_payload_len":12,"flow_tot_l4_payload_len":12,"flow_avg_l4_payload_len":12,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","ndpi": {"proto":"Modbus","breed":"Acceptable","category":"IoT-Scada"}}
00422{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541953,"pkt_ts_usec":929098,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzO9pAAIAGYIzAqG6KwKhugwH2CBrhFTrOQdLq0lAY++v\/BAAAANEAAAAFAQMCAAA="}
00423{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541953,"pkt_ts_usec":929171,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0i\/5AAIAGEGfAqG6DwKhuiggaAfZB0urS4RU62VAY\/LsAJgAAANIAAAAGAQMAAAAB"}
00421{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541953,"pkt_ts_usec":930003,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzO9tAAIAGYIvAqG6KwKhugwH2CBrhFTrZQdLq3lAY+982twAAANIAAAAFAQMCQcg="}
00422{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541954,"pkt_ts_usec":942774,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jABAAIAGEGXAqG6DwKhuiggaAfZB0ure4RU65FAY\/LAAGAAAANMAAAAGAQMAAQAB"}
00422{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541954,"pkt_ts_usec":944214,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzO\/hAAIAGYG7AqG6KwKhugwH2CBrhFTrkQdLq6lAY+9P+7AAAANMAAAAFAQMCAAA="}
00422{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541954,"pkt_ts_usec":944313,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAFAAIAGEGTAqG6DwKhuiggaAfZB0urq4RU671AY\/KUADAAAANQAAAAGAQMAAAAB"}
00422{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541954,"pkt_ts_usec":945105,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzO\/lAAIAGYG3AqG6KwKhugwH2CBrhFTrvQdLq9lAY+8c2nwAAANQAAAAFAQMCQcg="}
00424{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541955,"pkt_ts_usec":930829,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jARAAIAGEGHAqG6DwKhuiggaAfZB0ur24RU6+lAY\/Jr\/\/QAAANUAAAAGAQMAAQAB"}
00424{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541955,"pkt_ts_usec":931978,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzPBdAAIAGYE\/AqG6KwKhugwH2CBrhFTr6QdLrAlAY+7v+1AAAANUAAAAFAQMCAAA="}
00426{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541955,"pkt_ts_usec":932046,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAVAAIAGEGDAqG6DwKhuiggaAfZB0usC4RU7BVAY\/I\/\/8QAAANYAAAAGAQMAAAAB"}
00423{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541955,"pkt_ts_usec":932878,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzPBhAAIAGYE7AqG6KwKhugwH2CBrhFTsFQdLrDlAY+682hwAAANYAAAAFAQMCQcg="}
00425{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":932270,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAdAAIAGEF7AqG6DwKhuiggaAfZB0usO4RU7EFAY\/IT\/4wAAANcAAAAGAQMAAQAB"}
00423{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":933391,"pkt_caplen":65,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":65,"pkt_l4_len":31,"pkt":"AArkxYMKABzAX0kKCABFAAAzPDRAAIAGYDLAqG6KwKhugwH2CBrhFTsQQdLrGlAY+6P+vAAAANcAAAAFAQMCAAA="}
00425{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"modbus.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1223541956,"pkt_ts_usec":933457,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"ABzAX0kKAArkxYMKCABFAAA0jAhAAIAGEF3AqG6DwKhuiggaAfZB0usa4RU7G1AY\/Hn\/1wAAANgAAAAGAQMAAAAB"}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":102,"source":"modbus.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":102,"flow_first_seen":1223541953927,"flow_last_seen":1223541977037,"flow_min_l4_payload_len":11,"flow_max_l4_payload_len":12,"flow_tot_l4_payload_len":1173,"flow_avg_l4_payload_len":11,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.110.131","dst_ip":"192.168.110.138","src_port":2074,"dst_port":502,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":102,"source":"modbus.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 102/102
~~ skipped flows.............: 0
~~ total layer4 data length..: 3213 bytes
~~ total detected protocols..: 1
~~ total active/idle flows...: 1/1
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 1929664 bytes
~~ total memory freed........: 1929664 bytes
~~ total allocations/frees...: 35426/35426
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|