1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
00463{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"quic-v2-00.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"tick-resolution":1000,"reader-thread-count":1,"flow-scan-interval":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":120000,"udp-max-idle-time":180000,"tcp-max-idle-time":7560000,"max-packets-per-flow-to-send":3,"max-packets-per-flow-to-process":32,"global_ts_msec":0}
00549{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"quic-v2-00.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-data-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_msec":1637834659980}
00593{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1637834659980,"flow_last_seen":1637834659980,"flow_idle_time":180000,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"thread_ts_msec":1637834659980,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":50277,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
02137{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_last_seen":1637834659980,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"thread_ts_msec":1637834659980,"pkt":"CAAnfrFjCgAnAAAACABFAgUApRBAAEARnsLAqDgBwKg4xsRlEVsE7OHRwv8CAAAIrj891mmhU7MITo0Xtz5eoNQARMoxqNSV7ADoFS7QxZ4\/HLjYUQBcyNcuN8bWG62+xF99Aye9DaJmsH6KCNcXJhjzha2fPdBZdc4Nidwy8pCVeYmH4yM6vXMdZ9UMG9ccEeFY0I8OcdmCSXa5odhdufBB8IiExzry\/kH3tbfUjXG04iCN+nOW3sUvM9jYBjMbDtvxmp3pNIhkRBYoqbdUsrgnC8gxSkuovl57ULo\/sHveA0VUZAGJSxTmVKe0r07WTY8Vme8cfKQuhCJyJQ0u6fy9TRgZZXMRXC0eJFf7TJ8th7p5hroNv6bLzmOuPgjvNTNJHwrDyFSySUxVtcYIdHVVK87NTKPpEsdU1rVG0M5a4NB7IceprsnY26+xxntF6CSj3awhr3bTkwpEEUY97+p1ajX+D8g1I4aOX6rhaGAvrlzvXuUaEGOgKPnQ+AUWgI4et+ESZ0jx95yNVOZMOIz03NHVCKK7sdoCvaV6DvfXrxC8VlZ\/voiimBSm4fxQtoq\/ehX+TDbJpuRVnW6tNqvoqo6b\/2mSeCze+AQTzCbQpJ9VxRP1OFSZb\/ZvwGL1xj+B+gsuWBOb2AKjTbcvrTFxQzjTz05z\/BTm\/8w6cUnlTZjNa6p5dHreDqezRbSD7lRQGWYzSIxQvxfAw3DmeDsgfIfLxIqlbjPAc7d1HLNRpPfAu9Xl2s0TOHTNNjxjvzFCmvhejA7r8fwovA9MGeABUWwJKX2lyb2KKRc6ZJ\/qwh1AmX1b27zLxiD3bmnWKipDS2J7nLbuit+X+x06cImd6I0jpxyszf9KlN8iShBGZLqWJuv4Sjm\/dbK5NAaFMyuxjutoHwHvt07Y0ybvrYM9q8eVqN2oXETUg3Q3JUPV6WrxRbJl02cOpYDWQmBbK32W+peQ6GgIPEGKh9xa53uYTOijgYPO7CzdBEq3yxlRm5mC45k9OnUXWP+pF\/\/3iqFzsEKAmw40YLrHgEhrRPwPwjA\/dEAdjlHQzLuPuJq\/lyh\/hngZe3iwYssgO+tjI9yT4GdtlNlxQxO2O3GnJGqReBKmRxUAIhvO4FGZvjzwaSnuQrlkrbMarvFnXBuA5xyokJGnx4Iuzxr8AuV8zTQH+3jPA\/IQu7te8iyjuipCCygjw5xX59DLE12WjOG6koGVDaTnK7EbaGXrceFbkurw9qrtaiM69Yc9LMJ8TlSB2bvsKUS5ROi5bB7Lkinodsq5TR+EIX9Vm4IdcjVjEMLk4PtAnY002vWcKoj7dqnG3PPxJ9jU5ZgalNcld216l74snMEx+DiVUziQSuix\/uhvgPCsbbNV7hTCbZgZrDyKiDQRY4+3\/aHIQ1egJTtTtCRN9\/hWBzta55pccPOZDmu4uFONofh4h8xzoTP70OytaDdl0wQ\/Ei3lAuHXsCv8+mDaCq5lkkdaZ4yec+Y7QXFDsftrwvwkHfmK1cVGIkQNhKGTJhXsAPIvMTJrvHKrKfkAkhkpujyQ9rOaLYnu9tKAqSFHSGbT4+tf9GwvC\/qe1icEqu7DGJuTrYJX248FiL4Ch+mdl93W3xuioDiePz\/LIUFTufH2qrWjaZO246tacboPOhhUtoHXq9yDKn+WDGCcQai7+YX70MiOjB7M+ZA9r4rhA4BnGOCHFairuSvx7tyf1IdmjIxzRQkOzw=="}
01178{"flow_event_id":6,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_packets_processed":1,"flow_first_seen":1637834659980,"flow_last_seen":1637834659980,"flow_idle_time":180000,"flow_min_l4_payload_len":1252,"flow_max_l4_payload_len":1252,"flow_tot_l4_payload_len":1252,"flow_avg_l4_payload_len":1252,"midstream":0,"thread_ts_msec":1637834659980,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":50277,"dst_port":4443,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"QUIC","breed":"Acceptable","category":"Web"},"quic": {"version":"TLSv1.3","alpn":"h3-34,hq-34,h3-33,hq-33,h3-32,hq-32,h3-31,hq-31,h3-29,hq-29,h3-30,hq-30,h3-28,hq-28,h3-27,hq-27,h3,hq-interop","ja3":"0299b052ace53a14c3a04aceb5efd247","tls_supported_versions":"TLSv1.3,TLSv1.3 (draft),TLSv1.3 (draft),TLSv1.3 (draft)"}}
00560{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_last_seen":1637834659981,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":132,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":132,"pkt_l4_len":98,"thread_ts_msec":1637834659981,"pkt":"CgAnAAAACAAnfrFjCABFAgB2689AAEARXI3AqDjGwKg4ARFbxGUAYl4L8P8CAAAITo0Xtz5eoNQIzn6Zws0tgzR89MPJKWOEcQosGt5JnvFEzbxq7ueyicjryx4GEYRiBPVuCO\/u++qyU+1Oe0oBZ5OgZN57Q6zBwe7HF\/MNE0OW9jWa"}
02134{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_last_seen":1637834659981,"flow_idle_time":180000,"pkt_oversize":false,"pkt_caplen":1294,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1294,"pkt_l4_len":1260,"thread_ts_msec":1637834659981,"pkt":"CAAnfrFjCgAnAAAACABFAgUApRFAAEARnsHAqDgBwKg4xsRlEVsE7Ggoxf8CAAAIzn6Zws0tgzQITo0Xtz5eoNQzfPTDySljhHEKLBreSZ7xRM28au7nsonI68seBhGEYgT1bgjv7vvqslPtTntKAWeToGTeRJcWE0YjWjjVhc2Epc6uRtR8VN2t2fxi\/BKMmIkOV87hdjuuQq+sQZ0aP+qAWUZVPXYTQHrsn74n\/20No0K3IRfMpFAohmoCuHG\/oQ2kWLkh177bcXYP5JJlk8DkeqaOI5jJHhZopdC0EbAUvMxzupw+jzNBfqVtawmI7ck4oaVbSmv2Lh6DWiZpOV9olm9oIGBvX2BwaSJD1bqkBU4R9jqpVrYVbPT8wKh4QURdyUCFt\/pHVUDNOCdVrd5eUzcIKHKZaxSHePl\/yg\/dZfocdFhjXr+U733uYE1qFz548naI9j5KWFQR98\/CC0d0xoU88iMdiNfsuKpNx+0KTTooTNyU1vveYbCXzokTytLPjCvSa6G73TOvA8OuYqiUHp5xIaLnG3yNhVMDOSMhU4ie3r+DP28Mq2ZWhXb0gV907Zpx+KmY7qFE\/EyWPTw3ImggsMZOsPVzlV7KQ1G4JHZysWOpvVXcKqSK+UITOAxHamfF+pVJDkIieo\/+UVkfaWKxIvKYp+6AyW0mR91ijnCBWiv5ac8EelQBTEUMESmN3gff7jVmyD2UBGfExJI\/xp8zNyXaLaoqKwUf+CQdXZyTUzSEow4dw7sk0BLa4e20TxielSByZoWK6tkiltlUP4PBd1obZ\/M6oWg61j\/Daa8BtIg2NiKd6C8GmB4wD3HxshTAfK8yQQvtfE5oxhIYFSThvUihWT5Y6+DXgFo1pfhCLK9GiUczfLb4IIj1ohvX7+JFC3tCZNhvBg+W6VXr0O0KDoohneIAR1gneA0NH\/AqiCjy6uumlwR0QPW6m1\/qhFdEihzIt7lXZBU1C0s3xSiecNioN1nHQ1IZ18Gt5IO0O8fCyaWkwQJW2X4b7oYB71jM09PZ6yTEheWWX1Z9OGLrj2qcJloTu4Iu57B9axJ4rPb3iaYEijb13CtYJyBrdekXWhtaBsDUZ4K3VnApYE2uwbNJjLuophjh1jHU6UaDW7ICUdFlFfXOXD9zV29thx80\/DmDnUWBkCiYZ1b8WkeGSDocv3+HJQsgn59EUwVtn48xiKxF+ZxbEyvE+tNMsZmJsKYtblFc78KHscbC\/gXOqIss94XJoPcOEnYS4XkfqkmrgcV+OcOn4xwAQZnZuvWtmECInLRRqZSWSgrK5WL3PY0tP7MwsjMj84o6wBnMP4w3HV50+mH8pwYFK7mbzXOSQewpeHcDSLhnLJws7lK12ciTf9mDIIAvKBV\/tMkKkPxyJSEhm3jO7hS51vQnfnfkpRwdX7SiobX4njfsJlhehzLkqQw51jymiTpszSbAlctrbxZEyzfIc2WNWTUWx08ydtAwlnqeB3Do2MRGROWmPmTwZQao5kKTElIMYU3ySnnob2SxJIk9zX7GT64JhQ8ACYfYm+EIsGpdwABuXDGAru+RAc6pHR7G9TKS2nV6aLuss2\/KhvADWzMAzwYWr8elV6VWYH9TDqVGswk9u\/66exfYVBSjIRj5MhRdx3Wo5x2vsIYtvcbxtp7Mbnc9AhThDmqqwywGPlZW7atDcUp1UHbpIe7lydp\/rxXfp2pJnL4sHu4B5+Vosg=="}
00944{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":30,"source":"quic-v2-00.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_packets_processed":30,"flow_first_seen":1637834659980,"flow_last_seen":1637834659987,"flow_idle_time":180000,"flow_min_l4_payload_len":55,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":26333,"flow_avg_l4_payload_len":877,"midstream":0,"thread_ts_msec":1637834659987,"l3_proto":"ip4","src_ip":"192.168.56.1","dst_ip":"192.168.56.198","src_port":50277,"dst_port":4443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"ndpi": {"flow_risk": {"5": {"risk":"Known Protocol on Non Standard Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}},"24": {"risk":"Missing SNI TLS Extension","severity":"Medium","risk_score": {"total":500,"client":350,"server":150}}},"confidence": {"4":"DPI"},"proto":"QUIC","breed":"Acceptable","category":"Web"}}
00558{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":30,"source":"quic-v2-00.pcapng","alias":"nDPId-test","packets-captured":30,"packets-processed":30,"total-skipped-flows":0,"total-l4-data-len":26333,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":9,"global_ts_msec":1637834659987}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 30/30
~~ skipped flows.............: 0
~~ total layer4 data length..: 26333 bytes
~~ total detected protocols..: 1
~~ total active/idle flows...: 1/1
~~ total timeout flows.......: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 5189563 bytes
~~ total memory freed........: 5189563 bytes
~~ total allocations/frees...: 113076/113076
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ json string min len.......: 468 chars
~~ json string max len.......: 2142 chars
~~ json string avg len.......: 1291 chars
|