1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
00391{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"smb_deletefile.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":0,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00972{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368315,"pkt_ts_usec":417275,"pkt_caplen":434,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":434,"pkt_l4_len":400,"pkt":"2MuK4S0uKDc3AG3ICABFAAGkAABAAEAGtNLAqAF2wKgBu94QAb3ooAVq8kMyI1AYqgDfmAAAAAABeP5TTUJAAAEAAAAAAAUAAAEAAAAAmAAAAJwPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgAHAAAAAAAAAAAAEwAdQBjAGEAXABEAG8AdwBuAGwAbwBhAGQAcwAAAAAA\/lNNQkAAAQAAAAAADgAAAQQAAACIAAAAnQ8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AAJgAAAAEAaQBuAG4AbwBzAGUAdAB1AHAALQA1AC4ANgAuADEALgBlAHgAZQAAAP5TTUJAAAEAAAAAAAYAAAEEAAAAAAAAAJ4PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAP\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/8="}
00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1584368315417,"flow_last_seen":0,"flow_tot_l4_data_len":400,"flow_min_l4_data_len":400,"flow_max_l4_data_len":400,"flow_avg_l4_data_len":400,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","ndpi": {"proto":"NetBIOS.SMBv23","breed":"Acceptable","category":"System"}}
01092{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368315,"pkt_ts_usec":418447,"pkt_caplen":554,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":554,"pkt_l4_len":520,"pkt":"KDc3AG3I2MuK4S0uCABFAAIcOK5AAIAGO6zAqAG7wKgBdgG93hDyQzIj6KAG5lAYEAjw+QAAAAAB8P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAJwPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAPJad+s0itQBeC8Pcpz71QGM0O1xnPvVAYzQ7XGc+9UBACAAAAAAAAAAIAAAAAAAABEAAAAAAAAAEgQAAAoAAABlAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAADYAAAAnQ8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASACOAAAAAAAAAAAAAAAzwlM5LZjUATN2tkyb+9UBqrZQPC2Y1AHHrtHNIlnVAYD0HQAAAAAAAAAeAAAAAAAgAAAAJgAAAAAAAAAYAEkATgBOAE8AUwBFAH4AMQAuAEUAWABFAAAAq04CAAAAAQBpAG4AbgBvAHMAZQB0AHUAcAAtADUALgA2AC4AMQAuAGUAeABlAAAA\/lNNQkAAAQAAAAAABgADAAUAAAAAAAAAng8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="}
00413{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368315,"pkt_ts_usec":418500,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAbm8kM0F1AQqfyLpgAA"}
00896{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":575781,"pkt_caplen":378,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":378,"pkt_l4_len":344,"pkt":"2MuK4S0uKDc3AG3ICABFAAFsAABAAEAGtQrAqAF2wKgBu94QAb3ooAbm8kM0F1AYqgDGowAAAAABQP5TTUJAAAEAAAAAAAUAAAEAAAAAgAAAAJ8PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgAAAAAAAAAAAAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAQQAAABoAAAAoA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AACAAAAAEATAB1AGMAYQD+U01CQAABAAAAAAAGAAABBAAAAAAAAAChDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/"}
01047{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":576871,"pkt_caplen":522,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":522,"pkt_l4_len":488,"pkt":"KDc3AG3I2MuK4S0uCABFAAH8OLFAAIAGO8nAqAG7wKgBdgG93hDyQzQX6KAIKlAYEAdr9gAAAAAB0P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAJ8PAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAHF8fnEN3tQBwjwds5371QFsgQlGF1nVAZpBFPwbWdUBABAAAAAAAAAAEAAAAAAAABEAAAAAAAAAEwQAAAoAAADNAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAAC4AAAAoA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASABwAAAAAAAAAAAAAABsgQlGF1nVAaWmw1ic+9UBpabDWJz71QGlpsNYnPvVAQAAAAAAAAAAAAAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD5UGAAAABQBMAHUAYwBhAP5TTUJAAAEAAAAAAAYAAwAFAAAAAAAAAKEPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00413{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":576940,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAgq8kM161AQqfyIjgAA"}
00922{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":577027,"pkt_caplen":394,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":394,"pkt_l4_len":360,"pkt":"2MuK4S0uKDc3AG3ICABFAAF8AABAAEAGtPrAqAF2wKgBu94QAb3ooAgq8kM161AYqgDtZwAAAAABUP5TTUJAAAEAAAAAAAUAAAEAAAAAgAAAAKIPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACBABAAEAAAAAcAAAABAAAAAQAAAHgACAAAAAAAAAAAAEwAdQBjAGEA\/lNNQkAAAQAAAAAADgAAAQQAAAB4AAAAow8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAACEAJQMAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/2AAEgAAAAEARABvAHcAbgBsAG8AYQBkAHMAAAAAAAAA\/lNNQkAAAQAAAAAABgAAAQQAAAAAAAAApA8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/w=="}
01070{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":578124,"pkt_caplen":538,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":538,"pkt_l4_len":504,"pkt":"KDc3AG3I2MuK4S0uCABFAAIMOLJAAIAGO7jAqAG7wKgBdgG93hDyQzXr6KAJflAYEAanewAAAAAB4P5TTUJAAAEAAAAAAAUAAAABAAAAmAAAAKIPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAAGyBCUYXWdUBsSVXap371QGlpsNYnPvVAaWmw1ic+9UBACAAAAAAAAAAIAAAAAAAABAAAAAAAAAAFAQAAAoAAACxAAAACgAAAAAAAAAAAAAA\/lNNQkAAAQAAAAAADgAAAAUAAADIAAAAow8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAkASAB6AAAAAAAAAAAAAADyWnfrNIrUAcMy8HGc+9UBjNDtcZz71QGM0O1xnPvVAQAAAAAAAAAAAAAAAAAAAAARAAAAEgAAAAAAAAAQAEQATwBXAE4ATABPAH4AMQAAAAAAAAAAAAAAGpUGAAAABgBEAG8AdwBuAGwAbwBhAGQAcwAAAAAAAAD+U01CQAABAAAAAAAGAAMABQAAAAAAAACkDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00413{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":578187,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAl+8kM3z1AQqfyFVgAA"}
01019{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":585648,"pkt_caplen":466,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":466,"pkt_l4_len":432,"pkt":"2MuK4S0uKDc3AG3ICABFAAHEAABAAEAGtLLAqAF2wKgBu94QAb3ooAl+8kM3z1AYqgB5sQAAAAABmP5TTUJAAAEAAAAAAAUAAAEAAAAA2AAAAKUPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAA5AAAAAgAAAAAAAAAAAAAAAAAAAAAAAACAABEAgAAAAAAAAAABAAAAAAAAAHgARADAAAAAGAAAAEwAdQBjAGEAXABEAG8AdwBuAGwAbwBhAGQAcwBcAGkAbgBuAG8AcwBlAHQAdQBwAC0ANQAuADYALgAxAC4AZQB4AGUAAAAAAAAAAAAQAAQAAAAAAAAAAABNeEFjAAAAAP5TTUJAAAEAAAAAABEAAAEEAAAAaAAAAKYPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAhAAENAQAAAGAAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/wEAAAAAAAAA\/lNNQkAAAQAAAAAABgAAAQQAAAAAAAAApw8AAAAAAAD\/\/gAAEQAAAB0AAAAAKAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAA\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/w=="}
00586{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587479,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"KDc3AG3I2MuK4S0uCABFAACmOLNAAIAGPR3AqAG7wKgBdgG93hDyQzfP6KALGlAYEAQu2wAAAAAAev5TTUJAAAEAAAAAAA8AAAADAAAAAAAAAAAPAAAAAAAADQAAAwAAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAJAEgAMgAAAAAAAAACAAAAJgAAAGkAbgBuAG8AcwBlAHQAdQBwAC0ANQAuADYALgAxAC4AZQB4AGUA"}
00415{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587531,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAsa8kM4TVAQqf+DOQAA"}
01100{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587603,"pkt_caplen":554,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":554,"pkt_l4_len":520,"pkt":"KDc3AG3I2MuK4S0uCABFAAIcOLRAAIAGO6bAqAG7wKgBdgG93hDyQzhN6KALGlAYEAS2GQAAAAABgP5TTUJAAAEAAAAAAAUAAAABAAAAuAAAAKUPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAABZAAAAAQAAADPCUzktmNQBM3a2TJv71QGqtlA8LZjUAceu0c0iWdUBAAAeAAAAAACA9B0AAAAAACAAAAAAAAAAFQQAAAoAAADFAAAACgAAAJgAAAAgAAAAAAAAABAABAAAABgACAAAAE14QWMAAAAAAAAAAP8BHwD+U01CQAABAAAAAAARAAAABQAAAEgAAACmDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAD+U01CQAABAAAAAAAGAAMABQAAAAAAAACnDwAAAAAAAP\/+AAARAAAAHQAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGz+U01CQAAAAAAAAAASAAAAAQAAAAAAAAD\/\/\/\/\/\/\/\/\/\/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALAACAAEAAADNtesUnIBJiady75EwC3S7AwAAAAAAAAAAAAAAAAAAAAAAAAA="}
00415{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587634,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"2MuK4S0uKDc3AG3ICABFAAAoAABAAEAGtk7AqAF2wKgBu94QAb3ooAsa8kM6QVAQqfyBSAAA"}
00560{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"smb_deletefile.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1584368317,"pkt_ts_usec":587709,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"2MuK4S0uKDc3AG3ICABFAACQAABAAEAGtebAqAF2wKgBu94QAb3ooAsa8kM6QVAYqgANAgAAAAAAZP5TTUJAAAEAAAAAABIAAAEAAAAAAAAAAKgPAAAAAAAA\/\/4AABEAAAAdAAAAACgAAAAAAAAAAAAAAAAAAAAAAAAkAAAAAAAAAM216xScgEmJp3LvkTALdLsAAAAAAAAAAAAAAAA="}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":101,"source":"smb_deletefile.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":101,"flow_first_seen":1584368315417,"flow_last_seen":1584368317802,"flow_tot_l4_data_len":27272,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":270,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.118","dst_ip":"192.168.1.187","src_port":56848,"dst_port":445,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00135{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":101,"source":"smb_deletefile.pcap","alias":"nDPId-test"}
|