1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
00476{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"snapchat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431417993318,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":318652,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8f1tAAEAG3k0KCAABSn2IjYHRAbtgYhiTAAAAAKAC\/\/8GegAAAgQFtAQCCAoAKmfIAAAAAAEDAwY="}
00409{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":319843,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAalAABAGjBRKfYiNCggAAQG7gdGfnedsYGIYlFAS\/\/9PMgAA"}
00409{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":322345,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAof1xAAEAG3mAKCAABSn2IjYHRAbtgYhiUn53nbVAQ\/\/9PMwAA"}
00718{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":373192,"pkt_caplen":280,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":280,"pkt_l4_len":246,"pkt":"ABoRAAACABoRAAABCABFAAEKf11AAEAG3X0KCAABSn2IjYHRAbtgYhiUn53nbVAY\/\/9LawAAFgMBAN0BAADZAwNQUkrj\/NwhWGN+74t6DO1OzXkqPZ7NjCRqFpHWgKKF7SB5P2Jy9UHDO3+nUN7rdggpnyyuKLgakXSnjHmueU\/o1AAswCvALMAvwDAAngCfwAnACsATwBQAMwA5ADIAOMAHwBEAnACdAC8ANQAFAP8BAABkAAsABAMAAQIACgA0ADIADgANABkACwAMABgACQAKABYAFwAIAAYABwAUABUABAAFABIAEwABAAIAAwAPABAAEQANACAAHgYBBgIGAwUBBQIFAwQBBAIEAwMBAwIDAwIBAgICAw=="}
00791{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1431417993318,"flow_last_seen":1431417993373,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":226,"flow_tot_l4_payload_len":226,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"36e9ceaa96dd810482573844f78a063f","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00409{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":375603,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAa5AABAGjA9KfYiNCggAAQG7gdGfnedtYGIZdlAQ\/\/9OUQAA"}
00600{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":476626,"pkt_caplen":191,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":191,"pkt_l4_len":157,"pkt":"ABoRAAACABoRAAABCABFAACxAa9AABAGi4VKfYiNCggAAQG7gdGfnedtYGIZdlAY\/\/8EngAAFgMDAFECAABNAwNVUbSJQinlln\/8edE+8CspXRzVGNkcjqtzNcG7sXtSrCB5P2Jy9UHDO3+nUN7rdggpnyyuKLgakXSnjHmueU\/o1MAvAAAF\/wEAAQAUAwMAAQEWAwMAKAAAAAAAAAAAf2zZevNRbfwJe\/A1K5Q+MDebGGO+Uf8ZeAUlLlz2nCI="}
00845{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1431417993318,"flow_last_seen":1431417993476,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":226,"flow_tot_l4_payload_len":363,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","24":"SNI TLS extension was missing"},"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"","ja3":"36e9ceaa96dd810482573844f78a063f","ja3s":"fbe78c619e7ea20046131294ad087f05","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}}
00409{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":479525,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAof15AAEAG3l4KCAABSn2IjYHRAbtgYhl2n53n9lAQ\/\/9NyAAA"}
00480{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":533668,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"ABoRAAACABoRAAABCABFAABbf19AAEAG3ioKCAABSn2IjYHRAbtgYhl2n53n9lAY\/\/\/n2gAAFAMDAAEBFgMDAChjpkAEFO1Imock9wPzUl61uVUbhQtDgFJLyjkYPfyHn3wBcQOiHJ+Z"}
00409{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":534065,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbNAABAGjApKfYiNCggAAQG7gdGfnef2YGIZqVAQ\/\/9NlQAA"}
00666{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":534248,"pkt_caplen":235,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":235,"pkt_l4_len":201,"pkt":"ABoRAAACABoRAAABCABFAADdf2BAAEAG3acKCAABSn2IjYHRAbtgYhmpn53n9lAY\/\/8m\/wAAFwMDALBjpkAEFO1Im7ts7r9vIMM5uHkPA\/yBTyfRRzAGAH5A+yTbBmvQrg4bMm38fceyN4A3oL7ebB2KJZ\/\/+0N4q0T27fvdooYsha8TnDhL0Hp\/8Cykk7hvPnTbb1F\/VzChhtgIxWxY+\/kb1lZZ72J\/OFY7Gy6eGp211rWHidq+f6syv1L9octxVv3M0YMqviBQw6+lIPlRQ1aT6Fa6mpsOiZVclxU2AQ+r8nYUsE97cyWFTg=="}
00411{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":534493,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbRAABAGjAlKfYiNCggAAQG7gdGfnef2YGIaXlAQ\/\/9M4AAA"}
01137{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":534828,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAf2FAAEAG3EMKCAABSn2IjYHRAbtgYhpen53n9lAQ\/\/+7rQAAFwMDAyJjpkAEFO1InFuL7PegJ5aZt7UbyHCucmYjkh8cDwiMViQWAyhcPEgXRBh52WYs8bbds8SCoxXFo49C2n3DHEIC088k11Jrpeq31\/o+Hut+XBE8e8rWxDX89K5erAsfRBYirWdv0wF+IYU9xudlutSwjKHfV8cZ0J5XCtXmZXVJr1FiGJ6qz+ABfjdxkPCB1GlLDK0XYYWWpzZhgHSi3WAm4gRRXP1FUp3hRUfCyfotBPw5Pu3UW4FTRztGot4aqqWRS6fsoxTiFqQxCK7dRgu0H0BrR9cbsf2uY6Q3iBzJbOR3LxxUGoSEhdBS6UNaj7kiAjmYnUim9Bxh+dbIwHwqLoGlr8is+bZr5jqr7OvA6TvIgoTgVf6LT2paGZ+0eX6J98u+wg4+3J4eRn0XEbuky9JkFfslAmMo53gMw9loLfIW4WcRJugOAIyJmUoJiIVdj\/P4TWC4GV2zsW5\/QKreqHxbwhCUxTB2l4cQN\/gQJVXUQcZWRGhOJUG9LtAOeZ7Cze\/eneoaNbo1VIDn3W6j76B5PwKA7RBmFFFA40h3Ndu3pN02USR\/tw40bUhYVQWM9cLksoN29MJq0w8O9r7a4wgDR4Q8Ks4FMywt+gfcGU21zMewcdasPUnDzJlDFWqZmP2a1BOeN1JjF\/lhPdriIAqRE4Nj72sjraiksnXgIWAripOfm5ZxvWyLltQIXzlBA38="}
00411{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":535072,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbVAABAGjAhKfYiNCggAAQG7gdGfnef2YGIcdlAQ\/\/9KyAAA"}
00785{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":535256,"pkt_caplen":325,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":325,"pkt_l4_len":291,"pkt":"ABoRAAACABoRAAABCABFAAE3f2JAAEAG3UsKCAABSn2IjYHRAbtgYhx2n53n9lAY\/\/\/YKQAAVnC0jR2z5CJlKZ8fFFQ8iRLZP172ZMrsOdo1SYpVQsQaoADocXdPgUrE0Pnq5UHQfeORu9\/czCm6OlgNS+YaLiqXdxksA+wiCdfpYmwCi\/6Nxlq6\/m3RaHuR0Z5xjL1StUO4mzH5UcsjkROn7NVe5vAVF9H7hWfYf\/LMtivYeaNQDAYnc3CoO6FCTYqyAICPE\/ljwAR\/YlV9wUHpuGfK0MtD6UAN8xX92tRW7hWhs8asthEs+J5bfrnZcCHsBVGhsRvljOga8XVhi50v4xcKnca3jR4+GaR5e519J810NayxCAAqQKIp2HbcxnASL94+PONXQoAPl3MQQEgb7UxHoAnlIFIkYEl4mj9MR2B6yQ=="}
00411{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431417993,"pkt_ts_usec":535622,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAbZAABAGjAdKfYiNCggAAQG7gdGfnef2YGIdhVAQ\/\/9JuQAA"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":23,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431418008131,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":44536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00438{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":131807,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8OQ1AAEAGJJwKCAABSn2Ija34AbvuolTmAAAAAKAC\/\/8JnAAAAgQFtAQCCAoAKm3rAAAAAAEDAwY="}
00410{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":132967,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAeJAABAGi9tKfYiNCggAAQG7rfgRXasZ7qJU51AS\/\/8jCwAA"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":25,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431418008133,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":56193,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00438{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":133607,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"ABoRAAACABoRAAABCABFAAA8wNFAAEAGnNcKCAABSn2IjduBAbsrgq06AAAAAKAC\/\/9G3wAAAgQFtAQCCAoAKm3rAAAAAAEDAwY="}
00411{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":135133,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAeRAABAGi9lKfYiNCggAAQG724HUfVLFK4KtO1AS\/\/\/1gQAA"}
00410{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":135378,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoOQ5AAEAGJK8KCAABSn2Ija34AbvuolTnEV2rGlAQ\/\/8jDAAA"}
00411{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":136568,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAowNJAAEAGnOoKCAABSn2IjduBAbsrgq071H1SxlAQ\/\/\/1ggAA"}
01111{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":138643,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"pkt":"ABoRAAACABoRAAABCABFAAItOQ9AAEAGIqkKCAABSn2Ija34AbvuolTnEV2rGlAY\/\/+krQAAFgMBAgABAAH8AwOhEVtKJFbmMdITP5FzjInwHIS\/R2esElHqAErlmxUy8CACAgRWcgR9w4k0fccFDBFgltGnL9Eev8AwahrxGVyDbwAcwCvALwCewArACcATwBQAMwAyADkAnAAvADUA\/wEAAZcAAAAhAB8AABxmZWVsaW5zb25pY2UtaHJkLmFwcHNwb3QuY29tAAsABAMAAQIACgA0ADIADgANABkACwAMABgACQAKABYAFwAIAAYABwAUABUABAAFABIAEwABAAIAAwAPABAAEQAjAMS7WjP546+2lF\/TKyZI1bqIDoSMpbWj033whzxbUsavA0etyrZ4bKy5YSQsnhoz8RnY+\/yWt\/LQE9Z6ryY2tS2fDeIY9FtoXb0PXCAhPOZ9PZLgbr5sz9tAG9IyywPJZ6z79yL6zaCwJFb69s170JD9vfS74pAn3H8WYSxk9sXMidEjgizByb1wRsJYo7f11VDDw7z51tPC3nJwPfffTWJrmhbc9Lbb832t4bcLlJFcU\/yNM14PJqZdRRsDPXFzlk5o6fcwAA0AIAAeBgEGAgYDBQEFAgUDBAEEAgQDAwEDAgMDAgECAgIDABAACwAJCGh0dHAvMS4xABUAMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00750{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":29,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1431418008131,"flow_last_seen":1431418008138,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":44536,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Snapchat","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"feelinsonice-hrd.appspot.com","ja3":"fded31ac9b978e56ce306f8056092f2a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"http\/1.1"}}
00410{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":141329,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAedAABAGi9ZKfYiNCggAAQG7rfgRXasa7qJW7FAQ\/\/8hBwAA"}
01111{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":141878,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"pkt":"ABoRAAACABoRAAABCABFAAItwNNAAEAGmuQKCAABSn2IjduBAbsrgq071H1SxlAY\/\/8b8QAAFgMBAgABAAH8AwNZW7OoopxmUl9aAmMbvJ5KlPrEhizm1d1wyfHascr\/qiACAgRWcgR9w4k0fccFDBFgltGnL9Eev8AwahrxGVyDbwAcwCvALwCewArACcATwBQAMwAyADkAnAAvADUA\/wEAAZcAAAAhAB8AABxmZWVsaW5zb25pY2UtaHJkLmFwcHNwb3QuY29tAAsABAMAAQIACgA0ADIADgANABkACwAMABgACQAKABYAFwAIAAYABwAUABUABAAFABIAEwABAAIAAwAPABAAEQAjAMS7WjP546+2lF\/TKyZI1bqIDoSMpbWj033whzxbUsavA0etyrZ4bKy5YSQsnhoz8RnY+\/yWt\/LQE9Z6ryY2tS2fDeIY9FtoXb0PXCAhPOZ9PZLgbr5sz9tAG9IyywPJZ6z79yL6zaCwJFb69s170JD9vfS74pAn3H8WYSxk9sXMidEjgizByb1wRsJYo7f11VDDw7z51tPC3nJwPfffTWJrmhbc9Lbb832t4bcLlJFcU\/yNM14PJqZdRRsDPXFzlk5o6fcwAA0AIAAeBgEGAgYDBQEFAgUDBAEEAgQDAwEDAgMDAgECAgIDABAACwAJCGh0dHAvMS4xABUAMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00750{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":31,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":4,"flow_first_seen":1431418008133,"flow_last_seen":1431418008141,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":56193,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Snapchat","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"feelinsonice-hrd.appspot.com","ja3":"fded31ac9b978e56ce306f8056092f2a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"http\/1.1"}}
00411{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":142062,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAehAABAGi9VKfYiNCggAAQG724HUfVLGK4KvQFAQ\/\/\/zfQAA"}
00618{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":294053,"pkt_caplen":206,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":206,"pkt_l4_len":172,"pkt":"ABoRAAACABoRAAABCABFAADAAetAABAGizpKfYiNCggAAQG7rfgRXasa7qJW7FAY\/\/+zsAAAFgMDAGACAABcAwNVUbSYnv8lFkwrP3tkn4HenuHfYNVayyWpsUxN9vxrPCACAgRWcgR9w4k0fccFDBFgltGnL9Eev8AwahrxGVyDb8AvAAAU\/wEAAQAAEAALAAkIaHR0cC8xLjEUAwMAAQEWAwMAKAAAAAAAAAAAXacoUY2XPyBFJGfEF3Th1vw79TgzZopqWjm3nxKar8M="}
00804{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":33,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1431418008131,"flow_last_seen":1431418008294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":669,"flow_avg_l4_payload_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":44536,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Snapchat","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"feelinsonice-hrd.appspot.com","ja3":"fded31ac9b978e56ce306f8056092f2a","ja3s":"7bee5c1d424b7e5f943b06983bb11422","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"http\/1.1"}}
00620{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":294450,"pkt_caplen":206,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":206,"pkt_l4_len":172,"pkt":"ABoRAAACABoRAAABCABFAADAAexAABAGizlKfYiNCggAAQG724HUfVLGK4KvQFAY\/\/9r2QAAFgMDAGACAABcAwNVUbSYmROcimMu8n3UiA4V9o6+qZRQpBjKJ9EfdyRo\/iACAgRWcgR9w4k0fccFDBFgltGnL9Eev8AwahrxGVyDb8AvAAAU\/wEAAQAAEAALAAkIaHR0cC8xLjEUAwMAAQEWAwMAKAAAAAAAAAAADDcXv+W8vtUMi18PvtyGNW\/DmWyzX37WYnllu2M793g="}
00804{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":34,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":6,"flow_first_seen":1431418008133,"flow_last_seen":1431418008294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":669,"flow_avg_l4_payload_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":56193,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Snapchat","breed":"Fun","category":"SocialNetwork"},"tls": {"version":"TLSv1.2","client_requested_server_name":"feelinsonice-hrd.appspot.com","ja3":"fded31ac9b978e56ce306f8056092f2a","ja3s":"7bee5c1d424b7e5f943b06983bb11422","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"http\/1.1"}}
00410{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":295945,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoORBAAEAGJK0KCAABSn2Ija34AbvuolbsEV2rslAQ\/\/8gbwAA"}
00411{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":36,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":296189,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAowNRAAEAGnOgKCAABSn2IjduBAbsrgq9A1H1TXlAQ\/\/\/y5QAA"}
00482{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":296495,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"ABoRAAACABoRAAABCABFAABbORFAAEAGJHkKCAABSn2Ija34AbvuolbsEV2rslAY\/\/9RZwAAFAMDAAEBFgMDACg\/yxy\/isn7sp4msLqfjCgWlkRFGBF2Q3Vx+rR9jOq2HtyKTSD1PBM5"}
00410{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":296708,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAe9AABAGi85KfYiNCggAAQG7rfgRXauy7qJXH1AQ\/\/8gPAAA"}
01145{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":297136,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAORJAAEAGIpMKCAABSn2Ija34AbvuolcfEV2rslAQ\/\/\/rewAAFwMDBPI\/yxy\/isn7s62UJxnAMXh3dvQ1FR0BAyKUkmzGrbRl0gXfqY\/qfj3B60ZEj1t5HXW8WDe2jPkt2XB2v+kf0+QngDxGXySuQDmblX07nRPtLgRrklcyeTofbXYASvTR\/4+XMSedP4S\/aJ64NLTxjwSwGbg5X0qGgA9B9H8UeAEVL7TFeDsQPbMAQ0pG5TBb+sdRYeXeoVsHyy8b7OpscMBpDZrQ58kn8RK3Aa6YMdc4+qRAqehNay6Zngsj4n0\/XT9fIhKtSh5+wtDCo3WYNAXuAKaF9dJN0mdnFXkYtyJc8bff4QCIIDW2ZoOcMQPmNVSJp62NNJ9WJbDGznNHLjc5msvYYLqWF4+u8l527n5XgX2m3JTOK\/DP7S30rwWQ5yAnXWTSmZ0\/cF+EhOD89dVjqv0HBzTssaDdmgBLvX0vUzWSCrWcz43siIEiweuvLQXFbV0AOQJASMo4K01fjzpUFKMm7vWuNZk0Rxd1evLAiAq7I8okpNO2Xxfymo6\/z\/lwCk3zyNGxz1Y6YC7Eh3LgsfauSHZPp\/\/4RmjyWd1Q+PwtIWBW3iBR0UJZ2YUeyzh4Y5EsSdv29LR1glRjhPXztNbUns+kFn1Ulnxl9eTMvMA1\/UDX43WYhn7FAQAAqIhRhtk5YK0brfPFUinOQ3926BehWzO7QVw7jXjWngKkMDmg1qafBaBek1YjVCdPHE+w\/P4="}
00411{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":297319,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfBAABAGi81KfYiNCggAAQG7rfgRXauy7qJZN1AQ\/\/8eJAAA"}
01144{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":297471,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAORNAAEAGIpIKCAABSn2Ija34Abvuolk3EV2rslAQ\/\/94AwAAjErMpOsOwWHz6MPvoG\/ZHcDuKa5LP5+jFcnbC+cOYaXUYQ6dkw\/kcTw9m8JYp\/sOCAutSafXvixYVLHmzeGv50yOdgiMnUJEKnDUiQsY5QaYZ8R2\/JT+\/eTMi8F3vovOK5IHfPQ61hXDi6AqyTPG+LAAxtlCf7jHgV1tpvedPPN2HtyWETkGslx559gKtFQBp5hBAnSMbgFmbsL3pqgQurtkiFX9LrcRExO1yf8p9h6Hvg0mJP2LZ9OvW9b0Tf2udphLZmKkeNPwIYxqX6J3dnJ2EtsQAGMkRc+WQ7cEaidxxCIPK6MWoJ5GFNH4AWz14D75qqQI94e3pLBXwwPRFZs6LljU32ufzzNnQjFGvzke7USGa0Co1UWQ3R4buDxn0AhyJQHCwQ+iGhJ\/KvpaZ6byVBCO\/MJ9tUc9thkqa7m5U7aRiNuUK\/g6vLUvScnMyofHFl3P3SEjRgDTUSMsLhWzDv7sklRoRGufqRteO0VJ\/YrQzmmqp525+4PbLGVdlfDkkQoywpBlK+rANxuSi6xFSOu\/uYJyTxuozNNdYNegFvIauRab5UWEaiKjK\/WC+Vb+3O9cLktDZPKDa70BaWcNKYSGEzVIlsawKn7\/x6E84JzzxARbwDa5uRFPAOZH5+GELkP1dIPCSDw6+pyp6gr+O1cC4J94fH2M7QPic\/0a9E\/f9jJc8euOX3NBdDDEXQC83eXVWm0="}
00411{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":297685,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfFAABAGi8xKfYiNCggAAQG7rfgRXauy7qJbT1AQ\/\/8cDAAA"}
00685{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":297838,"pkt_caplen":253,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":253,"pkt_l4_len":219,"pkt":"ABoRAAACABoRAAABCABFAADvORRAAEAGI+IKCAABSn2Ija34AbvuoltPEV2rslAY\/\/+4KgAATPLlHnlMwVPMY3wN8GKj4lrDg+GYU76nwUHz+UjdXUaAGZ0fvbtAbP+ja0DxISIvnNR+NVh51N4gSCGKkbebxk8\/N\/ATfKDvEOIjjxDht1LpwfakTOw4a2GwYHEwO5Zc2bzZaRkCqH1SpR6hKamSk8AcJdOjmZPRsAkKxjEmjzdXbEtC2I1hMz1wX\/mSVhoXgJnbzFtBYBwtHDHAQFp5batgoINSt98mxTu71dYfcAzE7CJnb5u8S5EM2TgDkY6bgpo59HYK+A=="}
00411{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":298021,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfJAABAGi8tKfYiNCggAAQG7rfgRXauy7qJcFlAQ\/\/8bRQAA"}
00480{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":298173,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"ABoRAAACABoRAAABCABFAABbwNVAAEAGnLQKCAABSn2IjduBAbsrgq9A1H1TXlAY\/\/+tkAAAFAMDAAEBFgMDACiTANECLV5gyrmsEBxSetKObvy84tLkwEhQmWtdNsvkTmFU5Ry2Gp9E"}
00411{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":298326,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfNAABAGi8pKfYiNCggAAQG724HUfVNeK4Kvc1AQ\/\/\/ysgAA"}
01143{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":348684,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAwNZAAEAGms4KCAABSn2IjduBAbsrgq9z1H1TXlAQ\/\/+3hQAAFwMDBLuTANECLV5gy4HfV9LX8dSQgBzeO7DeX+weMF8GF7e1LC1b+ToibH9tyZlffB8Uhfgvr4v0PL1jd+1nW35dH4ZRVAVObDWYtz5qwjyx5h1jd2qU3AGF1KcuvyzG9tB83YJXoDrUo9PwMm2DYzlEqLuc+qjgW2aRdCYrmYkieecj6ZD8pXouDq3n2gyz+QlmK\/\/SaqB8LqVYkL1wwKY1+0JuRp2UruXLCtxqBaEdcwH\/QVOAsFlF5DOSyzSZKH0vkhtw+vaGW6An\/o0JExOABKsvzy\/sefM9s4LpBZZRJYCWiu2tLZuVj3gnYtCtRk7GPdvVbMuYTgyjIuad5WwhWMWYtaKv8Mln17kaIR9BVcVskWKOS48YO+BEgdQmWVAVSPfEKNTmD9jbLT8TwuJ4z5vbezNgkhPzV+Ij29X48cKCQJOoTOGkT8icrm6+e\/QI2rkLhi6ALWPYQwbdjOxl60TUO2u4GBc53G2xJrpJld3ry7ufoMeMBfouj+boBAgm\/wFazJtiwJvWkEPU8336\/4j2NsQU\/qX30KHiIme4y8RTlGYSsZhxz8J\/eBFace3P7\/KgpT\/Kv51j+Z5pLZUr0il7nNrULxRCiKO6WmqjU7Fw228lKtJSfQAWA92jMLl8QzWJeNd1xx\/hDqrnWErAZ1fPqCyWQOyVuRIP2+6KWnTM52pjzyHCsvEfP3Et1bcUwA1c1EM="}
00412{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":348990,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfRAABAGi8lKfYiNCggAAQG724HUfVNeK4Kxi1AQ\/\/\/wmgAA"}
01144{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349112,"pkt_caplen":590,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":590,"pkt_l4_len":556,"pkt":"ABoRAAACABoRAAABCABFAAJAwNdAAEAGms0KCAABSn2IjduBAbsrgrGL1H1TXlAQ\/\/\/qDAAAk2+qycyV9g+MVKpXbwYubpVyYG3dZhDEYaoH9Jn+5oj08ckn+oplVF7tRwRjNg020l1t\/EEG\/bZMXaWkA09oGXUSkpH18SjVbBrUQFTVu33uNUUCwjfZlM7qgh4tcVOp2oQhrb\/mpWd6cAApBINxGiia6GL13W1X3l\/lVkDRypn0sNyyOOJOXfFA1QAvHTkowRE\/fiEdU5V7q4dTkTb0hyUQIU0dFvBF3PJpGQkpBGPVg2K9SRwD1CLrEedagVaYTXD4GLGHdh9nv3Kdc5nqd8JYm\/VKTgIprxoam6I30yFx0fpUiZ7mlF8D0eeOrKoFxuTFIIgKgzL4w\/1hQiS7i3AHrubrmOdhd0Kz8aFtigiNeJ9Mh8wpsBJegrjcnddlqGxREpzCb28G\/CszBT989Ot3dNZ0kFb4pIEQMGsNgAm3n8X9MsZQK4WK4\/h2zypIEAC6oFSbdI3STdV3Yg38iHrmDmK+r7\/gbo5b93rPlMwElBmn76plWmy3JAD8PsA3vQXEYWUJpDU3V3fCthV2aVc2cE94lAL08Zw9UsdZ07nw4NJgOiEzY8HqxkKykQ+g9n7IJV9s61I7Y593NnPNrmbudnPveYUVso9jBZd354s1YJ2wzASfncWqpo\/v9Oa8SkMaum19T90NuylZyzdsTM6PosW4V\/ToAdYS7j\/hY2kLf1yJ6HogA9wFSVIj8TJUHCK9LqAFYZU="}
00412{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349295,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfVAABAGi8hKfYiNCggAAQG724HUfVNeK4Kzo1AQ\/\/\/uggAA"}
00612{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349448,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"pkt":"ABoRAAACABoRAAABCABFAAC4wNhAAEAGnFQKCAABSn2IjduBAbsrgrOj1H1TXlAY\/\/\/G6wAAstjj3\/bsqpZpfZBbB0U0MfQ1fvcBtg\/ngUbvEy0ydo\/TCHa74MV9Zwi2677DhjDQ7Y8hgLv04yaniKcq9e1oXDbG0nZBEfAhi3hvl9olQoHXtdnYwEdx7D2DuVvaqcLIx2lazMNmhLU53oscsI35lmtDhvLcFW6nY5DJFHZ\/uvNo7JO137yNDEMdsY\/zZaRu"}
00412{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"snapchat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431418008,"pkt_ts_usec":349631,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"ABoRAAACABoRAAABCABFAAAoAfZAABAGi8dKfYiNCggAAQG724HUfVNeK4K0M1AQ\/\/\/t8gAA"}
00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":22,"flow_first_seen":1431417993318,"flow_last_seen":1431417995589,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":1671,"flow_avg_l4_payload_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":33233,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":17,"flow_first_seen":1431418008133,"flow_last_seen":1431418008853,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1069,"flow_tot_l4_payload_len":3005,"flow_avg_l4_payload_len":176,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":56193,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":17,"flow_first_seen":1431418008131,"flow_last_seen":1431418008701,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":536,"flow_tot_l4_payload_len":2439,"flow_avg_l4_payload_len":143,"midstream":0,"l3_proto":"ip4","src_ip":"10.8.0.1","dst_ip":"74.125.136.141","src_port":44536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":56,"source":"snapchat.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 56/56
~~ skipped flows.............: 0
~~ total layer4 data length..: 8295 bytes
~~ total detected protocols..: 3
~~ total active/idle flows...: 3/3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 4834173 bytes
~~ total memory freed........: 4834173 bytes
~~ total allocations/frees...: 58425/58425
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|