path: root/test/results/teams.pcap.out

00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"teams.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1587041672419,"flow_last_seen":0,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":279,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00777{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041672,"pkt_ts_usec":419153,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzES1AAEARZ+TAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGABgr52AAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1587041672419,"flow_last_seen":0,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":279,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,3"}}
00372{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041672,"pkt_ts_usec":611330,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00143{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2,"source":"teams.pcap","alias":"nDPId-test","type":38}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"teams.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1587041673094,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"149.154.167.91","src_port":58533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00419{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041673,"pkt_ts_usec":94451,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGPCDAqAEGlZqnW+SlAbsZTPC7DAoX94ARECZ4MwAAAQEICjCEirAtAPMf"}
00383{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":4,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041673,"pkt_ts_usec":412435,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":4,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00372{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":5,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041673,"pkt_ts_usec":611235,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00143{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":5,"source":"teams.pcap","alias":"nDPId-test","type":38}
00372{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":6,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041674,"pkt_ts_usec":611244,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00143{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":6,"source":"teams.pcap","alias":"nDPId-test","type":38}
00420{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041675,"pkt_ts_usec":216685,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGPCDAqAEGlZqnW+SlAbsZTPC7DAoX94ARECZv6wAAAQEICjCEkvgtAPMf"}
00383{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":8,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041675,"pkt_ts_usec":409077,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":8,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00372{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":9,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041675,"pkt_ts_usec":611218,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00143{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":9,"source":"teams.pcap","alias":"nDPId-test","type":38}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"teams.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1587041675997,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60813,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00457{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041675,"pkt_ts_usec":997451,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"EBMx8Tl2KDc3AG3ICABFAABPKfkAAP8RDk3AqAEGwKgBAe2NADUAO4czzp0BAAABAAAAAAAAFHNreXBlZGF0YXByZGNvbG5ldTA0CGNsb3VkYXBwA25ldAAAAQAB"}
00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"teams.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1587041675997,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60813,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"skypedataprdcolneu04.cloudapp.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":10607,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"KDc3AG3IEBMx8Tl2CABFAABfTWlAADkRcM3AqAEBwKgBBgA17Y0ASwAAzp2BgAABAAEAAAAAFHNreXBlZGF0YXByZGNvbG5ldTA0CGNsb3VkYXBwA25ldAAAAQABwAwAAQABAAAACQAENHJNIQ=="}
00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":11,"source":"teams.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1587041675997,"flow_last_seen":1587041676010,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":67,"flow_tot_l4_payload_len":118,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60813,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"skypedataprdcolneu04.cloudapp.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.77.33"}}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":12,"source":"teams.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1587041676362,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60532,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":362386,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIex0AbuczSMnAAAAALAC\/\/99oQAAAgQFtAEDAwUBAQgKMISXcQAAAAAEAgAA"}
00434{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":405623,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8L\/5AAGwGm3w0ck0hwKgBBgG77HRJoiConM0jKKASIABWrQAAAgQFoAEDAwgEAggKYQZMqDCEl3E="}
00421{"flow_id":4,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":405727,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex0AbuczSMoSaIgqYAQEAmVMgAAAQEICjCEl5xhBkyo"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":15,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1587041676435,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":435900,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGghTAqAEGNHHChOx1AbsuhcJCAAAAALAC\/\/\/XIQAAAgQFtAEDAwUBAQgKMISXugAAAAAEAgAA"}
00423{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":448366,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0CixAAHUGQvQ0ccKEwKgBBgG77HWQGjC4LoXCQ4AS\/\/8WpAAAAgQFoAEDAwgBAQQC"}
00405{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":448463,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx1AbsuhcJDkBowuVAQIAA3YwAA"}
00689{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":449862,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"EBMx8Tl2KDc3AG3ICABFAAD6AABAAEAGgVrAqAEGNHHChOx1AbsuhcJDkBowuVAYIAChLwAAFgMBAM0BAADJAwMtfzNr5sJ0vwUnIfI3TV9sTsGbPpwfZOWfmMdYc+2laQAAHLq6zKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACEuroAAP8BAAEAAAAAGAAWAAATdGVhbXMubWljcm9zb2Z0LmNvbQAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAABIAAAAQAA4ADAJoMghodHRwLzEuMQALAAIBAAAKAAoACNraAB0AFwAYABsAAwIAAnp6AAEA"}
00741{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1587041676435,"flow_last_seen":1587041676449,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":210,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00413{"flow_id":5,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":462228,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoCi1AAHYGQf80ccKEwKgBBgG77HWQGjC5LoXDFVAQCAROjQAAAAAAAAAA"}
02368{"flow_id":5,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":463856,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCi5AAHYGPFI0ccKEwKgBBgG77HWQGjC5LoXDFVAQCAQshQAAFgMDF4QCAABmAwNemFWMOwvyyx98MPDpobiZrVYPHPwmzf3\/rqSZvCgYpiAgPgAA6ItZFOaiSOVhga+svmIZUZRfrWAIsMqwTIVN78AwAAAeAAUAAAAjAAAAEAAFAAMCaDIAFwAA\/wEAAQAAAAAACwAOdgAOcwAItTCCCLEwggaZoAMCAQICExYACfRizWOR6fGx5P0AAAAJ9GIwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MDkxMjE4MTY0NVoXDTIxMDkxMjE4MTY0NVowHjEcMBoGA1UEAxMTdGVhbXMubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOO+GAF5FB9ACneJsYJqU+PaAkwhs3Pmnh9LB9B35XWkyrIOYraOvvuhrHxhFcxbMuiVa3ke581gm0OvyNFkH2vhqLGtQ51IvKov0oZNIk4rt1kgisStRRDSjUTgKLPQ44s9fKS9qz\/Va1Q2\/LQEZQNYdKcaI2nANY2RmggVm7Aa\/Dx1r4sJ2SJmuRoiN6m9zGBwTorEnL9Q2Qy5FB5\/iaYy2JMNbemS7IbV+TczygQFu\/QwI3ZrqvbUGdtEzDIOU7YZXOmC6UcqvvcY0rIuNd65HCSFAv0X9ivVh0LGDegTyjuqKz68YmBI\/eJFXu94jw\/tEDwiIAZfs4Qk12UiGJsCAwEAAaOCBHgwggR0MIIB9QYKKwYBBAHWeQIEAgSCAeUEggHhAd8AdQDuS723dc5guuFCaR+r4Z5mow9+X7By2IMAxHuJeqj9ywAAAW0mulFVAAAEAwBGMEQCIHebEsXaxq31cmEfhRo\/gehRDe\/E1VvIxKmBjiYm513RAiBg9lvKKuXFDabtrglkBNY11LNgy+HL5dblDYVf8MIppAB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbSa6UVUAAAQDAEcwRQIhAOXf5ZJgk7Qqrx2VlFvAiEAHVXnD3mS7WxPkEHf9oGczAiA4\/Ss\/FGYnu0+Vqu\/igskDlNIA5yQpWRpemVD\/90ZvtAB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbSa6UqQAAAQDAEcwRQIhAOcvU5U2Fi9LD1ckKACgnV\/R4RUZapoJoV\/V8Nkdsox8AiB+s48woDYS2UZcbGfro+s0PlMOsyBbDvpNcsr42cSgwgB2AFzcQ5L+5qtFRLFemtRW5hA3+9X6R9yhc5SyXub2xw7KAAABbSa6UYEAAAQDAEcwRQIhAIBIEv6AY07+qXpuv9wKUq5PN5rdrOhWtdzhJm8jXedKAiBSHHhgI9NvoD6YhCpK3V\/Qif41w296yUSCK7eujn89vzAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYEFCbjW3RNU09jtsrWbR3zyYhJ"}
02358{"flow_id":5,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464089,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCi9AAHYGPFE0ccKEwKgBBgG77HWQGjZlLoXDFVAQCASK9wAAxC7UMAsGA1UdDwQEAwIEsDAeBgNVHREEFzAVghN0ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUenuMwc\/noMoc1Gv6++Ezww8aop0wHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAjJY5eD13an7Bpx5xxIqIPAsj0wiAkSQlVHG2eWn1U7EMYkaYNm1bcZdbxatFHak6SPpDF\/BFWOAuxpq29sjki83Ws\/tIbRtncE4DVkv23fvgeWG2G8sq5qx4c5qA830fqmXSktLgOpsdgmBaOYSsTY0x33dUHa4NMN17Lj60Gsd3yzeSYx7BQkMQJ\/V8Vdknwzcy4ja6ZEHFlhJa7naHWvheu4dpEV12l\/I7XnKJj3AvK6V0oRh9ztLUCO5SEw\/4IchbkuDrjeM7N7xqdsbAB+zxItuIRkK6NPYNfq2P1YcBIYP\/55E1YA\/2W2kVT3L2yJ3TBXNrhGw8kxGBtYIUDJYcydM9DjdbmXfvOOXkrLnLmQLDNp1UY2giyd1SVy6dmyy4UPGdKMrUjUJxLeLEth\/qlHwMQ78rdVWdoP1WKC\/rLalfyuTCeXW4p3qIF7Av0WcDgkUyDRhNrOo0xzsIbxL1KpcpwCXtJW8Gn3LPsecGEsCzZJ4Oio5x7suMWRhIOATNYjrQKjkP5yhS6WUM11anpHQdizI1hSi0Dsn9iu9KVNBmLjAhQpIWNLvziKckaPyFYM8Jju2yhenSjGdxKE8kwLk8CNf9zLVQ456aLfF9ge8FhSE9Tl8aBpIGGPaqGtl414VBcDE1HXqCtckuHxFFd2OvG07l2FddY0bGOrgAFuDCCBbQwggScoAMCAQICEAtqs7A+san2xGCSaqjN\/rMwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUyMzhaFw0yNDA1MjAxMjUyMzhaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKvl612jazme9TSIErsdUiZdfQkLxnmOq7cO3xmy3e4P9u70VuRG4pIP4mcL4xxxpNRBc7TLmRaOv3d9sK8ebO1xLsMId0pekq7sWtBIgdDF6aD1eo8ejV7TrZLA2saRNTEguTkEzRAqPJcdAJ6ZGBgJz0uX5Mn8APAMWp026LJAwUqshCiqPUYYK6eKrPSvS6h+SULHYiDA5qc7XeuQH7uK2JyQ4zqxbMKUzj4ya8txs0EuucXhXdhZJ4L74UgNfugE8fkBJ0H6lFp9xTC7"}
00405{"flow_id":5,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464151,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx1AbsuhcMVkBo8EVAQH9IrZwAA"}
02367{"flow_id":5,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464343,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCjBAAHYGPFA0ccKEwKgBBgG77HWQGjwRLoXDFVAQCATA1wAAtrrXEZuI+gHMbkuSufh4PMucaJoWZojQk7Aqgy6XER1+gSBh5LC5m5xuU5WVIsbZvXUQutl1jDw\/HdCW+DNFe3sfVDPlSJenBSSi29Hcla4gKn2WiUh7knrQJLHeSBH3Zzy03\/hYYPVPezRo5v2sJgi28yxD20\/EFtCbDHGHsQdrht2PoLH7ZtrYy+ny8GXljtgc6i+6LWTxXtAbULIMhUrPO8guKmp1jMCuXNnpwHx9fNqc471KsGAHgit9XcgQry5ijNya\/eHZuVlIl0Iaw1CBCx+DImvkm7wpIoL9gFFcdV8ONcLdfy96Z589jluMu6+d9MwM+6gfnSHB8+dSGl3OFFdtULhJ7rELJ9LiaScSbsbAJj7npCsbi1M4BvoahzrgS3+ZFk5ZPVlp8XGnZWUbAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUenuMwc\/noMoc1Gv6++Ezww8aop0wHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAEf5yBjohCjduyPUpIgJinkUO7foGn++\/niQ1F\/45iLK7AeF439GLl\/23d\/GKck9JOuizKdd0h+S58xdgh4iSVYK92X0TSH8GkDqJZuedlveVzWAP1+HK9nbu+ps1SKGYfdKTKk+BFseolrvRJfOmb1DaAJsqqPQ1AOP9LDvt5RWbfxYPx47JNiCU8B0BuRJQUJmB4ChCLI54\/+3GntXkyumgqrNIT6Rf5IsY\/xMCLZARNhhmKDoimt6V8Vnun20qF3WTUMMFEtXeZLS2vNvXdln+pdblVuH+Rlw7ivjsDvvvEpCRziASgbo8UuN\/40D0DEEgZocY2jJp4PbcjyjyvRYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBSf5XT0Ei8HGSR2kg+kjipmqRRaChgPMjAyMDA0MTQxNzQyNTNaMIGbMIGYMEwwCQYFKw4DAhoFAAQUIq8AHIB1Ygcm4MiTGuynQhwyEjoEFHp7jMHP56DKHNRr+vvhM8MPGqKdAhMWAAn0Ys1jkenxseT9AAAACfRigAAYDzIwMjAwNDE0MTc0MjUzWqARGA8yMDIwMDQxODE3NDI1M1qhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNTE3NDI1M1owDQYJKoZIhvcNAQELBQADggEBAGlk67Jed\/sp+WACNyn5PUUCNwjOEeSke0b79rtlfnnsSw96zwY2F9SV5Z+xW\/rcmSBDX3jg2nQuBEYA9Wvb9+nT6wkNSZ3ZaRWaif7D80Ixt0ABQToOKkrnaoitWqZpliCv6hPQ4FHx6fGtYnAq9q9N56uOy4CZ9I0jDblf\/FnYz8D+zATdvR\/f7OM1VEn4zgnDtJwqmkl+FEoMVdKQXenp1svVvECDF\/6TxBHv2VWGT71GDA66oH2k3FZzUb2W\/Ysq9qJqUK7mRSkWU4IlWh1O8jlIgWYtMhV8J8LVkHQPJqf4uSK+b07ApUiDUHFCRtKk0kiUZ7zJzQtTzquptSagggUjMIIFHzCCBRswggMDoAMC"}
00406{"flow_id":5,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464401,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx1AbsuhcMVkBpBvVAQIAAljQAA"}
02367{"flow_id":5,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464457,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCjFAAHYGPE80ccKEwKgBBgG77HWQGkG9LoXDFVAQCAQqtQAAAQICE3gAErJ3YfnO2ox+\/bwAAAASsncwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTIwMDMxNTE1MzUzOVoXDTIxMDMxNTE1MzUzOVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV80X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAEyAX+5SqsGiqoUBRMLbUF1MOQcsxK8kPSKDVxGywx62TXqosok\/w8WIw51eitl2x7hGoq0+h3f95iPllxy7yEMgH7qmedNRiuGxRK+fAa5MH9aVtlomaFyqBArysde41\/HXuL4UW4GtwiAkT5ExgE2wHYEV7T5X03YsAWWM3JKQwMjB+rXZkft+Uk5MWL\/cJto5+yML0QwJr2wL9Ak66bKsuEMnGd8UzoAOAp5Rk0DmxRztNTjl\/lZ2ntFXsAyJALx3q0EDreLw0q2SftDOieUHmNsOvbAPjYsWKtDXayhXR0gqkwAbamSUrmFXf6QE7XDQuHTRyG7d\/srUScNlDAgMBAAGjgdYwgdMwHQYDVR0OBBYEFJ\/ldPQSLwcZJHaSD6SOKmapFFoKMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBQf\/nlSogs2KaMuQIKX+dZl6u\/fN4stOkBATIA+8WfgJ+qNyF20yCllnRhbqa4pd5JTrRYGJZhGA7agazmyim9wGvV0HcHxLLN3oNZBP5gF5jLC0IqxgJEvTiyy1\/1wYRdtr+SpcKNi2ZCac3x7voBvsf3YH\/f1jAp2zQ87qKhRy1PmcUkJdsJR2OnkYNgdR6oPKCsPkPve+qZXjBdfEVjq9duYM1IFFq0MYXUlFCy8YhnxEcasx4mCnA6B14O98ewaSZZhGaP6Py\/67LRhuWf36qXptvXI8bFJZEld25A5aR+COHvYWrlWmmfie3I9YEeDGTVodHmHxesLeBLQQmxpuZgnJ1eZYwSS2g4bPN+OSonsgPlHLzmBJcUpzxJl3mgtcjyN+2OgF46A4V1ENucCVGdLYjsbo\/kk6U7V0KiqERMGjIUeUVMt9tfNUf6xYXUsVOKsIfNcAMbDiCO2hf6q+1nKxCJw6p0qsB1ANlzJi00XH17tvsddvABkR26jQRxWpc1ck4l6ErNYoE186dUnlcdlKjaIHU4jQ4CS6fS1HuZFQD6VdPpfAFSv8BxzC46PHD4wMhUHF2gx9Kp9\/ATrborJ6OxeXVS1Ba+IQzGX6MpVsGiH22VzumR7tEvftwy0MX7pfN+X9yHBrJmVvFG4s6d6wUOHM9cT9DziFvLgAwAAWkDABhhBEOupEe2\/wMMEK1iMM54UEoH8unxhtj8WYzN80k6LTIvPHF\/E25mwBrd3Ddc+3TTzEaMPjU0+M1XvIyvzj\/A5sXKLwcCblI6sSI+xP6Em1WR2E8sGgWJwUQhIVnRVHu17gQBAQA2v2zCtIQ6w5Ob9q9XSh\/Bog29dyX+eHSPzY16LHjE96ewrDw0qMexSBDw"}
00706{"flow_id":5,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464459,"pkt_caplen":271,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":271,"pkt_l4_len":237,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEBCjJAAHYGQSE0ccKEwKgBBgG77HWQGkdpLoXDFVAYCAScCwAAzjPbh60Ymm0tjFk6kKgrED9s6hrOYY5pNu9VYrK5pPgxrSAhNhst5\/5\/8MVEhARh014b8CQkuIP\/vDOZQPpfBPopVpmJQj7JuxbLB4RkMuq3bvko5Pv44o\/CEkLjRMQz4fOj+fCfq6EDg08bLmY27izuXnzUyg6CsISBPAsldliaS9FIdEgJKTmeAjW1uvY2xcoz9nx4cyxTpSxEiJpA4aFIkpyBYWDmjthHymsU\/xnc8dTEutTFR+vDoTJfm4wIDWbSvwIBoMC53HPI8+MWGNP49ra7DgAAAA=="}
01060{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":26,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":12,"flow_first_seen":1587041676435,"flow_last_seen":1587041676464,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6235,"flow_avg_l4_payload_len":519,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","server_names":"teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"0f14538e1c9070becdad7739c67d6363","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=teams.microsoft.com","alpn":"h2,http\/1.1","fingerprint":"68:1E:E8:3C:83:70:6F:E3:86:F4:E8:8C:C4:E6:A0:9A:3E:E0:9C:0E"}}
00406{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":464500,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx1AbsuhcMVkBpIQlAQH8sfPQAA"}
00624{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":469351,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAGgY7AqAEGNHHChOx1AbsuhcMVkBpIQlAYIABMRAAAFgMDAGYQAABiYQRucgjp+M009+y7BfrWGJrcaVoux\/RH354hUT9jM7kfyxIcTlbdGetTxtE3\/iG2szAPJokY+ykEqiJVfPaADPdlT4ze\/rZ3TdQ75xvFCAZrXljZeVoJBMqQeQJ6WRkIuLoUAwMAAQEWAwMAKAAAAAAAAAAATwxUzwoKZVac8SgD+A7mr6xxWyeSVP1XG1iEDvtSuCM="}
00414{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":481000,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoCjNAAHYGQfk0ccKEwKgBBgG77HWQGkhCLoXDs1AQCAM2ZwAAAAAAAAAA"}
00660{"flow_id":4,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":499766,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":240,"pkt_l4_len":206,"pkt":"EBMx8Tl2KDc3AG3ICABFAADiAABAAEAG9tTAqAEGNHJNIex0AbuczSMoSaIgqYAYEAlcWgAAAQEICjCEl\/VhBkyoFgMBAKkBAAClAwNgsc\/zVfk3fJaoeGVjBvcvXHJydxa1mwDEXFImXbQK\/wAAHsAvwCvAMMAszKnMqMAJwBPACsAUAJwAnQAvADUACgEAAF7\/AQABAAAAACMAIQAAHm1vYmlsZS5waXBlLmFyaWEubWljcm9zb2Z0LmNvbQAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAsAAgEAAAoACAAGAB0AFwAY"}
00780{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":37,"source":"teams.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_first_seen":1587041676362,"flow_last_seen":1587041676499,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60532,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02363{"flow_id":4,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":56,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":545373,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUL\/9AAGwGleM0ck0hwKgBBgG77HRJoiCpnM0j1oAQBAXctwAAAQEICmEGTTMwhJf1FgMDEGYCAABRAwNemFWMXBNb2F1eIS0NgygX31DvjFSWgfTq\/PXgXBX\/USAORwAAVmOWcPohT0niCo9N4puGGU7iW5AxxYvHQvC098AwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02357{"flow_id":4,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":545588,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMABAAGwGleI0ck0hwKgBBgG77HRJoiZJnM0j1oAQBAX4aAAAAQEICmEGTTMwhJf1LnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00421{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":545644,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex0AbuczSPWSaIr6YAQD9OIagAAAQEICjCEmCFhBk0z"}
02211{"flow_id":4,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":545713,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfMAFAAGwGllY0ck0hwKgBBgG77HRJoivpnM0j1oAYBAXusQAAAQEICmEGTTMwhJf1BM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdICf13BoKrGZPNG0+yUJZK8TCtflNTiG631bDCjWUJK4jBAEBAHbj1ePhfFL5FSiea0SFM\/ZkVyK+eDewU7ywV8xdIo\/5AzxB4ECtK1IiGdkJ4RVX31AHi\/CkjfaxlSycpoLayFFGuAJ\/ODU7meLERtve+q8bpBRRkElp8CtGG9ufBWZM9OTtVSHSiids0Y1qJQaSL3O++gtGLx1JVip50NS8osX9SZs8vOU1mv9\/OX7t6Mf4KJwc2l5RJQo9oZOzhWuMVW1WLzsIvCX5rZUG4lQu5imnPzvYMSQrxbkvH5vRtOnQ0oCK3Q4B72NjaN5XozPSxx6kRN1\/Ro5FKsGYBxIif+k03b5X8xi1li92DKijNEFd0s2WeBCBNW7PWnaHVE4F\/NAOAAAA"}
01308{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":59,"source":"teams.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1587041676362,"flow_last_seen":1587041676545,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4377,"flow_avg_l4_payload_len":547,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60532,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00421{"flow_id":4,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":545746,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex0AbuczSPWSaIxFIAQD9aDPAAAAQEICjCEmCFhBk0z"}
00551{"flow_id":4,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":547152,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIex0AbuczSPWSaIxFIAYEAAchAAAAQEICjCEmCJhBk0zFgMDACUQAAAhILIaMevnbK1\/hpHUboPpPe+pb1HBL\/FLZ+shbMz6dR9FFAMDAAEBFgMDACgAAAAAAAAAAIJ0SPvnUI1H6qTG02JvBbggKD0kfO8io3ogy9sAjVIf"}
00492{"flow_id":4,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":62,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":592494,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnMAJAAGwGm000ck0hwKgBBgG77HRJojEUnM0kM4AYBAUC6gAAAQEICmEGTWMwhJgiFAMDAAEBFgMDACgAAAAAAAAAAP2LLG2PnDQehKYYtBjGkN6MY9XhuxGTfkh6HM3dIStA"}
00423{"flow_id":4,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":592590,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex0AbuczSQzSaIxR4AQD\/6CJgAAAQEICjCEmE9hBk1j"}
00373{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":64,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":611249,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00144{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":64,"source":"teams.pcap","alias":"nDPId-test","type":38}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":65,"source":"teams.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1587041676612,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.5","src_port":60534,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":612882,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4fAqAEGKH4JBex2AbukS07pAAAAALAC\/\/+ZfQAAAgQFtAEDAwUBAQgKMISYYwAAAAAEAgAA"}
00433{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":642642,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8LqNAAG0G6+cofgkFwKgBBgG77HaiQxrbpEtO6qASIAC6gQAAAgQFoAEDAwgEAggKVQC94TCEmGM="}
00421{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":642755,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5PAqAEGKH4JBex2AbukS07qokMa3IAQEAn5EwAAAQEICjCEmIFVAL3h"}
00753{"flow_id":6,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":643404,"pkt_caplen":312,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":312,"pkt_l4_len":278,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEqAABAAEAGRp3AqAEGKH4JBex2AbukS07qokMa3IAYEAkkyAAAAQEICjCEmIFVAL3hFgMBAPEBAADtAwMFij+vLNUEXtDYw018fSI+oguo6nn0NGVGlSQBEa6j4wAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACc\/wEAAQAAAAAeABwAABlsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tABcAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAADN0AAAAEgAAABAAMAAuAmgyBWgyLTE2BWgyLTE1BWgyLTE0CHNwZHkvMy4xBnNwZHkvMwhodHRwLzEuMQALAAIBAAAKAAoACAAdABcAGAAZ"}
00792{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":68,"source":"teams.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":4,"flow_first_seen":1587041676612,"flow_last_seen":1587041676643,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":246,"flow_tot_l4_payload_len":246,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.5","src_port":60534,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"login.microsoftonline.com","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
02378{"flow_id":6,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675374,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXULqZAAG0G5kwofgkFwKgBBgG77HaiQyYcpEtP4IAQBAWIzwAAAQEIClUAvgAwhJiBCxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gMAAFJAwAXQQTOd4jCuMTh7EYDlmBiiGmTGwexXcFlv\/T2ck50p74cYWIJH\/qL5LjbfCSDp3wqAO8ZZNaw1gxy4Uzbx\/mTFEUoBAEBACuEjKAM1qXUNVaS\/GaC95SQ9vmaMh+jYNW\/golBe81NwxyW1ReEMvroTkbS6BjiR97ixB57SOr\/EVlzcCLlr0XL6vCOvZKaaq3SzHreSfwbGspHUYxwK5i8j23AovUYK4FdR8PK9GkF5j5DZYPL2nmL62KrpTU3AqFF18hKfZ2alq2jaowqtsC3NBCAd6aifgpEBRhB9rZP2x\/YPgDeBGSAHqMX"}
00553{"flow_id":6,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675379,"pkt_caplen":162,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":162,"pkt_l4_len":128,"pkt":"KDc3AG3IEBMx8Tl2CABFAACULqdAAG0G64sofgkFwKgBBgG77HaiQyu8pEtP4IAYBAVGDwAAAQEIClUAvgAwhJiBfbkMHpnw46Od39l8xQWfkMb8Y4m7UQItE2ZTaCJ\/+0VF2uUDoFo+ZzMmKB4UT6N0T0t8m216vjKZdmv27C48wjxjvRwQlpbFUmbQ8WYEeJCXNqNVwUeFV6amQX8OAAAA"}
00438{"flow_id":6,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675476,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4fAqAEGKH4JBex2AbukS0\/gokMa3LAQEAkrhwAAAQEICjCEmKFVAL3hAQEFCqJDJhyiQyu8"}
00438{"flow_id":6,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675480,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4fAqAEGKH4JBex2AbukS0\/gokMa3LAQEAkrJwAAAQEICjCEmKFVAL3hAQEFCqJDJhyiQywc"}
02369{"flow_id":6,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675595,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXULqRAAG0G5k4ofgkFwKgBBgG77HaiQxrcpEtP4IAQBAWO9AAAAQEIClUAvgAwhJiBFgMDETsCAABVAwNemFWMNZVYex2YSZU9LbdZAUx9rp8YuH+uVxY28HEy\/yAOEgAAkYEekCKcZ298BeKay3uMYwkmrgdnVSpTaON5cMAwAAANABcAAP8BAAEAAAAAAAsAD40AD4oACcwwggnIMIIHsKADAgECAhN7AAL0+uu8c4DySSOTAAAAAvT6MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xODA5MjQyMTQ5MzBaFw0yMDA5MjQyMTQ5MzBaMCsxKTAnBgNVBAMTIHN0YW1wMi5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg9uMC7tn8RKm9hx1Q+vclCmv2FS5644lZCwDqwzCYb8L0QUXObmurDTp9z7imH\/68rvf0\/+KpPvZzn8n+A1ECu6H51tc4jh4cund1rKWCEvaClslKP1O5XZfDppym7WFQSIHQp9LXW26FaTqarCYkxKrkm\/lTdJtaXF5\/C7ZRJIFVaL9dmL\/uMiooAbDLhN56zmBjGeB2V01oJAQhD\/q\/lznyyirBK2V2vQ7WyyX4O7R5ox9CbJ7fjHmVfu5B\/IGhKzckLb+kPv4Ou1DFiJ+VjXUg8+HNiqYybm516lzAMR9GTpDm\/EaK\/DoNiRmeP+V6xIxpVOXNmdtJ2yXkhn+AQIDAQABo4IFgjCCBX4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB1AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABZg2YTSEAAAQDAEYwRAIgNf1dCr\/A\/68iTF44ctzG4dfYj5k8kwrcMxb+OAftshACIEOFf1L8DyVWvGmp2q28iEZd5RDO6L\/3eE60TQKPTKibAHcAVhQGmi\/XwuzT9eG9RLI+x0Z2ubyZEVzA75SYVdaJ0N0AAAFmDZhK0AAABAMASDBGAiEA6k0qgGOQ2\/4vWshsmYpY7DSpdiwLlTeFqoSnh81\/2Y4CIQDv1+L779lV6U+goVXZN5Lr8mJnM2dtvY1ZqBBLJZkaOwB1AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABZg2YSsoAAAQDAEYwRAIgWKBW8MG0XWRpOFEy6yhRlkRMXWMvZwn2MMfc6oSrj0gCIBftriorxFHUNkLYAHoFWkhm8hNqcHO+KKiAs49boZzUAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFmDZhLTgAABAMARzBFAiAA3dU0fJfG9tq5Rc4+sUUH+XraMuPYSatYD6LC\/2\/zTAIhAJWqprUivm3Ca3RKEfcrJtar2nlcdcqed0u5OIHS\/4PYMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUiTQV2m224F\/j"}
00439{"flow_id":6,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675637,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4fAqAEGKH4JBex2AbukS0\/gokMgfLAQD9wllQAAAQEICjCEmKFVAL4AAQEFCqJDJhyiQywc"}
02357{"flow_id":6,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675836,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXULqVAAG0G5k0ofgkFwKgBBgG77HaiQyB8pEtP4IAQBAV5XgAAAQEIClUAvgAwhJiBi+Wbrav3bQpcZNAwCwYDVR0PBAQDAgSwMIIBJgYDVR0RBIIBHTCCARmCGWxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb22CG2xvZ2luLm1pY3Jvc29mdG9ubGluZS1wLmNvbYIbbG9naW5leC5taWNyb3NvZnRvbmxpbmUuY29tghpsb2dpbjIubWljcm9zb2Z0b25saW5lLmNvbYIkc3RhbXAyLmxvZ2luLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgh1sb2dpbi5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIfbG9naW5leC5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIebG9naW4yLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgiBzdGFtcDIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEARVCFDXaNOijZYnNGoRWvtuOpazT+6a5NhffPDEd8mw13I5P2ZjdjuwO0BCuAa0rcrb9Xsv2qMoirtQ46ssv7U4RUbJ2q644olWDdoDLw3u2IwAi4+it8uqFANVWf479pYNzQSRACICWvLYyZOXoCzSVgryqqt6S9JYKLV\/5cOCwnLGXIMXunQZDJ9OLbjk3hV+y1gACDA7qTWXqQxmgI9aFpumAbRwTxqZV913sHD\/Cf4ut1VrXdDHEcgGroOgboavAnBPF1buLwyr8dsFVfenl1cv4K6OyxBhOa\/qPQC3E1A4UNtSz4dz0swsNbngQZDrl3H9MqpMRswrpJ9jUAZ4uzcbjmByMFT7UrO5NyfE2e754OXgg0kzSG7F0aYPVW64WQaAN5alS554Apkxzpnhy4dbLpcc+qDxw4uZRbEMvvqiGy3Tzvw2N2ZlLhpfCA79zVH3D9QcugIgQY75KsamAAzOcbXq0zT0xKgmRKBpdzG5DeC2KsBbrTTak1bUSSPLjvYpHhgabRiV7OEik97n1Dth5jNj0APlNTe65xy1gwKh4ItrHo4sQMKfxY9NyTKSBVKN3poUeJpe9p2ArtCr\/ZmVWqTui7XFpZPfiQUHWHxyvx0VTPR40NEp\/NGn3Uw7Bd\/MS5F6AKZAjGFEeyvsfA2p3QKRyzfNkfQWM3fP8ABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UE"}
00423{"flow_id":6,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675868,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5PAqAEGKH4JBex2AbukS0\/gokMsHIAQD6PnBAAAAQEICjCEmKFVAL4A"}
00423{"flow_id":6,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":675897,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5PAqAEGKH4JBex2AbukS0\/gokMsHIAQEADmpwAAAQEICjCEmKFVAL4A"}
00597{"flow_id":6,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":699696,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAGRxXAqAEGKH4JBex2AbukS0\/gokMsHIAYEAAHhAAAAQEICjCEmLhVAL4AFgMDAEYQAABCQQQP74ekfGdN7RlsIKxJMW\/Mq+2BmbW\/7thooJtpPdhFAXJRybFYYpNybjYDAprlNb7BJOhHI0JNyOl6DfP\/9SUTFAMDAAEBFgMDACgAAAAAAAAAAIThtGFHNQ+umo9GZEAGHfoPFZYiR2E7d8fH5weSTVVC"}
00492{"flow_id":6,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":729269,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnLqhAAG0G67cofgkFwKgBBgG77HaiQywcpEtQXoAYBAQEbgAAAQEIClUAvjcwhJi4FAMDAAEBFgMDACgAAAAAAAAAAHANvoMH+9tmLzSa8LTfBzm9iSTK+Iyg6aq8izKwVC1V"}
02365{"flow_id":4,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":769788,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex0AbuczSQzSaIxR4AQEADqKQAAAQEICjCEmPthBk1jFwMDQBgAAAAAAAAAAVkfdghZFn7EKrTllFW7HsImopwaU4grgSMVQ9Ln8qFbWiGKPmAEmfR8JlskLbsUstOIiA11CeyqpKw3y7eFcu4cr3fWBWF5a3MhVe\/qNNfyWDy5QD2e\/ZEtYoVJsEXAk\/u4zUG5JuKAUP+mHQ6miLNPfeaCeFAdX6eOWqUw\/e60W7tbVcQwA9+siW+1loHYZMDieP2+QUop2JdvGnqEul0ug8pAuR27fw8RwfKHTxcg10fjGvxpfiZcouuy\/Z57jOQxIlff9oul2kld6vdPQGtwoyWjc1UHnvPTg1yJePblTg5CahHTzrLsBQxpZrmyqKdvVb85s17DvC1KGz4MmwZUUWA4eT9wRmFHopDghoqcHG\/TEUkfn259GszahDaoDNR8OgZy8Q818o394BbboE8nAuPdWEprIyVVDWOF7dnLzpj8\/XR1PbJ9nhjWR0jGM1kOA\/4OTzxGuyglNZT7bHz+UBToU+UIUqEUmv79ueiLkumpRnyuyQioiqXqiExvwqapAYh0gRfE5rwyN1YKgjZ1S6ii0sVjhv304LHo2H0GaWkaTm3uMm96ue8TnP6zQ48ESJiZ1eq6bnNAzhiu\/gGA1WT2l5PIxoy3unMgoFe2mDMpi0BH3MP7JWF1N\/lm7VlqmE6Xw01KFWXDgCokZ60+uckebdZhnMGG\/TTMbCtmg5YFRQxHb2PCCRhBMTGjr\/LmmAg56y7IxinR\/rR4IcGtsawGo+UmBw\/8KklLJsV6nE9oxFbzQt6BAI4E00uKSTEDocctWaTbMtDyWdnog9mDE3YWHOdhvAba9bjNNA+H67B1lUyh903op51e73olekk8ly\/bdCK5N0acS5BLgBeAbydJTxWysj0Btrph1fw\/fEQc35Q4KShs2VktgCr2tqQMRfTezBI4YDMSCiihlgFvMb0CXxMkwG8\/1CGdkME4i9xQqqwyCEcRlfUVbd15eWz9TW8L3BdFxC1rSJaHjaCAkG8fnNsS+v6P\/xLtrgrq8y8HBfUAHiPDgwzqwCfoiDhB9hlCUonShmV0cWfqCXdW4L+gNSJcWndZSLwshj6EItxNX1Hr7TEmWMGCwatiCyOZiHMutTXIKiuWPEi0+s2043QIyMz+DgoAt3lmPScsBM6oDqTW++hMmfyofGU2QSRCgs7Q8voEuT7jPC564IIi2T17wgokC4rxLMBa4xSSpoj\/lYnLw0mR3TwT1jNQ7JJ\/+iNW+uZ+HUm8w7TvxbgQQQYcQ98FcfYRP+dmJ64ByZ2rQ1N72p9w7aBDPNjQKJ478xGSSKFmjLiNEqhKkFXREAidA8oqmMko9vNvjsAkotRjKmRbon0\/zAHocH32Pq7nogXTuUe53R2soxdSgvcTM6fReTUMf5YNCAqD3wom12vilzgS\/6OPV8UTie1wmsZheZpR6DnPoczhJZzzvst\/grCBPaeuAOQ1PRBp0fCsZKh3QQlc+rjPVR0FD\/Qb8IGBkUF4huRvbJVzkNszF2EL+RkvXhJbprXBncJJRjIISx2jUiJg57HcPcg1UZg6rOcWqafEFAyghPThgPc06l24tfmRM6\/F2g7EZp6S\/4USUUzJfscT7EEfit6a5\/cx\/sNNn56Mbw3e0soYaYHXbVyeygrGu9xdcE\/PIPgetT6G4EXxf79l8hokaNLJqOaX7Wgo9haYksVOYzj0E7yuDUHZbu+7JW0pewGxjcxp8wa\/A+qdZBGPA3PWdq6zSBGv3gg9dk\/lkrwIjE5u78KfYIeHNg7IBuuZCKzE\/vZOGS5pXCZRIXmlHk0S9C81njFOovyu4OGmGoZXok3hOnqUBn4ZgjIjoAoTT5i30p4sM7jCijhG5Kk80L2ElGVDWiPbYcM6YBy3G8ofyiHdFIeQUUiEg4j+PX1\/"}
02366{"flow_id":4,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":769794,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex0AbuczSnHSaIxR4AQEABkowAAAQEICjCEmPthBk1jhetVSaOs0tVuOWSWMQt9KqsujxkAMKWHRi1WGPxJI63MiRm2Ue\/V7d2WwiTSqcWMmV4UGBaBicxHy0Im9BFzDU3NPUffzhyUjcoAONACL0EqIVjd+10VQxMJcbmvHrnp5weXg+CcMG4Dd8yFN0vKXme0TYB80DXsjBqDYndTE8W1CDaLM1Fpt7g3kwqwppOJOdACvhyvD2b0bMN+27J\/5sUsuwybgNukgyii8wUecNhmpO2zLmM263oF3M2iHh2\/a3cCaSw\/q2SexfQDUFSiocH3Sj5MTL3FTfyXCVuzyFn1Z9sMNr+h\/uZxr7J4\/pYPPENAalR9p8vwjUF2SKtKyjMUltBbm8nHX1gFhoaJG8levkK1PAM0uiA4kXxEoXQBLTw4HDO6eHj7U8HOYflNZXJWB15vmpaF61hrJnxjWHv7QqxOKL7yWyxSAWNT\/YDsPFOJOVeKEtJyKrHXmo89w7s5jTRmj24Jqykxq3HbONuc9m74lriHWyALwtB4+19pOt8Ofv42xsEzdzppNHnN6WleK1tM3E3VtreWlthU0885jovLDfKT5DtNDmGtGgEhYwoxYmwCEiuJFqFGi0X3Kbm92KzNxjf8IrFjBzIiqUO9PqXwbfUup9qhvG9KOVQOg0xBhMjV6bc7a3Uv70HipO0VLfK\/95Zn2\/0+Kt4kLPjyEsDh3x1+wI3KKHFxsgRTJB+roeShavaOcq6wUrIhIrWz9nDgJ45C7pgGliTQcFcll5A8leMbwk7nc3fEQvLuT+07WcS\/MtgsUTIfKSBZ5kKvSbKLebl2\/2hxHU5+8hr6ODuw0pGl5BJKPZXudUVDojF0y+t+wviklcVBYGSeutHjyxzaPsOV30d7+cE50ezVy4fF0AAOK6tztNR5ayL\/o7BJYQqcWztDcXoZhqgV19AAsJH5OXGjv\/5XuBfBdUtK+4D95P7Kv8Hvu\/e7hKaVHfFkNxX7rtQ5KlOzOTCC6VUt+j5OCYKlTcJyhMGyqDl4L7iIWLTqmlkA7hGU2tnY5HAzfxtElKR+kqelu\/FinQpzRcf3I\/dHsQFRPfLRahYBMfi3fDEBbIbUT9hXjYctI\/+cDAlN\/5hyfxhna4YcY\/dA0zq22Bdvt4HYS8mZD4xWp5AmjhYnWr1I9Tb+xPnSg0sPnW83DuQpqY2LCUA++RU\/oFYJAuTZHg1A+eFNULtjFJmKsbNp5VWsaTAGUs3RXIf7VtLQ83xCL7CyPOY7dY94\/Yil4+jd3kf46y6K9IH6YPzz4d1TXXvmX71YzDR94JcxRaRnaARqx7T\/M5BNw5bhFW6ees0i4OJNgphq1VaLc3xNeIkFY6+S0icOS5yTlqzLV6zZHXQnLJIwP6QbL+TjaCXYpbZqDEkPhCxZ22MJ1RILD0FpjJPJlDopx3HaGqXbUJmyoohvW1tLqcChXQPB0cIEcKpfHUoQzXH\/Bt5Ulfa\/aPlOx7YjBTNYrlqHP+uUCsRkSJDK5+jHrnzCN8XyStU70Shbp\/CV73lzd1PTqBYjnrv+NQUgOSroLFuXu8GUiUHz9XVwBs5hq0aN\/pXA6kMANc+EClVvxxF910l93c7wo71We89\/85YCbH\/H11hsYuGjoAucYB143swT+YbDm9IrvMjghO8iNg1T9V5414OnB+Zig+jXFJXc2rpyVkqp790PqfQiSZYXzKGwZmYwLIX7Y2J3lrgqCltjx5WPaKCTgZLmvqFbyJZD3BNuEFcBZ5dyfSEvI7e4bYBQ4HdpBAuGeXiBCvN27t0Ca0F\/GUQILX5M2a9bOsfJp4IFIffaALVfwVVAPzgLFtn\/+q5CC2YHe7L\/Wr6N91+wKfktrFQIBiJDAae0dpARr\/waXCgK8wLfWnNDGNhN42hH8i\/H3fo\/x2KGVF4zCYeIlOf7cLP3"}
02360{"flow_id":4,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041676,"pkt_ts_usec":769795,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex0AbuczS9bSaIxR4AQEADpHQAAAQEICjCEmPthBk1jWylJT2di9X\/pvFaCQxDFYRfzWolRdIDirpYmnOjJmvqzpPA20taElVSIyDpXIMkWMyn3oIaYGIwhOLremdRsUNp03DOSE0Qkil1Xvh8ARZ6a7EKylJ2d4ApuGmBztqseHxfEpgUlKPxX+h84La9BtzmnLiV1VI2cd4IIlJXIRgf6HTDy8DS30120bXw6K0uBESHQptRN2v4yA9I59T66cF+0Z+nh9n+sakB1c72DZswss7Dh7v\/WCZb+eBEKyH+n\/x8sUQUDYzGJV5cl5ahTWtm5yB56D801VI\/QszB\/rBNLsiULlYwNVvoQTdZsKiYakVOJXYKUsJNeFxiNau427oWcIahwMsIScodPYS53RwRwBbAEwWWPDD6coxlJsPaubSPct1ohEFZRFPmW8O+mNBQpax9O80yYU44R44ErS3kxnzSmo2w+RxAAU\/LIEkHTk4DVIJK6yThlxB3YeuvbhDYOM35H2YrsxRKkgw6OgUIz9pwLgQt1dSiDHlyxCys0hX0mpGL83TQwpZTLeIq9MVr+JSUefh5SDekKs0YUgU0+0geu5seVlKUcYEdd4hglQrZKDRFK4qBkErbhpvA0AxhxjBoWN2AgqcluckgYk+lNTKgM0kjgFI8F7raGXad\/jjvl0gK7PQF4xM6meoFuwtX9cJfUDVpWK\/rumhjVcbtQkmneCqUVtIVSAedxj4FXFY8I5bo8imqKdHih9gQ5ZwwpJV1tsT7LhCaiIpvT7vMyUD4KcaDAF7p2xnADPcBuHSsNXrLG9uDl4bUd1T0MUqFO1g8qRnwCyrGTm6e9UN7ykFwU4R0BGEPawYjzh\/YQ2ekavMZOOVmPD3hGOXFTqU1U0sl8pg0+gu0MkYpZhgY2VdaczFI0oPb8R\/eBaagnOntSrO5v7xyypKaC+qpe64TRzODER1z1PmzPThGv\/9ExvpAsagEsYZYtdyusumABraQVkUhsqoiuz\/ib37K5ph5F8GUsC5oqpLSBXiJYXHAzxX92IzBk8AYM0HN7BGhHLfklyX8j4fS\/QxrvMgKSXkMTf6QyHF4Ajzl913VbtnjGcdfi+f8D\/IJtG4mRNdqfvq9BfForVSQzVA\/c1HCadO6UaMdDv4Aldr1jESpPG1abFiZpq7CH91kgOj6WssBpEPpg53VmyRO54j8fOEFIzh9k8h0saoSfjfjXw5PUCbuXwQQB8tRzuyC\/Nu1IlfBYOaZSglnORhQe8XHaVD9ih8DrKEwZCf1vm8RMsykUUpaRgFIDUyg5E8D8WlzM94CGTsO\/QWtvkfkNw5Iox2dSXUm\/ETbDP3Q5uV4EK9R9+3YaAZhy5io9dsYvoGQgoHfLfhY4cvk7bVFSZnFeKoogwZmPNWHDiZb0bupho9glsxFxXYmuVAsxHK2phdgA8YaCCSjbqMRniiK5ot2Igq80qEW8u\/sJvC74mt4SA\/TSPC9to4z1\/mHJAEArnfiB7Jr8x0a6mu716nNe47p4kf6eSHLDYQHjMHLa7YQsDkFsbsdOF30\/1HXco\/QAXF8XtxgcUi5Jbpr9LdPZ4JuilhHuTojmwbzMtwYqL73vydQSMuosglSqWr82hN9rOqy9Y3coVs3WxvJ9MWXZ2NRgiQo+8bmrLECoxVx04fRmKaS0XlQyqAplUvfegGyrrvXovMwkhEvINqjXa8uqe4+PEcIbVSefDh8nNA2ojdbDXU8Cau8T38os2eomn8l\/izzvZRbBjtMl8eEhO\/MQbam0kSKai2SoMTRaze2tqPCx+24ZvgsBPUIIZeaZv+ZgqU\/j47gUKPlJ2+71EpvVNg2H8zX5u6HWmBGagt751JdzJkUNimibD\/NgSmLL6diuWbN5pps7+HzI3Xsav5YeXqy2svA4hmCOgEa8UTnFur+fKdVdXlOv\/V54"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":153,"source":"teams.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1587041677042,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60535,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":153,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":42751,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIex3AbvbPWM6AAAAALAC\/\/\/8iwAAAgQFtAEDAwUBAQgKMISaAAAAAAAEAgAA"}
00433{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":156,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":88014,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8FwhAAGwGtHI0ck0hwKgBBgG77Hf6fNLR2z1jO6ASIACfvwAAAgQFoAEDAwgEAggKYRMfbzCEmgA="}
00421{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":157,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":88160,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex3AbvbPWM7+nzS0oAQEAneQwAAAQEICjCEmixhEx9v"}
00703{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":158,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":88499,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIex3AbvbPWM7+nzS0oAYEAl+5wAAAQEICjCEmixhEx9vFgMBAMkBAADFAwM5dVF27rKLSF3ZLHW6jf6ecE8+y\/c\/MIkP9CtH6UUE1iAORwAAVmOWcPohT0niCo9N4puGGU7iW5AxxYvHQvC09wAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00781{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":158,"source":"teams.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":4,"flow_first_seen":1587041677042,"flow_last_seen":1587041677088,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60535,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02363{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":159,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":137230,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUFwlAAGwGrtk0ck0hwKgBBgG77Hf6fNLS2z1kCYAQBAVAOQAAAQEICmETH58whJosFgMDEGYCAABRAwNemFWNrPjx8U\/n2+1HOnhSXCpnALSFvyfXRw2ICUZrciDASAAAvuo5mSGLHTbLJlo\/aqiaHVmeYbbWtXIqS6QEP8AwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02208{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":160,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":137251,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfFwtAAGwGr0w0ck0hwKgBBgG77Hf6fN4S2z1kCYAYBAWzJQAAAQEICmETH58whJosBM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdIP49xIfrfjDvk9a062lCLcDWR7nMSideF7Sue\/RplckxBAEBAH6zAEyUpfFNwqzR7mmhOYufXGc+KPq30VcKIDnpWEwxZCz2OpNChgHJKjPVTQ5EDGCelpa35ZM110cuSF0Wn015y8PlugqZYRvLoVz6fJ6UdKXR5SgVQONGhs7fdu3GB\/JcRY3DO3LPhEFPo8gOI7nUYKeDaBZJ02iftBX0OaHjcaBQG0kTPE\/IofdfYyaOWf6Ag2IxMr6LVaXz97cn90K4hhnEBy0QXrzoDbDxFfOmWoFc72r8b0ZHVtFOpaj3dIiZyMIzopBcPDvxW0P0nb2U0wKlaFWbTnNvZUuhC1MPHmTmPij8dkbUSOhdta0bEasOTIRpplZ1IlyiBxmbNVAOAAAA"}
00438{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":161,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":137337,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIex3AbvbPWQJ+nzYcrAQD9zrQAAAAQEICjCEmlxhEx+fAQEFCvp83hL6fOM9"}
02358{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":162,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":137475,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUFwpAAGwGrtg0ck0hwKgBBgG77Hf6fNhy2z1kCYAQBAVCDgAAAQEICmETH58whJosLnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00422{"flow_id":7,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":163,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":137514,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex3AbvbPWQJ+nzjPYAQD6nNCgAAAQEICjCEmlxhEx+f"}
00550{"flow_id":7,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":138785,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIex3AbvbPWQJ+nzjPYAYEACHlAAAAQEICjCEml1hEx+fFgMDACUQAAAhIHPBp8+wuw19lTcvNkHN8MSJxGoJG5HShn76nTcEFxwBFAMDAAEBFgMDACgAAAAAAAAAANbr7pZrkfyPmtyujxFx+COuaCSWjNqCq8kcxQsKiIjC"}
00494{"flow_id":7,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":165,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":184001,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnFwxAAGwGtEM0ck0hwKgBBgG77Hf6fOM92z1kZoAYBAWuSwAAAQEICmETH88whJpdFAMDAAEBFgMDACgAAAAAAAAAAAKrgBHo\/OOQWfKLiWv1DSZ7VsgdwrCQ83brRuEYu3dO"}
00425{"flow_id":7,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":166,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":184101,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex3AbvbPWRm+nzjcIAQD\/7LxwAAAQEICjCEmophEx\/P"}
02363{"flow_id":7,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":167,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":186021,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex3AbvbPWRm+nzjcIAQEAAogQAAAQEICjCEmothEx\/PFwMDOsgAAAAAAAAAAQJpxAXFlgGOw6NQNyLgxT\/WQbnFK58fUOQKkdNAS5RydKNY8HzEFuEeAet1NUkUBXLHKuYVABOUmmxk9BmgxadTV\/RKIwYbgskYp8Au1ug6qGwFxJaN+Ox4BVqbjN6nDgIZw8LZeylc2yM2OqpL4pPdpi5U7Qocm\/Ex1IAc2JPxnpZI6Zcab6cRQZ1sT0mb3slH8HhkXkN8w9DZliXVBWUUQAMvBW00kp6vrBzorNtoxB1x1hyQWudtCsv4vYSc8V43+13gX\/zgTC\/jXRIw3RE7fSqBdLDyfoGcu0NxvKMnKtkQJYNYDHrdaGy9bx87US7FPnCk3fANf3h\/fWnlfhNEKZpqyvyHbdUO4iI0MDZtIVs2ZpocOMz+KsJbr1uFywJkG8yjul4XBo6L6ae68NXUqIIkcD19\/eFJn5278MbAh6uZPcsE1PI9r74+JV3K2Sxr7vKJXItXiaUNOoCrhKYGl\/wOAlq7k8zQqDgwcQYhv8r5D4XZGifULhmztXm8+ILd4yDCJWZxN\/LseI9SyvE2xTqt9jV27Ap8FjRfgrtSeU4EyrqJjWf0tCjQQt8\/CLeumf8EqjXZ7WgL26vJN8PyHdaG8xk2XrysHLQeEFUpUpVbsn5z\/R2y2lA3hgF2KApkegZ8tQ3SklLAabJVzWkV2L9XzPrjYtxzyyOaVCl3l2pcwyjSKCPkqvj6ps6Kx0Rs2kGbqk1VfEjcYAbJxhsNZ+6tvkMu0eTBypbUpntOC2QQgt3RFs1WomWmUe2sHbpq+RYF9NOH7\/HsFWxyJuiS+w\/YU09y6AD0y5DjSxKFIi\/xXSz5jlBxo+6UxLr2Bz3OHHAq1ZLXOkcepl0JLkUpAlAQ6lBfsqvGLHUBkj9W10pt\/SgJLZGJ5fcPTJZe5wIdJSipqQio5vBSAq6trCzVsfqWTG8iGlLAHSre5GUM\/FCWxVKBEt9Jv7BrVwzCozKwnO5nZlSyFSlI5fPZtlkLaOM2QMfuC4G7jipn7mgfOnuqmlvsD33chok9nPigNeigKBeyQ9fmcEj9gvJTa8TVwKezKFgzGMak7\/xYB\/L9Gt72bGUBlFrqHcKcYcn606JK06EcUwdJ0As7VO2hSuG9uRMmJ02JocPYp\/0i5clMIzlRZGcjCkOSJMxMJ4UmWbXA4DuLJj2mmnsyT6wfywFkWVcKRwCXd5255UO\/UqrclSzDAijjEWgsN0Ppua1RTtoWqzMW9g+fo\/kLunsvPij5XHVuBrqw3+XLVjO9EZn2lW+kkugQ3scDQ7X77soldus7L9IbFwcc7z2yn2n1rDRPtxdCtHMt2KcfuVih7E3ZcltM7jHjb9VQG5D8dTHlFL2Kd3MHcHnpWcL0G2vFoXObqmEocfEWT+AmFOOKGCAnXmn0u\/K2L8acgiFNRR2DkfncieK4iqlJXNxMANehiPOrKzIh5j9DsIZUp7mQjpFIij9gM6htFfEr9FnEuPcObTNmDekLChMIWsJ+fEDWhU7B396RyQzA0KgZ6udB1Ojmo8yjw\/KlcsjTEek+wHeM2\/ceUNRwqMVM7nhbwiv3vM9IKIMuEWsCowIVJUHA2XhlTQd\/kfmeOSqkj4Ou8iRFRMuNkgHHNwQRLwas6e2FJE\/TQjEx5STAxXhbAKsVhQoh2cXkj9Gl5lTMj5CGVIt+bpFob7jAuhcmJS6FFwEfk2\/2o1yB8c94jCoZyfye2ECQkf78bVYsZEi+hVrz13PQxXJO5P3u4didOBHy4fI4MCRS1KiV6QmCAHl5yQr3WdtIMqT5vQXxCmvYe3BmrHF2\/vVwJg7I2dm8p1xJnmIMtjiqEGmYipeJuLvdC0taL5z\/mI4umSoZh1T2BIvdklHpsoGKl5X+PmrU3d04aJ5QnmiN6U8+QpKw"}
01310{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":167,"source":"teams.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":13,"flow_first_seen":1587041677042,"flow_last_seen":1587041677186,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":5981,"flow_avg_l4_payload_len":460,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60535,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
02362{"flow_id":7,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":168,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":186025,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex3AbvbPWn6+nzjcIAQEAATNAAAAQEICjCEmothEx\/P5AmATORmFYP7I2nBov1DOAa3ez5VMz+PdmoaUFqueTVtrK6BWDsGuC+wteXP56yloZigSrL1zn5wqAElpR2QDI6BcRTmg8QMRyjfeb4vwyvMIp6ednEyNRLjM9UI61peqgEaKrCeQaTj3cUM+87eGrKl7rWU0WEtwPbfcF0chHYC54dD2eqPaxDrn0SrAZ\/3hM21\/NLwc\/rsCwUd+6z49H0jtsFJA3pEVnc2uFuifTEU8fV+EltPM58dgx+yEMvHIa2yeC\/l2M28MJLAGg\/KzxzqcZUNuoZXBaZ2SDbk27Mm7sn\/iQMWzf4knknVOMXmm2XbL0GfRoj0rOdZoHnh7bX993OeADKhh2oxODmT3lfeobDuVl9dR26Wgmnd\/U7Bv1Fz6v6Itihy7ax4+uA73pZUKIBd5Yo\/mHk5jXqWUkP3\/qqPpmAzdADUEJPaoTDgJHolRMRkz1DyAJ5Z9uJ4qJ+mGy1QD7vxUM2EVm17zwbSraGm7\/xo8l8ntULPYeo3KO5dd02xl9n1TqSIXpFazXZJiXSEcAP1jpS9GLVQOqMr8A4y1O5jXKdIMQcLSNxrJ0WSfh3TfGxNfpHUMmW6fDRxgLvY4yAm9j197rcz9hDiLyzJcAZV9scJNavaz+8Y3nv3emG6MapVINyRXbSoqYhwr9CE5xw\/Cu\/uvrXqBo+Ud3v4IWmBaR4xwkFTtY2kyLJYf6Qxpk7mvxoTPK+ldpJBYpuq9N2CYCYHnEFxyHCxXFmtBDnnqPIKTVVbSICZW3YtZ2+3sxFaQsUMHc3OBuDLid5poF4ghFzlCIeZLXPFRFzpYxoPEniy2M7pHyOkOOQFfUvrtvRmwNVsEx38lNS+6cbyaoetDBPAy3utqb0CthvIr6yxrlodTKlRQRS+2gJVHK1aA+wdmK2joJjQuqzWb19lN0YIhOYeLcWCHBqr+PAoJgTXBLIsk\/5iDmd1R8PZzSPuvJ9Xtbtqs5X+boqgaRmxphDHQ2YCN2ATV4JZXhjQqS5nTwkNib9JSFAX5YV1wIb3Hos0\/DgyII\/Vn19IJsBQ8fUeOAN6I5HE89bje9Nt6VYWR+6q74OkrmxWYpyPQPUzyBZ7l8zAWsB3p6nH+vAqQeUnSoWR3Q2ccJVp20jK9YOqZX32QS9K80Sj6SJ1elFq9LkJC2TC+MRYvbaxiai0NluhS5WcEgvyuMlvB1Im3lLPPBexFgYpMFSYxPZHswwLAHKNFzf+lhB0IcX7UyIAwh6caK0RSTgZ5CVoor+qnesmsUvUP6Fr\/gwSH\/uQyWnPbBtmFOubE+BSf9TeLqobSwWjKnF6fJyMsFMvjxcRhPNO98nUBX0zXnFh1Hqch4b9OIwkLLNX4iRoIQC3KRdSO6s+veoVy9+D7WwJR0I4xC1Om+NX85sI61O3rXfDdhV\/IP5FKd3rqlgbUANCvg41Rb\/3bSZ\/OBOcPlQ+PV8kK\/YHb1d0xKncljiFoGzUHazX5hHApUWCCKyPCaKh6MDF7CVih7CNP7uSo4WcMQtbUgXUvj\/YjlOJoSFeLHVCAq732L0zhE8afzX5SQdkoP5L8CG3zaiJySY8SLPAGJgq2hIoqvr+XL+NO\/b5QaAqccKUSkz300JQPuPh3lQjSQZ8\/5XnsrAydUKvinZg1M69wJkuUdRLAEpEV7rXuiTt6fk9GI9REZDKL1FamMKwrubDExZzQ1TByzcJamuFOABVCVdQ5orB40Ilz53WJ91yOU29DAUJRkFWu5FB\/iQL5\/QcgOFH+Lfs7mS87O4pajt3wpkf4sdsnguwpnxbM38tvtUObvzU9R5RA71\/0ip+jRfq8ZJn+6+qiAkceMaPf+jCAC1RIRDEGk2J9YcqJ7RA6Tty7PCVxlus9ufktP1enuaHhXRt\/YdgEWSvILhti15K"}
02364{"flow_id":7,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":169,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":186027,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex3AbvbPW+O+nzjcIAQEAAFtgAAAQEICjCEmothEx\/PnbPSWryiGzQDS\/oFUBlW8bowjYxMP9iVB1LZDNG9xoaC4GLRUNkCELYmJU4K02gjIvu9srl3y3tjYCayyUnwhCfELIPerCfHTtF9Nz7Xde31fWkQAufe25dxtBq4vdbcJBXxfvUP2KXraRglsYMTPNQAKCPOJTv\/rA52cA9l8PfBkRcFCvU0gQBr\/+XALJwF4wQDCTWL\/TetSwT\/RsgmMKMxhP+ehM7r\/5f6cyhtmVYPQeHmJ3MbymkM6VuFxgQje62RIVYNEmpTLzdI9uZrqDkpzyElVE1YGPCN4G3nib8AzHehlq2EBFPLShsFEAjeq9D6heur1JX+qxFnp1E7C4D546JbHG0eft8cxKfgj+M1fK9Gr8MJXsqCIcQu3QBCDYii8MQ4y8Pk7b\/cKtxEy+Q0Q1HCyJ4Dmm25Iu8qghDIddAish2UFxW7\/C+qda7wgKrE+9+iXpyuXlKBbVSR\/ED7+dPTK8Xs0eKyU6GTXo9uITAj9ck3S9v4nku0XSqhWsvREQlb4vCBrRU7oo3jwyQt6TXXQgp10a3vuiU2CDX8yCcH7155l5ry7VXy4PYMrCTveQYJtAUkuTa5orWzQoUsBToeW6pBg6YigktAJm\/ARWCt0oCbzjhV86sL5sKEgisoVN7n2EYOYAzXj1gOkMdgQKujmKxdbznVmLiRdVp8w8VIjtx5RCyfAltOsDYQGfpGlKygkkscvfgpAIZ9evZmMFP6Y8zir3NWCI3cwLLy20A0UEQ0I+XWOgnYxBYTizgMmOYxYN6G7zkrSn8Ysk\/8Z5Q7jw9nMg1GdkhC9YDT94WxyGXjcItRwWjZEPYOEO32W6quMs16FPwgG+N6ycAgCyrTY0Cn2I2J3JlOMDojejlPa16j9tYoYfLsucILwWnrYYxYZDGXuuiCbIYjrH5zeNgQS0r2UVGFignNnhNiN8o2nueU2N2sgbj8\/vi9A1acTz8Ua+VIHi8XxMlSEV7IX3cxzDz4Mg2I0\/HSVy2ph3\/VlDddmbliDP6h3TW86Lg62C\/uGdSZfALbx8oqo1hOeq9HE0BDq3H4oM3mMCdo7csSDZVSoqhtyxyh3p\/fpbmTbD8hGhTJYbPL+sFzSarPK2QWRJXF\/IjalEx9KyO9X1z2d+TbJkVHyv99+29Hc8jUcWggBZYYHFjBeF9kEs5B1dCfREobsVRPjholcCBRdExkXhm0tkBeythz5DWelDcqw\/PFC6azVGKC7mKqXcFxOVRWY3h87IYj\/dtb13hQIf36szWaDnpsvC2EV5BefktsYN3yX1t9IKLECSAzzFF6+Wlg2DD8XWL\/dNeaQvqRPuA3mQ5wIB\/7+aqqfS0w9ZKGdlGRyBNE3\/3\/06xyQelV1M53oa71uwdl9aMSdmT84qK5vOQcEYlFiFVWf8SSSpch8Skv5VyfMpdj2ToeUkhMHoPcY6wbyIpLPxR89e2u1jCDJJkBTjlK3prd\/BDQ6hiq9wvF6ls\/zF9DLTgkJKgNN2kF152YeenpauZUlkeZ+MTHbU1MnL5QtrPjBmG22aWD+D2eFeIDStsWFqnYEhqU3uJ24dkGCw5aQW1o1QkgNM1jtxyqwafrW+650eE8JygtQjGRv2D0vsDSu+anLhAWXJNymra31+FzOo6obZg2Y1Zt2945tS1NcqpKMEu\/3wpIc328DjsmYXNmyrP276jW0U\/MoxzPu22nU3VNBkEchmC7+H8ndefuW\/c2oahJizzZ8\/VmzGfzbgk0lsn5aQ0TtNvQUBYggMWNAP5oJeHgfwom6zG71DATTtL78SMl9SCALU3HmGx3DSl1\/qIFmAp2TfsSAJezp0WgP07EPyLGrOg1C2LpAkdU1os16JMvMPYdzAKaMgjcHfp29sd5EmfhehI02mz517NqAmJbpDL9K6Hn"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":175,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1587041677243,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":243705,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGghTAqAEGNHHChOx4Abt\/TkvVAAAAALAC\/\/\/5uQAAAgQFtAEDAwUBAQgKMISawwAAAAAEAgAA"}
00424{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":255126,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wUlAAHUGi9Y0ccKEwKgBBgG77Hiki1UTf05L1oAS\/\/8DeQAAAgQFoAEDAwgBAQQC"}
00407{"flow_id":8,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":255227,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx4Abt\/TkvWpItVFFAQIAAkOAAA"}
00699{"flow_id":8,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":178,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":255452,"pkt_caplen":268,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":268,"pkt_l4_len":234,"pkt":"EBMx8Tl2KDc3AG3ICABFAAD+AABAAEAGgVbAqAEGNHHChOx4Abt\/TkvWpItVFFAYIAA3rwAAFgMBANEBAADNAwPZLPUYRvEghAe9kJUNx9IFhytDuazyHj3Xl0vfJTFFvgAAHNrazKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACI6uoAAP8BAAEAAAAAGAAWAAATdGVhbXMubWljcm9zb2Z0LmNvbQAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAABIAAAAQAA4ADAJoMghodHRwLzEuMXVQAAAACwACAQAACgAKAAi6ugAdABcAGAAbAAMCAAJaWgABAA=="}
00742{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":178,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":4,"flow_first_seen":1587041677243,"flow_last_seen":1587041677255,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00415{"flow_id":8,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":179,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":266382,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAowUpAAHYGiuE0ccKEwKgBBgG77Hiki1UUf05MrFAQBAE\/YQAAAAAAAAAA"}
02370{"flow_id":8,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269133,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUwUtAAHYGhTQ0ccKEwKgBBgG77Hiki1UUf05MrFAQBAH1pQAAFgMDF4QCAABmAwNemFWNnrZpaF22Bped6ZWw91UwI3oUldGCaX5R54k8RiCIFgAA2\/RfiviLafpeQF8wbrmKm4c0zQA\/y2Pu6GvQeMAwAAAeAAUAAAAjAAAAEAAFAAMCaDIAFwAA\/wEAAQAAAAAACwAOdgAOcwAItTCCCLEwggaZoAMCAQICExYACfRizWOR6fGx5P0AAAAJ9GIwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MDkxMjE4MTY0NVoXDTIxMDkxMjE4MTY0NVowHjEcMBoGA1UEAxMTdGVhbXMubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOO+GAF5FB9ACneJsYJqU+PaAkwhs3Pmnh9LB9B35XWkyrIOYraOvvuhrHxhFcxbMuiVa3ke581gm0OvyNFkH2vhqLGtQ51IvKov0oZNIk4rt1kgisStRRDSjUTgKLPQ44s9fKS9qz\/Va1Q2\/LQEZQNYdKcaI2nANY2RmggVm7Aa\/Dx1r4sJ2SJmuRoiN6m9zGBwTorEnL9Q2Qy5FB5\/iaYy2JMNbemS7IbV+TczygQFu\/QwI3ZrqvbUGdtEzDIOU7YZXOmC6UcqvvcY0rIuNd65HCSFAv0X9ivVh0LGDegTyjuqKz68YmBI\/eJFXu94jw\/tEDwiIAZfs4Qk12UiGJsCAwEAAaOCBHgwggR0MIIB9QYKKwYBBAHWeQIEAgSCAeUEggHhAd8AdQDuS723dc5guuFCaR+r4Z5mow9+X7By2IMAxHuJeqj9ywAAAW0mulFVAAAEAwBGMEQCIHebEsXaxq31cmEfhRo\/gehRDe\/E1VvIxKmBjiYm513RAiBg9lvKKuXFDabtrglkBNY11LNgy+HL5dblDYVf8MIppAB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbSa6UVUAAAQDAEcwRQIhAOXf5ZJgk7Qqrx2VlFvAiEAHVXnD3mS7WxPkEHf9oGczAiA4\/Ss\/FGYnu0+Vqu\/igskDlNIA5yQpWRpemVD\/90ZvtAB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbSa6UqQAAAQDAEcwRQIhAOcvU5U2Fi9LD1ckKACgnV\/R4RUZapoJoV\/V8Nkdsox8AiB+s48woDYS2UZcbGfro+s0PlMOsyBbDvpNcsr42cSgwgB2AFzcQ5L+5qtFRLFemtRW5hA3+9X6R9yhc5SyXub2xw7KAAABbSa6UYEAAAQDAEcwRQIhAIBIEv6AY07+qXpuv9wKUq5PN5rdrOhWtdzhJm8jXedKAiBSHHhgI9NvoD6YhCpK3V\/Qif41w296yUSCK7eujn89vzAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYEFCbjW3RNU09jtsrWbR3zyYhJ"}
02359{"flow_id":8,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":181,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269225,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUwUxAAHYGhTM0ccKEwKgBBgG77Hiki1rAf05MrFAQBAF7ywAAxC7UMAsGA1UdDwQEAwIEsDAeBgNVHREEFzAVghN0ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUenuMwc\/noMoc1Gv6++Ezww8aop0wHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAjJY5eD13an7Bpx5xxIqIPAsj0wiAkSQlVHG2eWn1U7EMYkaYNm1bcZdbxatFHak6SPpDF\/BFWOAuxpq29sjki83Ws\/tIbRtncE4DVkv23fvgeWG2G8sq5qx4c5qA830fqmXSktLgOpsdgmBaOYSsTY0x33dUHa4NMN17Lj60Gsd3yzeSYx7BQkMQJ\/V8Vdknwzcy4ja6ZEHFlhJa7naHWvheu4dpEV12l\/I7XnKJj3AvK6V0oRh9ztLUCO5SEw\/4IchbkuDrjeM7N7xqdsbAB+zxItuIRkK6NPYNfq2P1YcBIYP\/55E1YA\/2W2kVT3L2yJ3TBXNrhGw8kxGBtYIUDJYcydM9DjdbmXfvOOXkrLnLmQLDNp1UY2giyd1SVy6dmyy4UPGdKMrUjUJxLeLEth\/qlHwMQ78rdVWdoP1WKC\/rLalfyuTCeXW4p3qIF7Av0WcDgkUyDRhNrOo0xzsIbxL1KpcpwCXtJW8Gn3LPsecGEsCzZJ4Oio5x7suMWRhIOATNYjrQKjkP5yhS6WUM11anpHQdizI1hSi0Dsn9iu9KVNBmLjAhQpIWNLvziKckaPyFYM8Jju2yhenSjGdxKE8kwLk8CNf9zLVQ456aLfF9ge8FhSE9Tl8aBpIGGPaqGtl414VBcDE1HXqCtckuHxFFd2OvG07l2FddY0bGOrgAFuDCCBbQwggScoAMCAQICEAtqs7A+san2xGCSaqjN\/rMwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUyMzhaFw0yNDA1MjAxMjUyMzhaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKvl612jazme9TSIErsdUiZdfQkLxnmOq7cO3xmy3e4P9u70VuRG4pIP4mcL4xxxpNRBc7TLmRaOv3d9sK8ebO1xLsMId0pekq7sWtBIgdDF6aD1eo8ejV7TrZLA2saRNTEguTkEzRAqPJcdAJ6ZGBgJz0uX5Mn8APAMWp026LJAwUqshCiqPUYYK6eKrPSvS6h+SULHYiDA5qc7XeuQH7uK2JyQ4zqxbMKUzj4ya8txs0EuucXhXdhZJ4L74UgNfugE8fkBJ0H6lFp9xTC7"}
00407{"flow_id":8,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":182,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269282,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx4Abt\/TkyspItgbFAQH9IYOAAA"}
02367{"flow_id":8,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":183,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269349,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUwU1AAHYGhTI0ccKEwKgBBgG77Hiki2Bsf05MrFAQBAEOfAAAtrrXEZuI+gHMbkuSufh4PMucaJoWZojQk7Aqgy6XER1+gSBh5LC5m5xuU5WVIsbZvXUQutl1jDw\/HdCW+DNFe3sfVDPlSJenBSSi29Hcla4gKn2WiUh7knrQJLHeSBH3Zzy03\/hYYPVPezRo5v2sJgi28yxD20\/EFtCbDHGHsQdrht2PoLH7ZtrYy+ny8GXljtgc6i+6LWTxXtAbULIMhUrPO8guKmp1jMCuXNnpwHx9fNqc471KsGAHgit9XcgQry5ijNya\/eHZuVlIl0Iaw1CBCx+DImvkm7wpIoL9gFFcdV8ONcLdfy96Z589jluMu6+d9MwM+6gfnSHB8+dSGl3OFFdtULhJ7rELJ9LiaScSbsbAJj7npCsbi1M4BvoahzrgS3+ZFk5ZPVlp8XGnZWUbAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUenuMwc\/noMoc1Gv6++Ezww8aop0wHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAEf5yBjohCjduyPUpIgJinkUO7foGn++\/niQ1F\/45iLK7AeF439GLl\/23d\/GKck9JOuizKdd0h+S58xdgh4iSVYK92X0TSH8GkDqJZuedlveVzWAP1+HK9nbu+ps1SKGYfdKTKk+BFseolrvRJfOmb1DaAJsqqPQ1AOP9LDvt5RWbfxYPx47JNiCU8B0BuRJQUJmB4ChCLI54\/+3GntXkyumgqrNIT6Rf5IsY\/xMCLZARNhhmKDoimt6V8Vnun20qF3WTUMMFEtXeZLS2vNvXdln+pdblVuH+Rlw7ivjsDvvvEpCRziASgbo8UuN\/40D0DEEgZocY2jJp4PbcjyjyvRYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBSf5XT0Ei8HGSR2kg+kjipmqRRaChgPMjAyMDA0MTQxNTQyNTFaMIGbMIGYMEwwCQYFKw4DAhoFAAQUIq8AHIB1Ygcm4MiTGuynQhwyEjoEFHp7jMHP56DKHNRr+vvhM8MPGqKdAhMWAAn0Ys1jkenxseT9AAAACfRigAAYDzIwMjAwNDE0MTU0MjUxWqARGA8yMDIwMDQxODE1NDI1MVqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNTE1NDI1MVowDQYJKoZIhvcNAQELBQADggEBAEZyDVJqZdwwAYWXXOD\/WrJx+loWpBj3rt4Ju8CuGr\/+GOp9YaKjTsd1ULlSvIiakNcZCaeerfJWuw5x9pmfpA7sdUm7WfLXt8dHvTIbI6u\/QBpm0O5\/50dK12yFJyL+JLu8x3U0zG70PJS1qjz6q2WjOGOX9GPt6zur4BdBvcpkCoYfpQKxudHidYgsiEHuYGt7bIx7Z3KqvQTd827Gi70N4QvZQ6vZtqxwrT8SwCsNfWDiumaGQnPQr8+459G1FaM+QBf4accdUy1kSzx4bpnaShCU21X0Ar\/6TIxnD8ADKcZWsXt68L09I6Xp6JuhP25qW0XLbHcPtdRR4+PMzRegggUjMIIFHzCCBRswggMDoAMC"}
00408{"flow_id":8,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":184,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269406,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx4Abt\/TkyspItmGFAQIAASXgAA"}
02369{"flow_id":8,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269473,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUwU5AAHYGhTE0ccKEwKgBBgG77Hiki2YYf05MrFAQBAFxvAAAAQICE3gAErJ3YfnO2ox+\/bwAAAASsncwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTIwMDMxNTE1MzUzOVoXDTIxMDMxNTE1MzUzOVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV80X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAEyAX+5SqsGiqoUBRMLbUF1MOQcsxK8kPSKDVxGywx62TXqosok\/w8WIw51eitl2x7hGoq0+h3f95iPllxy7yEMgH7qmedNRiuGxRK+fAa5MH9aVtlomaFyqBArysde41\/HXuL4UW4GtwiAkT5ExgE2wHYEV7T5X03YsAWWM3JKQwMjB+rXZkft+Uk5MWL\/cJto5+yML0QwJr2wL9Ak66bKsuEMnGd8UzoAOAp5Rk0DmxRztNTjl\/lZ2ntFXsAyJALx3q0EDreLw0q2SftDOieUHmNsOvbAPjYsWKtDXayhXR0gqkwAbamSUrmFXf6QE7XDQuHTRyG7d\/srUScNlDAgMBAAGjgdYwgdMwHQYDVR0OBBYEFJ\/ldPQSLwcZJHaSD6SOKmapFFoKMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBQf\/nlSogs2KaMuQIKX+dZl6u\/fN4stOkBATIA+8WfgJ+qNyF20yCllnRhbqa4pd5JTrRYGJZhGA7agazmyim9wGvV0HcHxLLN3oNZBP5gF5jLC0IqxgJEvTiyy1\/1wYRdtr+SpcKNi2ZCac3x7voBvsf3YH\/f1jAp2zQ87qKhRy1PmcUkJdsJR2OnkYNgdR6oPKCsPkPve+qZXjBdfEVjq9duYM1IFFq0MYXUlFCy8YhnxEcasx4mCnA6B14O98ewaSZZhGaP6Py\/67LRhuWf36qXptvXI8bFJZEld25A5aR+COHvYWrlWmmfie3I9YEeDGTVodHmHxesLeBLQQmxpuZgnJ1eZYwSS2g4bPN+OSonsgPlHLzmBJcUpzxJl3mgtcjyN+2OgF46A4V1ENucCVGdLYjsbo\/kk6U7V0KiqERMGjIUeUVMt9tfNUf6xYXUsVOKsIfNcAMbDiCO2hf6q+1nKxCJw6p0qsB1ANlzJi00XH17tvsddvABkR26jQRxWpc1ck4l6ErNYoE186dUnlcdlKjaIHU4jQ4CS6fS1HuZFQD6VdPpfAFSv8BxzC46PHD4wMhUHF2gx9Kp9\/ATrborJ6OxeXVS1Ba+IQzGX6MpVsGiH22VzumR7tEvftwy0MX7pfN+X9yHBrJmVvFG4s6d6wUOHM9cT9DziFvLgAwAAWkDABhhBE+RAXC\/Xyd7UGeindq9xlq2qMKybD1FvF7NS0Q4Wnqgy+n0khMcobgonh6xbfdP6E2KVfyXbwTlraeuMDOGmxneQcHBifND6feNrPEleiAvyZ63CqEHXbuSCiAa5uZ0\/wQBAQAuqm4B5\/bbJuxzQ4HWtDDnbGvzWU\/SbPr4jUYJusk\/mOTB1TEHVi7Ysu5R"}
00706{"flow_id":8,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269476,"pkt_caplen":271,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":271,"pkt_l4_len":237,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEBwU9AAHYGigM0ccKEwKgBBgG77Hiki2vEf05MrFAYBAHfiwAAXmhm9FMI3qyjcnWYHDq5pJXe5LxxQiXcS7F7UMWyodFmf0Y2n4UV1oaptfAq62Mp0hzP0jkRR8Koy5NnpWVYjEEaobvfceXcy2e5kVF+mgUEbNMUUEHK0j5oyhuvhNYbp2ZSRS2srlEhhTZPrqPsdetHCr7lhX+majSPjB+X\/p7T24uO+LOMiS\/yeCk67d9qdVGcdwSOZ342Z1h4dM\/m4hrDY2zgeDXbNjB\/GfFdIsk52m7C1N7zBwfS2ftaTTJLXZDO0benj1Uao8znBEwW3iHOavB0DgAAAA=="}
01061{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":186,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":12,"flow_first_seen":1587041677243,"flow_last_seen":1587041677269,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6239,"flow_avg_l4_payload_len":519,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","server_names":"teams.microsoft.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"0f14538e1c9070becdad7739c67d6363","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=teams.microsoft.com","alpn":"h2,http\/1.1","fingerprint":"68:1E:E8:3C:83:70:6F:E3:86:F4:E8:8C:C4:E6:A0:9A:3E:E0:9C:0E"}}
00408{"flow_id":8,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":190,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":269547,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx4Abt\/TkyspItsnVAQH8sMDgAA"}
00623{"flow_id":8,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":191,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":274350,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAGgY7AqAEGNHHChOx4Abt\/TkyspItsnVAYIADFvQAAFgMDAGYQAABiYQTxgotmGkb9FcH5FUJAmY+IuSsOw5d+NiTKNDdr8gMKGCiRz+OrN2usCVeyQuJ2hYG0lEs1BP4wAxS3bfPvL9r2KEGBZkrJHYatnTVZxhAAdnXdPSdHbUfx19ZFZrZkHzAUAwMAAQEWAwMAKAAAAAAAAAAAaIoAUkcmslIl15A1c+bAL53g4S7Y2eLaeTpGpoRJasw="}
00415{"flow_id":8,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":285008,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAowVBAAHYGits0ccKEwKgBBgG77Hiki2ydf05NSlAQBAEnOgAAAAAAAAAA"}
00406{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":403,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":380886,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGPCzAqAEGlZqnW+SlAbsZTPC8DAoX91AUECaMmwAA"}
00385{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":607,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":408485,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00148{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":607,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00779{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":422728,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzES5AAEARZ+PAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGADtdrMEAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":617,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041677,"pkt_ts_usec":611261,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00145{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":617,"source":"teams.pcap","alias":"nDPId-test","type":38}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":618,"source":"teams.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1587041678029,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60537,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":29919,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIex5Abv0H+uOAAAAALAC\/\/9XkAAAAgQFtAEDAwUBAQgKMISdwwAAAAAEAgAA"}
00435{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":619,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":74133,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8KlZAAGwGoSQ0ck0hwKgBBgG77Hk7ZXhQ9B\/rj6ASIAAz8QAAAgQFoAEDAwgEAggKYRL\/2zCEncM="}
00422{"flow_id":9,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":74233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex5Abv0H+uPO2V4UYAQEAlydQAAAQEICjCEne9hEv\/b"}
00704{"flow_id":9,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":74525,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIex5Abv0H+uPO2V4UYAYEAlkRgAAAQEICjCEne9hEv\/bFgMBAMkBAADFAwOeU\/FfLHrtrdCBVUwx+w+ija6LF0MoHL44Af8vhwR8KyDASAAAvuo5mSGLHTbLJlo\/aqiaHVmeYbbWtXIqS6QEPwAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00781{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":621,"source":"teams.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":4,"flow_first_seen":1587041678029,"flow_last_seen":1587041678074,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60537,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02364{"flow_id":9,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":622,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":120796,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUKldAAGwGm4s0ck0hwKgBBgG77Hk7ZXhR9B\/sXYAQBAVKXAAAAQEICmETAAQwhJ3vFgMDEGYCAABRAwNemFWOOTYxM1NwQpKmeq910c4Y3+sTj8LkGeyXAZo3KyA\/IwAA6KEdJo41XGChq4nIXjJi3Ldaf94\/c7z6UnyyFcAwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02359{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":623,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":120831,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUKlhAAGwGm4o0ck0hwKgBBgG77Hk7ZX3x9B\/sXYAQBAXWRgAAAQEICmETAAQwhJ3vLnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00422{"flow_id":9,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":624,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":120910,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex5Abv0H+xdO2WDkYAQD69magAAAQEICjCEnh1hEwAE"}
02214{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":625,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":120987,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfKllAAGwGm\/40ck0hwKgBBgG77Hk7ZYOR9B\/sXYAYBAVgZQAAAQEICmETAAQwhJ3vBM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdICEPGiTacHJnq6PrPlvxEoSaCKiLlyOZHNbVkDzqi85DBAEBABUbcpY7flrxlEmvDQF\/IYHc9AdP2GVXd1cOX\/fYXfT0ZSgvuD5sBNK5kL95opARYfACknMPnR9YPrMt4drq5G4D+3Cq1bWVzdWq+Y6vcG7\/6uyH6ZztbTHWxMaRhLpLKLYHjPBw59DsssnYv\/Xsw\/X07nCzjEwuAfVl+DdsaTEacepOIpFcFqQOg6LM3hKoP+z0mamxSI4\/NqdwUUBwZts0zK8YKpE9AzWTPuNF3\/jzGJyN2ecuBhwndtaTM4BlK30GTE3PBMfPZH0YwgA+aAeOVv1qWqnYS2k6eM925BUb91FnctQbP9V0JMtxgrqfeLE8JKM916dg0kOffJQ5+7sOAAAA"}
01309{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":625,"source":"teams.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":8,"flow_first_seen":1587041678029,"flow_last_seen":1587041678120,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4409,"flow_avg_l4_payload_len":551,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60537,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00422{"flow_id":9,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":626,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":121021,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex5Abv0H+xdO2WIvIAQD4ZhaAAAAQEICjCEnh1hEwAE"}
00423{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":627,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":121060,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex5Abv0H+xdO2WIvIAQEABg7gAAAQEICjCEnh1hEwAE"}
00551{"flow_id":9,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":628,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":122107,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIex5Abv0H+xdO2WIvIAYEAA4KwAAAQEICjCEnh5hEwAEFgMDACUQAAAhIP7RpoO5uqiByuxIuFaSUf7cSQPUqY\/bPrLjbKhyQYw0FAMDAAEBFgMDACgAAAAAAAAAAA2bwhqRB70JhCC7tK0J+uT0p40fntt9Ofuwu8IMPAUS"}
00494{"flow_id":9,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":629,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":165509,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnKlpAAGwGoPU0ck0hwKgBBgG77Hk7ZYi89B\/suoAYBAUy2wAAAQEICmETADcwhJ4eFAMDAAEBFgMDACgAAAAAAAAAAHelKESahrXk8NeOsJcyeXwB1mevaMDIfanvCHkpcUO2"}
00424{"flow_id":9,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":630,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":165603,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex5Abv0H+y6O2WI74AQD\/5gAQAAAQEICjCEnklhEwA3"}
02361{"flow_id":9,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":631,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":167012,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex5Abv0H+y6O2WI74AQEAAoYgAAAQEICjCEnkphEwA3FwMDG2cAAAAAAAAAAZWrlc0xquAlEvLg1qd3Ae5HeSo+iORe3JZNH14zWSiFWZJRmwAZvfrqVn7gmX\/rBt9nqaoLblCpp70qMBnSlYFTpLvirc1co0KqGiQE+L+jglGG2U181le9GMVy6lTlGpt3HjbhTIt1xyS2V+dwLbOqWsppgDq8iEvfGeRGjo8ubs2SAmphgiJEVy+ftkrvWmIxlnJEe0KJeNfyl420ieFoLwDIKqKxsKNo6wrrtmz5U81Mxy5z9+CVZRVUR1GSMDdtSjCDuXfd0er7qCMW0JkPh3vr6ANjn67SFYnQjWRYyUrtbC\/QAereKfnogKEVrQYU+Zi0n3EfB3UcYgsYQi0Jzr3lsWTtOwT\/xmia\/4cCIicAQ\/GMhxPKNinUw3VBSdzebgMVrM5lV6emBMyD9p97FPZFSo9oMfOuOqPOV9JM5biYw56\/12WdgNU4QNKnnC0X7VNC\/qsy8xWEkirzVaJdTjKQVtA9Fdigzp8pVZdmcKxxLYRg\/Qy20HdyxD1dWotjW\/iCqC8s1AXTBo7GlVjfO\/46wnL+Z4hJ9ooUjSQJ3qd0vK2MQRbUbbfNbpj4x2tSKJCGnRMDszzIMrX+hmB7uef3MI+S59QOmIsKrXeoNXsLxmuRw6W4F6xhxYbgZFioL71ouyMa\/A7+UR7J48hxdj08TZzumyLbjJ9ujRMIAhxdFkXyqkmWuq6rw4XZ4o\/0QF+S8Z5iYLfdWj8AKOnPMSYoPRfAU509DGJp1aGBtfkwf5gGb0I\/iYSVteGjlJI\/tk0wbS8mF\/IIb7FHDv71tM++F85Yapsne1iouzN443i3GO1l0aQUUV5YLGK6AiH0expNocaeSgcl3nS8WrX9MnMPzJtLpks0BpM2Y2mIbS\/a+CGlovrjadPZENRsN1miaMj5bLtdR+IMvXHqlQ7IHhdsaneLMkjaEms+l5c8L+yKl\/neXkCF6qYd7ugaYZ86T4LTsh6vXy1C1Gh3YoSFW7TxxTkhmdO0sPy6a6rOF4q536Obtt0ZjQL7Xya8ZO2+aniELVmXA2pi7zgWFG83HZPnAB4T4CgzzJ0VXZta09U\/tOKTPbXRti5aNbBP3kgjHoOKaLQa0fOHzHIWxuUJKV0JtnpeiVrlepeA0jYzOP286YEkCbpDlE\/bzceBRqNAShu6k+gRSkYmKG1WVKQqdIEawJwhNbLpBJa7HLC35zrjR1vC08PdBJPZHkGD9LsgHqUXqGDntDrZfuxV\/28wBkPK67i2NTOWEroUVGereH641SSKM9CWqsYmgq9pJsqdJ4wxEsuyiurR9ftmh9Dn5IQwpBeKzF0LR7w3SuHdkAKTQFB7rMjTx2HntUhG4EdcNvsQVLEUWh53KJPbvECnbJ5nHenBk9V9f0HVxFzpWLfveMyIf8bwtZw7gacmbaEHux4rkgMeXCJQjw\/DtoPIKQ7g2DZoVXj+LF2C9tapALqNK4Fo\/ZVZnoOTO5ChtIFuJA6d+3\/JzAdDHm+O3MsVmKgaicqcTOZeCd75hKNXR0\/oWrcWr5FIx2w89TRLqc8ES7Qdw3zwZGFPs27DKxhFEVnWuZV\/McUmB92gxyYl1JVZheceYxPjLdgTM4tDQrPgibg+kExAWj1UTbwyni7kq9MHpCQwNG+YfGuOlxjWQFkiomPenkBPCTFSHKvYLmwTfK\/6qrFdmMMSPpxYNgs40zsx+Ft3HXLWhcxjmnYtEwsd3W3I4Rg1kZE8bwc95mkKpIuMlzIUYZi3raBYtR5ACkmghCN7voA4EDuCeqmMDvOyrhei5CYM6AuwQKXhoU8nXbOcOmtd0dI\/dTBJO3mj+nR98Fz2PF5aAObS\/JKA7B9YmvOzXszSJB0xa6DDIfcSw6iiRblePgc0QjR08bOQ2XbS2+hB"}
02360{"flow_id":9,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":632,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":167016,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex5Abv0H\/JOO2WI74AQEACuHAAAAQEICjCEnkphEwA3J+mKwXvMvO8jfyhEiq4VtBb0DtQ8isPryoapLKM2XxbLPC6pdDIeSIAwXVrF08zI4T\/yzbSkl9w2wMdC9g5YanKAuHEJ96oJyzuW8ReCHP9aLsp3AvGfcFqr\/AnF9VVhOFq\/aRGmqk+ftx9jHdFU7La3MJMRb0FAF3T0NoK6lMgh5JFfDyD4hClVL5yUd7aJtp\/onXnRAa3qXgrkuXwGo3gZ48T4YkBKLDFE7gjiqjFf0eqMm9d3y\/5JC92l1H1VpmEqAyLCIMZaQMErwXfU1AYMA64uvLVUxAnIwfzRexoX0U2ADCPeuV\/mrPM53OMkHlBXAbkr5kUpoZm1eVvF3jIjXmNe\/z+ZFhNbqSPwbpCwaiOFHtP4jDPCs3tUv+5tvPiiwBsoYfAADbsV7YWtp3iMoQaIAzXk1hMy6dQyPBAmA4b5mjKDIYUpZUVoCYV9fCCOmc1+f2E+BwBcp64ChwwzDGaENNLKxJN4hT3pR7aU+3srTUfZMRKTJe1UsGrFb9EmBcniDvg2fqh0KZ2Cj+Gud6xZ0bg2lr7iBFi\/j9ppWYlKwg4ODh+6QMmUTVJ4EqZC73H57nN0fs99Zuj1JdC66ebUny3bRweuqhkjmQgtftv8QBwRZ3vY47iMSUjbmytbduip+HnI5bcdv8K9xn40cmub+pon2DZ5i\/GcvZcenP5xAk24ssyosJuV8AUUlVJcz5WvzOzXbxUgiQ0LU2Co9fA8TxSQ8Q+BDIkoaZYEc3pYEQiM+b1lRmL4RcwRifMmkZOH2xx\/MXNKGpj2mohaUHSGAnu3jAKS6WmRqhrtcWAfEwlirw++SKoF0sshMtkSYFloGaFPFrPf185KwWATOK2ym83A5870DeQoP1eSkY11vx+ExqyySQiBkyYHtB0tiUi3COVsrybNI5EOQtWusiWFkAogY9yUXBpb4qyPbYczG0iKPISEJzUs81Vt2cdNzBP9Ty8Js14b3hHM2LUD1jH6IU3rQzokQPA226onwObbu1tv92xfMnnzHmB4iS4+kImvhQmRJyCqa1wbpLaB0waGh8MzKMNZGKvYESQV2\/n76KYiG\/n3daltozEvfLDBzW1VUGVqb67PDdrQD3GtB+bI4hwh8ogEBjOPM+MhgRK3LtFt0yLF6WfkUC21rlb0dk\/Oi2Op4f3w0wnwZmxNY+tx+wivYeaTkZ5dsYZ2DYApsaC8u\/9\/Q55oo\/k1bP4S+AuBjJqQFJhtVTCYOlsBugmKaW\/Sn3qRnKgAfkDwKQzpDLG0TqHPlNC8+Exy2AkjcHLdA+Le2hti3+MrppkdHEVaXvgcDQKEs8a50VgUKuIg8y9B1E2CWX36+TsEBekAUraAkyycxjYB0CifaBgJMR+f55yrMKmjlscjkz4m6LjYf5LnAYpa3scIIubyJfeHm0CO+CFKix8I9MUY0sxEe9a\/aovbisEaJWGIPnGKHRhPzl5h2Z38meqwh3+UPL2Ji+RM6cMJR2TvAktmDZjmYJ20Yybxpmiml1+vvcshqo0tdulUe78IAbZ\/l\/9PpFVPcC04jtq729NZ8R6bfZ0VmDXNNukN9J8i9zZcGdeQawz0JJUtS1bIDmGCU3oEyQUjhxBAUz9IWNRH35l9TnleE\/PoX5leE4tV2ZpXqs9rR7Sc5YeC4b71Hstp6sXnB8LP1Y1G\/XziMvq8MeVQ7c8qG8Q9SG4yrwFHt7zKwecAZVHul2jyRRdhYST1LfwPeBZZFHzRlZ3CFnop787FACRzaIejUFmCCQX4RLM8JGSvJ4INFYGD\/pcSHF4qGDCxi3nE9IzvoWNnWITCqzw9On3dLEvIzswSbSPIJJGMr3mrNRyRzyvMDpb9ExgUN7\/GYVNu1m93zfuqwKJAI1pW4XeXckO+wZvg3r\/+NEz\/Sx0hTRHs"}
00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":644,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041678,"pkt_ts_usec":611338,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00145{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":644,"source":"teams.pcap","alias":"nDPId-test","type":38}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":645,"source":"teams.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1587041679059,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":64046,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00447{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":645,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041679,"pkt_ts_usec":59584,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EBMx8Tl2KDc3AG3ICABFAABFmxQAAP8RnTvAqAEGwKgBAfouADUAMTs\/p0sBAAABAAAAAAAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAE="}
00651{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":645,"source":"teams.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1587041679059,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":64046,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":646,"source":"teams.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
01055{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":646,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041679,"pkt_ts_usec":280602,"pkt_caplen":527,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":527,"pkt_l4_len":493,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAIBKZoAAEARjaTAqAEG\/\/\/\/\/0RcRFwB7XmveyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiAxMzMzNTg3NDkxMjE4NDQ1MzM1NDE0MzUyMjUyODU2OTU0NjIxMiwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzI3NTAzNzA1NjAsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgOTk2MzA2MjE1LCA1MzAzMzAxMjQ4LCA0MDU2NDYyNTkyLCA3MDUzNjI3MTg0LCAxNTIyMTc3NTg3LCAxNDIxMTE0Mzk5LCAxMjUyMTE2NDI5LCA5OTQ2OTc3MywgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":646,"source":"teams.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":647,"source":"teams.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
01051{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":647,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041679,"pkt_ts_usec":280885,"pkt_caplen":527,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":527,"pkt_l4_len":493,"pkt":"\/\/\/\/\/\/\/\/KDc3AG3ICABFAAIBMegAAEARwq7AqAEGwKgB\/0RcRFwB7bcHeyJ2ZXJzaW9uIjogWzIsIDBdLCAicG9ydCI6IDE3NTAwLCAiaG9zdF9pbnQiOiAxMzMzNTg3NDkxMjE4NDQ1MzM1NDE0MzUyMjUyODU2OTU0NjIxMiwgImRpc3BsYXluYW1lIjogIiIsICJuYW1lc3BhY2VzIjogWzI3NTAzNzA1NjAsIDc4NTI2NjE3NywgMTUyNjI2MzA0NSwgMjg1MjE2MDcsIDE0ODE5MzM3LCA0NTE0NzI2NTgsIDczNjM0MTUyOCwgOTM4ODEzODQ5LCAxMjY3Njk1MTA5LCA1NDQwNDA3MDcyLCA1ODM0NDk5NiwgOTk2MzA2MjE1LCA1MzAzMzAxMjQ4LCA0MDU2NDYyNTkyLCA3MDUzNjI3MTg0LCAxNTIyMTc3NTg3LCAxNDIxMTE0Mzk5LCAxMjUyMTE2NDI5LCA5OTQ2OTc3MywgNzA3OTYzNjY4OCwgMTc2OTY0MzA3LCAxMjU1NDA1NjYsIDEwNDc0MjgxODksIDQ3MTYxOTAwNDgsIDU0NjcxNjMwODgsIDExOTUwNDQwNzEsIDk2ODUzMjI0LCAxNzYwOTk2MywgNjQ3ODMwMzQ0MCwgNTExNzA2NjQyLCA2Mjk3OTU1MTg0LCAxNDE1NjIwMzUwXX0="}
00523{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":647,"source":"teams.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}}
00385{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":648,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041679,"pkt_ts_usec":406816,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00148{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":648,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":649,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041679,"pkt_ts_usec":611289,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00145{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":649,"source":"teams.pcap","alias":"nDPId-test","type":38}
00447{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":650,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":62816,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EBMx8Tl2KDc3AG3ICABFAABFhq8AAP8RsaDAqAEGwKgBAfouADUAMTs\/p0sBAAABAAAAAAAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAE="}
00522{"flow_id":10,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":651,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":74798,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB61LQAAEARImfAqAEBwKgBBgA1+i4AZgAAp0uBgwABAAAAAQAAAWIHX2Rucy1zZARfdWRwBG50b3ADb3JnAAAMAAHAGwAGAAEAAAA7ACkFZG5zZG\/AGwpwb3N0bWFzdGVywBt4ZvNkAACowAAAHCAAJOoAAAACWA=="}
00672{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":651,"source":"teams.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_first_seen":1587041679059,"flow_last_seen":1587041680074,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":64046,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.ntop","breed":"Safe","category":"Network"},"dns": {"query":"b._dns-sd._udp.ntop.org","num_queries":1,"num_answers":1,"reply_code":3,"query_type":12,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":664,"source":"teams.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1587041680216,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00886{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":664,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":216814,"pkt_caplen":397,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":397,"pkt_l4_len":363,"pkt":"\/\/\/\/\/\/\/\/AICPmq69CABFAAF\/44MAAEARlesAAAAA\/\/\/\/\/wBEAEMBa5dnAQEGABWCmMYYtQAAAAAAAAAAAAAAAAAAAAAAAACAj5quvQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBPRP\/j5quvQABAAEfyzfOuCfrPQjbUAB0AQE5AgXcPC1kaGNwY2QtNi4xMC4xOkxpbnV4LTQuOS41Ny12Nys6YXJtdjdsOkJDTTI4MzUMDHBpMy5udG9wLm9yZ5EBATcPAXkhAwYMDxocKjM2Ojt3\/w=="}
00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":664,"source":"teams.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1587041680216,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":""}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":665,"source":"teams.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1587041680294,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":1,"l3_proto":"ip4","src_ip":"93.62.150.157","dst_ip":"192.168.1.6","src_port":443,"dst_port":60512,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":665,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":294054,"pkt_caplen":102,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":102,"pkt_l4_len":68,"pkt":"KDc3AG3IEBMx8Tl2CABFAABYCTNAAHEGSuNdPpadwKgBBgG77GBJd2ZkkI5L3oAY\/\/uUpgAAAQEICsJ1bW4wg\/kbFwMDAB8AAAAAAAAABVYf48xkHJTZ\/YMO7dmv4tC6Gofi60hR"}
00407{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":666,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":294170,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGhUbAqAEGXT6WnexgAbuQjkveAAAAAFAEAAAvzgAA"}
01902{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":667,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":294649,"pkt_caplen":1156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1156,"pkt_l4_len":1122,"pkt":"KDc3AG3IEBMx8Tl2CABFAAR2CTRAAHEGRsRdPpadwKgBBgG77GBJd2aIkI5L3oAY\/\/v9PwAAAQEICsJ1bW4wg\/kbFwMDBD0AAAAAAAAABm9iu+t9XgqZR4s0F3BUPHh3OFodjBrwIjhJ5jzUDrtlDVli1SVxk270m+gEbse5EGdXD2tQPqX+uNfx4B7otIIyfqifH2S\/KFxGyKDkumEYrUX2hsTy4AvsIXg77ggsd77nUCYIUkr9Dcu1K8XBBisxPpHT+zWCDZADIu9GEbXV2\/9sowiGe8yrlpVrokOfQ1DpsHmZowwlG7Bi36UFm+L5Z6cwifqjKB8bGHxJp5qTVRJD\/elikR43sBRzkZfcKqYDSp7JYzhK3QKUfc6m5GUQ5dfnLhv5nlfAs74UtmJ5EyjXuAHe9YxanSSvzzG4JMTWGAY5tTjjtYwpZihFAGx52HToq2O+CpcbwPHV1TLQUDbT2yGJc7gM1GLG5aFGzYu4CebCnnBl2NsUqq80dM5DZBgWZFtSy9z2NYnNFnXM\/L50k82dbGP\/hbFfCNFMS6BvXhwvqUQidPN2cRmVwTsWXaFgKlMTAFoatWZ\/LRmGoWBdnNparAnK8NJzgtzGWejWpNSxsXZQ1NSy\/4QwWmZ1aiyH3lAZfsyIjqYBH478mZLwQeLwCsFzK39ybhvc8awbkRiAIoeLHCDrqRPBNhP62oMKfuuybYfQO5cgeLBcoVWj4YmTHvVqXUaiIJM0ecCweYrE28c1bMOuRYrnD6X5H1vOaut8zUARe+SwmWED1FAd9+LaLocuQm5mzrdNkB6aXE4s0lhsnmXfrvdjFstoXCwJT0nh7ITIpoT2HCapxHTDXopSW+f6iqr0aTti5yh8nUUMgZZ++9jn1o3T3lmRclm9+mgQdUUmHkA3dQCgvlVHN9ZAWzkNyqS56Hs+VXyhIUgDoTONh43ut\/yBnqLWJ6HXKcI6qe1ntdtXyoQyjYZpSOnm2uYp+6WFP8eztjtGexEu6hDqMx2fyQv\/mVl0auJxOvVANURsh9C6cu1LRWqw8SukcmJhO9ptW5iUNYclFK0BRMa7HDoqgqFCccb2WkU4sxDCVFF52CIMR33VkffteHiI9\/NgTNgZERM3tobFzsdXrDpRRXLWDage6O7fLzs8m9hERZCv46Exgndu8ho3VvbFCaZyMsnBpC0\/L6igC1xzLSs2ksZSkx5L9Q7VhMaHlPusEBUMQJ5uA6CkdGrw0a3GiTrkSUGJIGKC7WyL+yh36GZcaflqIrfqPpArwHS0O6hsLRU\/2t+Pwt19umaYcC7QuLOwfSwEr1PxrFtzW1mzlNCKarl0LmPBlPWyV5JfN4y4C1aRVZ7yV7\/4iclnIrddqAkiXdgSc+ai4OnXQhk4fgmfh+Ar5gfpmM8U2v\/X345bEZszWOszb+cdvmzW47cwiYheg59HkuZ4TWUwEFRrPkd047noDz+bhfvXLMYNCStN2XWEGpRFtvI8rpdiTmvHc7+aKDQSaaH8jzVNbso1cSOHqJjXtpeD+vrVfOMXgQ=="}
00407{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":668,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":294680,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGhUbAqAEGXT6WnexgAbuQjkveAAAAAFAEAAAvzgAA"}
00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":669,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041680,"pkt_ts_usec":611341,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00145{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":669,"source":"teams.pcap","alias":"nDPId-test","type":38}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":850,"source":"teams.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1587041681218,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":56634,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00456{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":850,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":218709,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"EBMx8Tl2KDc3AG3ICABFAABLUFkAAP8R5\/DAqAEGwKgBAd06ADUANyl9Kf0BAAABAAAAAAAAB2NhcHRpdmUFYXBwbGUDY29tB2VkZ2VrZXkDbmV0AAABAAE="}
00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":850,"source":"teams.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1587041681218,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":56634,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"ConnectivityCheck"},"dns": {"query":"captive.apple.com.edgekey.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00530{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":851,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":248693,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"KDc3AG3IEBMx8Tl2CABFAACAqEJAADkRFdPAqAEBwKgBBgA13ToAbAAAKf2BgAABAAIAAAAAB2NhcHRpdmUFYXBwbGUDY29tB2VkZ2VrZXkDbmV0AAABAAHADAAFAAEAAADSABkFZTcyNzkFZHNjZTkKYWthbWFpZWRnZcAmwDsAAQABAAAAFAAEFzKeWA=="}
00694{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":851,"source":"teams.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1587041681218,"flow_last_seen":1587041681248,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":147,"flow_avg_l4_payload_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":56634,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"ConnectivityCheck"},"dns": {"query":"captive.apple.com.edgekey.net","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.50.158.88"}}
00385{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":853,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":407197,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00148{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":853,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00374{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":864,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":611328,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00145{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":864,"source":"teams.pcap","alias":"nDPId-test","type":38}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":865,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1587041681714,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":865,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":714331,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"EBMx8Tl2KDc3AG3ICABFAABCnaYAAP8RmqzAqAEGwKgBAcdZADUALvSsiC0BAAABAAAAAAAABmV1LWFwaQNhc20Fc2t5cGUDY29tAAABAAE="}
00645{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":865,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1587041681714,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"VoIP"},"dns": {"query":"eu-api.asm.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":866,"source":"teams.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1587041681714,"flow_last_seen":0,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":53,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63106,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":866,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":714835,"pkt_caplen":95,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":95,"pkt_l4_len":61,"pkt":"EBMx8Tl2KDc3AG3ICABFAABRU9EAAP8R5HLAqAEGwKgBAfaCADUAPVgfcugBAAABAAAAAAAAB2V1LXByb2QHYXN5bmNndwV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAE="}
00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":866,"source":"teams.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1587041681714,"flow_last_seen":0,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":53,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63106,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"eu-prod.asyncgw.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00610{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":744695,"pkt_caplen":203,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":203,"pkt_l4_len":169,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC9OkBAADkRg5jAqAEBwKgBBgA19oIAqQAAcuiBgAABAAMAAAAAB2V1LXByb2QHYXN5bmNndwV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAHADAAFAAEAAAvAACoVYXNtLWFwaS1wcm9kLWV1LXRlYW1zDnRyYWZmaWNtYW5hZ2VyA25ldADAQQAFAAEAAAEsABoOd2V1MS1hcGktdGVhbXMIY2xvdWRhcHDAZsB3AAEAAQAAAAoABDRyS0Y="}
00697{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":873,"source":"teams.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681744,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":161,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":107,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63106,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"eu-prod.asyncgw.teams.microsoft.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.75.70"}}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":874,"source":"teams.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1587041681745,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60538,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":745719,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VHAqAEGNHJLRux6AbuCUaOxAAAAALAC\/\/8ErAAAAgQFtAEDAwUBAQgKMISsLQAAAAAEAgAA"}
00584{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":754842,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"KDc3AG3IEBMx8Tl2CABFAACo\/M1AADkRwR\/AqAEBwKgBBgA1x1kAlAAAiC2BgAABAAMAAAAABmV1LWFwaQNhc20Fc2t5cGUDY29tAAABAAHADAAFAAEAAAb4ACQPYXNtLWFwaS1wcm9kLWV1DnRyYWZmaWNtYW5hZ2VyA25ldADAMgAFAAEAAAEsABoOd2V1MS1hcGktc2t5cGUIY2xvdWRhcHDAUcBiAAEAAQAAAAUABDRyS0U="}
00684{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":875,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681754,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":140,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"eu-api.asm.skype.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.75.69"}}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":876,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1587041681755,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":755860,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VLAqAEGNHJLRex7AbtPkLhOAAAAALAC\/\/8ixgAAAgQFtAEDAwUBAQgKMISsNwAAAAAEAgAA"}
00435{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":877,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":772449,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8MUxAAG0Gmwk0cktGwKgBBgG77HoxlVjpglGjsqASIACccwAAAgQFoAEDAwgEAggKVud31zCErC0="}
00423{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":878,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":772560,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux6AbuCUaOyMZVY6oAQEAnbCgAAAQEICjCErEZW53fX"}
00732{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":879,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":772814,"pkt_caplen":292,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":292,"pkt_l4_len":258,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEWAABAAEAG+HvAqAEGNHJLRux6AbuCUaOyMZVY6oAYEAmUUgAAAQEICjCErEZW53fXFgMBAN0BAADZAwO+LJEVwOHGYhKiVcLvt6A9rXWEi+VY68GJ4Pnee\/+sYQAAHLq6zKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACU6uoAAP8BAAEAAAAAKAAmAAAjZXUtcHJvZC5hc3luY2d3LnRlYW1zLm1pY3Jvc29mdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAjq6gAdABcAGAAbAAMCAAL6+gABAA=="}
00757{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":879,"source":"teams.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1587041681745,"flow_last_seen":1587041681772,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":226,"flow_tot_l4_payload_len":226,"flow_avg_l4_payload_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60538,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-prod.asyncgw.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00435{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":880,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786454,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8PqJAAGwGjrQ0cktFwKgBBgG77HsaOOK2T5C4T6ASIABGlgAAAgQFoAEDAwgEAggKVN17aDCErDc="}
00423{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":881,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786551,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex7AbtPkLhPGjjit4AQEAmFKgAAAQEICjCErFNU3Xto"}
00714{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":882,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786764,"pkt_caplen":277,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":277,"pkt_l4_len":243,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEHAABAAEAG+IvAqAEGNHJLRex7AbtPkLhPGjjit4AYEAnBuAAAAQEICjCErFNU3XtoFgMBAM4BAADKAwNa\/jUh9W55wUB0tnlMq1eAEhrPfTr7oU\/DtVhV\/8e2AwAAHNrazKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACFGhoAAP8BAAEAAAAAGQAXAAAUZXUtYXBpLmFzbS5za3lwZS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAgqKgAdABcAGAAbAAMCAAJ6egABAA=="}
00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1587041681755,"flow_last_seen":1587041681786,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":211,"flow_tot_l4_payload_len":211,"flow_avg_l4_payload_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02367{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":891,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802258,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU5AAG0GlW80cktGwKgBBgG77HoxlV6KglGklIAQBAXbeQAAAQEIClbnd\/MwhKxGsYFQCvPTWcgwCwYDVR0PBAQDAgSwMCgGA1UdEQQhMB+CHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQA2X\/om4H+4\/cR81+swhscxS+n0lRF6\/9QaS3UJkZbRbKTCin3OgcYqSG9pYg6G1+1K1UtTBpsolwlA3Wj42xE7Uv4QpgEXC5f0oaTcFK1me59SUtzp5qGDrwX6WjG8Ktb6uYB5gEczE7C4PC+CFPM3paTb5H5cy9SB3sXBctpW9JL3Q4jgLf0RmKI+tU\/yzqXGVuQXEGhEGBnx2gx7c5jv9zuJnDG+h+fy0tJ8oKxrnU3\/YDtE5a8Gc9riCos64k1IwawJ2ex5sg6EIN6aZMm7jlbnY0GaYkT3Xzq9y\/pq48vIUbUNujVUDc5\/R\/SCSk\/dzf6G7\/xO1H5cZnPEC40ThKUvhXFO2qUKIhsUCjzJG5EdSNtcUv8eCyVsfCMB7dRsifQSwSDmGmM4n\/G81i0O9M4b2XZ+YaSEgJZmQx7Uh5AdoOqwYq2SqBhAihGJdwH2XMq283yNTDRqqo\/WVv2tQAJnjORm59j1r8dDWyuUfRzmyA\/balmQRC8\/yMgQswTFwP1y97tt4lyNjydBDOIBJv2TudKgtjqTbU59+fWu1pBkJP0+oPi5U7f32J4ZwXrKLU9tbuRaGYpYaW\/H8\/s8ycG4tlrTfTYH+M+FW9Y1DTTSC08bOYNW3zgFB64XvsPWTwevXfQWad0gfn6zMKIffJ0Woh7B4kndlMdWD8PoFQAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4"}
02367{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":892,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802287,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU1AAG0GlXA0cktGwKgBBgG77HoxlVjqglGklIAQBAUZCwAAAQEIClbnd\/MwhKxGFgMDF2cCAABVAwNemFWRvAfOxj\/O2LS1GvKbLbSBGZz8VXg6KCdxioXd2iDMPAAAuPt+tyjvNYKaxBUbB7raSosgkzWm+0YaVQadbMAwAAANAAUAAAAXAAD\/AQABAAsADooADocACMkwggjFMIIGraADAgECAhMtAAND9wESkm\/sd3ORAAAAA0P3MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xODA2MTIxMTUyNDVaFw0yMDA2MTIxMTUyNDVaMCgxJjAkBgNVBAMMHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9uZE6YVmzh1ro\/4d8Zo+mVIUEDaUviyuYUeJe2UcdHKsHDSUdTQ273GJngjGhgUHAMwvq9w4DIyOUBwcveTFYCZWzVANdRsFsD39nLpXp3vseB5VUXnmXJq29gPKyJFpkrbimMnnEOki7t5nlA9Z2K+wtT1X+Z4mAoJsSkScanGPxLU8tNcdirpZ0\/tvH70adSNM5iFxsRFLblVIdVrqSBeeNgafOdZlIIGOv9P0ABMY7kxYKnw7S8oGlbB3U6ETluGBbgY1c8n6n6\/5011R8Q390xb8uiX78WpVL6NRdD2McwEdmJZUS5ppX\/9INS5YdaB\/lVrmNtlNRMwIco6t6QIDAQABo4IEgjCCBH4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB3AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABY\/PgldcAAAQDAEgwRgIhAK4F5+xyAZ8PgWPavtk6ktZ1Mdq5zCcDAj1dU28RQakyAiEA4DkHuRE6HiTW8RE5rf\/suuvGjdxWguIuLXIbKDGvcIwAdQBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWPz4JSyAAAEAwBGMEQCIEUKuHHg1cOu3ulDL23MIyS7vGphefBcWA43AQQTjyDEAiAwpImJzpyITltxVu+5E9RI6mCB4HmB+34SpNIgXnX3UQB1AG9Tdqwx8DEZ2JkApFEV\/3cVHBHZAsEAKQaNsgiaN9kTAAABY\/Pgk\/MAAAQDAEYwRAIgVkQLEK+aFME4Hb3costoQAwcLpeeMRkWlMpAVlvVKYwCIFBaS7ZLwxVX5ANaQxIs20s7ccOU9sO75sNDOPFjUiVzAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFj8+CXzAAABAMARzBFAiBcPX96Y\/KYUQsVX6QdJU7x5hxNzu6nSgTjsrM4Wi0KDwIhANsnPYmqBlSVUmPKVKXLbePowV4E\/X0udEs\/42bFhpbcMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUC8G3iHj\/iQZjMtUq"}
02380{"flow_id":18,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":893,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802295,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU9AAG0GlW40cktGwKgBBgG77HoxlWQqglGklIAQBAUxzQAAAQEIClbnd\/MwhKxGUEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUyMTU3NDhaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhMtAAND9wESkm\/sd3ORAAAAA0P3gAAYDzIwMjAwNDE1MjE1NzQ4WqARGA8yMDIwMDQxOTIxNTc0OFqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNjIxNTc0OFowDQYJKoZIhvcNAQELBQADggEBAIqBVwyEEXU6DdYDkoqozQrVQ3FRKIupPdre3a2OvDuPW67S6m+tIdeZ+Zw9LPj+fsyi8jf2W8ZWZc4ClcyDblg9\/4QFNtwVQXl\/inU56UYBHMz0qJ+TlvszBwql1\/mJBV01cH5ActofnFMnyNGINyReu+UvHJO6dh1AH4X4rEowHHpl+4s\/zexMBK1xfIDEwT\/2vFdefuv46V0LNIY8NDUYTnWXdDZPMP9v2chYYDkVgXP0Tvyu\/anOPVEkkZ\/uySkMtjbbQW5NAC934A6s58ZNbyf\/qkweMbyXW5vDLaf7E\/7QvopkhMOF\/1Jz"}
02364{"flow_id":18,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":894,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802315,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMVBAAG0GlW00cktGwKgBBgG77HoxlWnKglGklIAQBAXYgAAAAQEIClbnd\/MwhKxGn1Qet5YvmxEJQA2HbHgnngQuAR2gggUjMIIFHzCCBRswggMDoAMCAQICE24AFdNPBmaWWBEkr9EAAAAV008wDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MB4XDTIwMDQwMjE2NTgwOVoXDTIxMDQwMjE2NTgwOVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV81X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vbFFZga\/POcMNPw1dgv2un35hrdvRno\/bBLdqRDnw10YI02qHluRhaXn0ywENQe\/0R\/7DYJrN1STc3KeGjgTy+l0QKHrulfQbrYNkE6IWaW4E0pu4LnDLSoWm4NmJ+4Jov8kiKgf6pnHDWf1P4iU9huFQi30sRZshzPc0q9UCMvba4Jsh7h+BB6JFBjoJAw46Iom9tUbSOL6u1zzr4zGGGXhZP+gDSsQX+uQHIyTZU5KE+bs5h2Q8Hglp1KxjESVB0lCpm1nsPHVCgjumm5i+nCLOz1uTn+qk9tk5fZ98Q2Ztg9fwgQigcia\/D53k4K6OFwfw0PzLYPcAS3dg7JLAgMBAAGjgdYwgdMwHQYDVR0OBBYEFCh3Ac5lnou4VSj4K88j38W8dhpMMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFAj+JZ906ocEwry7jqg4XzPG0WxlMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBl5aandQ99EtkjJSQg4\/erMAO+8kd6xjrcNzbKdJmdXDLCCNx4V\/6T7JABdTiq20PBxVuXxEDFndNHE4r+3H25iZpq+0SbezCH2HkHsMK+Yhd+qwkmVGkr84UZ9x\/j0E0FlcmTLn1\/xh8nj2GyImJZyFyUQLPanTgh6OVjauPMIyeAIxPZukDNgGwleiYBsqxVGXTsthPgIuF0gget36zJN653KOQx8lvfjL6rHF4MK91358sodyvFRqjdlex3vDPeaTURZBVpOj4x3f8QJS8Q7laNeMh7rJwqiayWnB74QW3oyOCK3lM7FncffccA0ji9Pnc9E2jIpmGQThL2IUJnN8JNZ6ewmRmmeUswAEThqo1ABfplT\/NqlsAZL0s9NqIq\/1HLWAwpquytNt2cXnCKfACZWHCprz208rNt8GThXTjIE90MnYOMVMtqdNDcQsaqEqqqZy+uy4eCE7Z31qTUc\/XcTHELT6Lj4auGohTDJbF2OeJQmXKV436KIhooSDqO+tUcVatHc9S0NujxMRpwTIX3pzzFdyM9WdRWuFUj77Z2+rI2kxnwAIkAPD0kQTyBOiinMYeWqObfpp2Vu9pkDXQbGz4H+dDHtrs15bXvHVFWI7ZEYk6TiUdJiTMkvMBfEV34nqJyDHYnMUGJWTuOhvWrrR7OQQwN9pF2c9cVDwwAAUkDABdBBO+QKUiBSZhLWNy3tvXi2wpueoBvu0K+6OxpotGzkdnkxc2+TDc5r8W7tAbxMGYLNDLCthpHASq2UGk93krzBm8EAQEAm9OI1pXuCJ6kOmQN\/sjKRXm5AMNzGOeP"}
00750{"flow_id":18,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":895,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802317,"pkt_caplen":302,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":302,"pkt_l4_len":268,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEgMVFAAG0GmiA0cktGwKgBBgG77HoxlW9qglGklIAYBAWUqQAAAQEIClbnd\/MwhKxG3ueO4RFj+c8GEWZqZ2ovmlySwoou222o9uG3S2GrB1TfiWZLWZVissMZEKj22iCLiOSMDLRfrYOYclJv+d+871WdAeCW3f0oejs+a5PLWILQOxN1oJUmkzygCfKvgb0GTQZa4zf7vuGEH+a9IHNMZPFTq52DrUJ2zRbLbWITFYCD7IgBrczHOWvPH1ug3jIaaD2PdYvFV+\/lwr\/7oOvoj\/NFH9sKjIdd18UnE4QERIUspogHtp2gCNVnFCK6UG1hMOqHExEk\/B8blqIWUhvX\/b7W9\/zleEhQ0+sc8Cv\/Bbrp4V+zCsaDew4AAAA="}
00440{"flow_id":18,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":896,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802360,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VHAqAEGNHJLRux6AbuCUaSUMZVY6rAQEAl+FgAAAQEICjCErGJW53fXAQEFCjGVXooxlWQq"}
00425{"flow_id":18,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":897,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802397,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux6AbuCUaSUMZVkKoAQD6\/PCgAAAQEICjCErGJW53fz"}
00424{"flow_id":18,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":898,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802399,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux6AbuCUaSUMZVvaoAQD1XEJAAAAQEICjCErGJW53fz"}
00424{"flow_id":18,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":899,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802400,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux6AbuCUaSUMZVwVoAQD07DPwAAAQEICjCErGJW53fz"}
00424{"flow_id":18,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":900,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802468,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux6AbuCUaSUMZVwVoAQEADCjQAAAQEICjCErGJW53fz"}
00597{"flow_id":18,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":901,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":803367,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG+N\/AqAEGNHJLRux6AbuCUaSUMZVwVoAYEABuqAAAAQEICjCErGNW53fzFgMDAEYQAABCQQRCHykjycQ+YysDW1nbaTFzY5zguJV1X+39rCv4Go2SaRWNHbEhm5ZXStHmGt0y5fJQP8fyRomQ2T4QmssmKb8zFAMDAAEBFgMDACgAAAAAAAAAAJde95qF1h+K4M0YxerhkxaYKARQZ6\/4jiLUbo+vBbUG"}
02374{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819208,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPqVAAGwGiRk0cktFwKgBBgG77HsaOO33T5C5IoAQBAWJqAAAAQEIClTde4YwhKxTjSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQUqShwURmVA+Jp3zLm2A+QCVyZqYAYDzIwMjAwNDE1MTkzMzA5WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewAE4Lxi6ctlZLvhngAAAATgvIAAGA8yMDIwMDQxNTE5MzMwOVqgERgPMjAyMDA0MTkxOTMzMDlaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTMzMDlaMA0GCSqGSIb3DQEBCwUAA4IBAQBJ3b+j9b9amWJnAoiCkmf2UNIwgNLUYY7i2oIxOcCe4FwtfKqAknYBXLXDmybtzIEQGc9zVWPgZbClw+Dn6abFkbXSG0mhM4QP5D5MQbVxhe7SgYoYVGwkJbmRpd4grc+7uBTiXMgAxBCB5kUsxvRwqLqgwU4Ain2W6hQNvDRMAvojfSg3lYkOFvlf7bcTwOK90BIJGU11EABEc5brrKndHE9hje0klAXbzMZTL8AqrbgnzOZi1rf+0+Wq4RUDesXv6I1AJt7EoKj704jMo9fFhVZPD8osr0ZocAW0OSf5m2CQ\/UMENY99jq5D1K0ZM\/O3ik40uY\/GyUUQa5PIKgTroIIFIzCC"}
02362{"flow_id":19,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":903,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819297,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPqNAAGwGiRs0cktFwKgBBgG77HsaOOK3T5C5IoAQBAUeOAAAAQEIClTde4YwhKxTFgMDF00CAABVAwNemFWRxsczknY4W6\/34saNX6HG\/tkx\/UZ9Np0CsYEaKiDBDAAARXF5Y4o6n8EH5kwHvss0EWdkuluw\/cgdTRfUBcAwAAANAAUAAAAXAAD\/AQABAAsADnAADm0ACK8wggirMIIGk6ADAgECAhN7AATgvGLpy2Vku+GeAAAABOC8MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xOTA1MDcxMjUwMDNaFw0yMTA1MDcxMjUwMDNaMBoxGDAWBgNVBAMMDyouYXNtLnNreXBlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSeVBZeaxVgbEF7BDFpA+N3ExF3ZQK1QrQQqA05Ko2A7Gpby+2Es8MXR3Kj2VRAX9P5YFzjF3SN5faeJJRz+j7An2iOLXkwQNkglDT6\/sjB3LbEb7T\/nzN+yIm+S8blVfyih6JM9Apu\/ik1krtvLJUniVwHJtK2\/rOjpX264mOpTx8SQf7TjiIlSs3HiDphOG0YLn3YYZ8njuADtWKju18sgzmH3TMQYaJ5rR8rrvEPgZCHNBk+XQJFexPiGtcDjF2WCQ1CKqCKZf8hKbpm8Y4TnLNUxuhK2E+6sFA1dP+E8Bm6m26cCfBNV3G7APHf8AN1YKGjnSNcO3xC9CoOmEMCAwEAAaOCBHYwggRyMIIB9wYKKwYBBAHWeQIEAgSCAecEggHjAeEAdwC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWqSYTh5AAAEAwBIMEYCIQCK9TKQMvnjt3bF9IskNoov410+TNUfrflXc+EV+7RCFQIhAOhI+FRSDv5ZevTOA7yjzgGxZ7+Vifwc2fzYuzpyLBBgAHYA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFqkmE4gAAABAMARzBFAiAiHsCLrUDabE9VESRZTt4BikyAq6rNE1j3618pfpVpCAIhALEshKOsZh7n88+DKEMN6Qrti43TvlJOQ0RAjLMbS84WAHcA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFqkmE4gwAABAMASDBGAiEAhlim8PX4pyi\/mpblvrIKUelL3OW87784ne5SOBJO7rUCIQCJx97+HPxXSJjEZtGi1euZMJxoXD7mYyvmnAr9RyA7ngB1AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABapJhOJEAAAQDAEYwRAIgSWpW2jkU6iqzOFfqoMvHGTVxpA4qvulMcPxZZ3C6R34CIBq5beRJMDaP8rIHcokNsjMMe+YTY4GBs5JmQen9SUa+MCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQU3aROfyhw35kc1iGhSMjmHtjM\/20wCwYD"}
00439{"flow_id":19,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":904,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819318,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VLAqAEGNHJLRex7AbtPkLkiGjjit7AQEAk4IQAAAQEICjCErHJU3XtoAQEFCho47fcaOPOX"}
00439{"flow_id":19,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":905,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819322,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VLAqAEGNHJLRex7AbtPkLkiGjjoV7AQD9wykAAAAQEICjCErHJU3XuGAQEFCho47fcaOPOX"}
02370{"flow_id":19,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":906,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819426,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPqRAAGwGiRo0cktFwKgBBgG77HsaOOhXT5C5IoAQBAUY\/wAAAQEIClTde4YwhKxTVR0PBAQDAgSwMBoGA1UdEQQTMBGCDyouYXNtLnNreXBlLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEACIPKEF9HBi2JkkD6ESYlhdNm8iY+gsr0gL6615hSWh4U8l6lWg6SETVfALvWbJjmw+\/RrBNplXGC8hs5V5pMU16UcIqWwWnwj9H89vNvbl1iKlIVOt4RWjn26oXYU89\/6yhyTFsoYJw14ZgatF4o6NskbJ4jd9eFkmtnA2pAjAkeUcTig\/ViNIaBgLHVSmEQ5VHoKbzaQkh9ExsrhRCPHgpPM725R0vC3YhgcdPvZKXA8fzvgpQbP1cw6DeiKQcXr17A51t6NQt7aUakXnzhmYfATzL77\/894cWiz0WcX4A0aa5DLZm140uoZWtRS26ZRq3nRyaM9dauZygIwi5IZv5dUKrmXINvpHM0KDbRNjj6QWrSnFzN0yfjKFx4W875eT04M\/x3qwsQkxjqUFF7C5v85IFT4eLY8IizHhU9Z\/RzToGnPY9l6O5EhWTtQpY\/KujoJzU1eF3iL2FGSCKmW8\/F09oFcAJ\/Mh5O5DKSlLCLAd\/XZQHUj9ZLL6IV9UR8Oljo5vGaqsqaweuAYLRkQfmzbLulFBfco+9oMqG+FmRopdfTBE6kr017ZOPRobJ8Ni+ncsyKb4w+jv5EC5IAzF20\/PMnQyzSIdBd7P3UkRAFoa4fG\/742U4mzEXZ\/hXTg2kehLVXTw011bmeK431GF1WynIKwOa40miKycFxYXgABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/"}
00424{"flow_id":19,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":907,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819461,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex7AbtPkLkiGjjzl4AQD6ZznQAAAQEICjCErHJU3XuG"}
00424{"flow_id":19,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":908,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819509,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex7AbtPkLkiGjjzl4AQEABzQwAAAQEICjCErHJU3XuG"}
02371{"flow_id":19,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":909,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819548,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPqZAAGwGiRg0cktFwKgBBgG77HsaOPOXT5C5IoAQBAUnWAAAAQEIClTde4YwhKxTBR8wggUbMIIDA6ADAgECAhNhABSap66sLDo2qRdOAAAAFJqnMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDA0MDIxNzEzMzNaFw0yMTA0MDIxNzEzMzNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1maDM3NHgdAGgJqybRrmWKqSKKEAYvfdrTYPfOpI9FRrz1yFR14GS0e4UDB2rKDlnKsuo9ERf\/Qqpm4JL8SvL0pujmn6ZoeGzO2t5TqMTECkWob1tiLQA1JYOA8RRLKv\/6QsvJzMX0qMbFHNBo4sgrAXoMuWjZcqWxH4fyrsBZdgc0mwpuoYVkD1vOmNWzPZMimjQN4cSMkWQA18afJyhp3Zot3K0OwDCe+wWTKimBMVYuYulSV22tyMOegkWJc5sufvpl383UKGyEuZphpcLBxNnCardIA\/ZTccdHp9K8sF+mKwepxetf1cMDzSEN\/\/lScMw9vnX9v5H8JjKrjnwIDAQABo4HWMIHTMB0GA1UdDgQWBBSpKHBRGZUD4mnfMubYD5AJXJmpgDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAgtIw1XGBca6Erz1OvszgvoWacr5GZbPwH0ImFUkqlkKLrDGX26dw78f6py5VurHJyseUPcKNiqot0YVSXUymap0K7zktMxei7OfRzxrEOStMFRhf4eEHV\/O7\/AyBR9FkstJwucamtnpDISZxXPW9rr05PkrOTdnlVyrAOCoYfaDnEQ+1xPoitDay0pVcsGYu77BrbIohKzTwrNEliVrRyxHwimvvaHfJEeI73Qw0xrKz5P2CAjjq+NS3oq42ShzO\/ZCeXkJIIQxSItMiM\/KixA61UUs2f5UNuYZUE81ffd5fJNZDPejQ32czGjgspCbvyvnAED5O\/ZqaA7YQYaq3nSRcyP4y0KOHUNeWrapkqf2VGf9QXuHcfDAhUX30IdVSnvu\/CLNrMi1Rc\/CZt9f0sLen3IGaj7ifKeBfINsKUj7Utkgl6EdqdMZrfLLmiG6+Y3\/KPyWJtGfIZM3e6ZY5B2wRzMrYYSNTP1k2g+IB3vv\/TAkkF6yAhm3Pz+d\/Rl+lIDcAaXujGd1t6LMRqDJpYUmLJDdwfzEcDT63DedYHw5CsMOyixyuwnidRlHASQQC1dmeOqRbV0dQxUDR0kmGy1yLAB3YKRexpVCttjSYvsbYbEtKmpQHIQQ8GwjWv4W9qsYbbo7PJWc0DNh7tJ43lVbs0jzQ0ajpeayGRvxpIogMAAFJAwAXQQRy1HRDpUzSvPzuW+AhNe9zOi7LZG4Bvgs8cSK4WHQLcBoNKbQZVZZYRNY2bd8CnR\/oEIDOQ0PEG\/C4ypTDybiOBAEBACbqRuN+yFWjhf6Bep\/8CdKBX5tbd\/fuvLREeC7iExGG4UbHa29HoRfNvZeMSZNCYlMS"}
00712{"flow_id":19,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":910,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819550,"pkt_caplen":276,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":276,"pkt_l4_len":242,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEGPqdAAGwGjeU0cktFwKgBBgG77HsaOPk3T5C5IoAYBAWlfAAAAQEIClTde4YwhKxTMVWY2KoM3UYNmUH53VfnFXQ7Balll6FrwjaWxkYmpJt0YQsGfB6o7My7usVjRo8Gl8LHEn9yDr8ZQjiqXpWCxWD1TPA5JGPQ4rki4qwn2LQnW1Z8jDbbG2rCsSoIsJ13reEorAWYQD9lgY7u6NhKhQivxM+NrK3lC10+ksRahXbaAed8F13P2B6X6pzJCA3sXXJy0ubM3rtfZ\/JuagHOdHC6t5DukWhpcRN\/gb9\/\/aLYdj+03iV+MEje6vELnhdfMDQOZ6uyxdS\/Ox2Q0OUOAAAA"}
00424{"flow_id":19,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":911,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":819590,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex7AbtPkLkiGjj6CYAQD8xtBQAAAQEICjCErHJU3XuG"}
00597{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":912,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":820604,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG+ODAqAEGNHJLRex7AbtPkLkiGjj6CYAYEAAfqAAAAQEICjCErHNU3XuGFgMDAEYQAABCQQSp\/xAWzX3m+GIpNYZNVd0zA6MTBbdTMGVEx0p1jU87SuX7JAy22e1aGg2H\/gasj5M3tBe1eXKbBJ6jddJBRYpYFAMDAAEBFgMDACgAAAAAAAAAADSGNV1DA1tmj+MfNOrWBiBzPkbQyCVjLR4dzDxIj2ac"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":932,"source":"teams.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1587041682076,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60540,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":932,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":76700,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VHAqAEGNHJLRux8AbuMg\/cHAAAAALAC\/\/+l4gAAAgQFtAEDAwUBAQgKMIStbAAAAAAEAgAA"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":933,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1587041682077,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":933,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":77081,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VLAqAEGNHJLRex9AbuFeblcAAAAALAC\/\/\/qlgAAAgQFtAEDAwUBAQgKMIStbQAAAAAEAgAA"}
00435{"flow_id":20,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":934,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":106830,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8XUVAAGwGcBA0cktGwKgBBgG77HwdJJF2jIP3CKASIACM5QAAAgQFoAEDAwgEAggKVscEoDCErWw="}
00424{"flow_id":20,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":935,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":106937,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux8AbuMg\/cIHSSRd4AQEAnLdwAAAQEICjCErYpWxwSg"}
00736{"flow_id":20,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":936,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":107386,"pkt_caplen":296,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":296,"pkt_l4_len":262,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEaAABAAEAG+HfAqAEGNHJLRux8AbuMg\/cIHSSRd4AYEAmCtgAAAQEICjCErYpWxwSgFgMBAOEBAADdAwM8bxQ0whreuqvYvEztjLrW4PBGRpjuL7egzSBD9aU3vgAAHKqqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACYCgoAAP8BAAEAAAAAKAAmAAAjZXUtcHJvZC5hc3luY2d3LnRlYW1zLm1pY3Jvc29mdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAISkoAHQAXABgAGwADAgAC2toAAQA="}
00757{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":936,"source":"teams.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":4,"flow_first_seen":1587041682076,"flow_last_seen":1587041682107,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":230,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":57,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60540,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-prod.asyncgw.teams.microsoft.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00435{"flow_id":21,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":937,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108320,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8CPlAAG0Gw100cktFwKgBBgG77H37toO1hXm5XaASIACQKwAAAgQFoAEDAwgEAggKVQ929DCErW0="}
00423{"flow_id":21,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108400,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebld+7aDtoAQEAnOvQAAAQEICjCErYtVD3b0"}
00715{"flow_id":21,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108566,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"EBMx8Tl2KDc3AG3ICABFAAELAABAAEAG+IfAqAEGNHJLRex9AbuFebld+7aDtoAYEAl5vQAAAQEICjCErYtVD3b0FgMBANIBAADOAwNRm85ZKo2j5rIUIlemfdLsNPrk0mWhHKlhPOh2TLU7CwAAHKqqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACJ6uoAAP8BAAEAAAAAGQAXAAAUZXUtYXBpLmFzbS5za3lwZS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI+voAHQAXABgAGwADAgACmpoAAQA="}
00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":939,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1587041682077,"flow_last_seen":1587041682108,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":215,"flow_tot_l4_payload_len":215,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1587041682129,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00452{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":129643,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"EBMx8Tl2KDc3AG3ICABFAABIVE8AAP8R4\/3AqAEGwKgBAcFqADUANJ5TmvIBAAABAAAAAAAABmNvbmZpZwV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAE="}
00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1587041682129,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"config.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
02366{"flow_id":20,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":955,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139467,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUXUdAAGwGanY0cktGwKgBBgG77HwdJJcXjIP37oAQBAXL3gAAAQEIClbHBMAwhK2KsYFQCvPTWcgwCwYDVR0PBAQDAgSwMCgGA1UdEQQhMB+CHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQA2X\/om4H+4\/cR81+swhscxS+n0lRF6\/9QaS3UJkZbRbKTCin3OgcYqSG9pYg6G1+1K1UtTBpsolwlA3Wj42xE7Uv4QpgEXC5f0oaTcFK1me59SUtzp5qGDrwX6WjG8Ktb6uYB5gEczE7C4PC+CFPM3paTb5H5cy9SB3sXBctpW9JL3Q4jgLf0RmKI+tU\/yzqXGVuQXEGhEGBnx2gx7c5jv9zuJnDG+h+fy0tJ8oKxrnU3\/YDtE5a8Gc9riCos64k1IwawJ2ex5sg6EIN6aZMm7jlbnY0GaYkT3Xzq9y\/pq48vIUbUNujVUDc5\/R\/SCSk\/dzf6G7\/xO1H5cZnPEC40ThKUvhXFO2qUKIhsUCjzJG5EdSNtcUv8eCyVsfCMB7dRsifQSwSDmGmM4n\/G81i0O9M4b2XZ+YaSEgJZmQx7Uh5AdoOqwYq2SqBhAihGJdwH2XMq283yNTDRqqo\/WVv2tQAJnjORm59j1r8dDWyuUfRzmyA\/balmQRC8\/yMgQswTFwP1y97tt4lyNjydBDOIBJv2TudKgtjqTbU59+fWu1pBkJP0+oPi5U7f32J4ZwXrKLU9tbuRaGYpYaW\/H8\/s8ycG4tlrTfTYH+M+FW9Y1DTTSC08bOYNW3zgFB64XvsPWTwevXfQWad0gfn6zMKIffJ0Woh7B4kndlMdWD8PoFQAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4"}
02366{"flow_id":20,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":956,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139500,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUXUZAAGwGanc0cktGwKgBBgG77HwdJJF3jIP37oAQBAXx1AAAAQEIClbHBMAwhK2KFgMDF2cCAABVAwNemFWSaFVRkCOJc9DstYMfC08iAySbs8fPN8bS7IioNyBmSgAABnBrPYmSUv6UMChNwK9m8a4QGJY6Yy\/tWe+U9sAwAAANAAUAAAAXAAD\/AQABAAsADooADocACMkwggjFMIIGraADAgECAhMtAAND9wESkm\/sd3ORAAAAA0P3MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xODA2MTIxMTUyNDVaFw0yMDA2MTIxMTUyNDVaMCgxJjAkBgNVBAMMHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9uZE6YVmzh1ro\/4d8Zo+mVIUEDaUviyuYUeJe2UcdHKsHDSUdTQ273GJngjGhgUHAMwvq9w4DIyOUBwcveTFYCZWzVANdRsFsD39nLpXp3vseB5VUXnmXJq29gPKyJFpkrbimMnnEOki7t5nlA9Z2K+wtT1X+Z4mAoJsSkScanGPxLU8tNcdirpZ0\/tvH70adSNM5iFxsRFLblVIdVrqSBeeNgafOdZlIIGOv9P0ABMY7kxYKnw7S8oGlbB3U6ETluGBbgY1c8n6n6\/5011R8Q390xb8uiX78WpVL6NRdD2McwEdmJZUS5ppX\/9INS5YdaB\/lVrmNtlNRMwIco6t6QIDAQABo4IEgjCCBH4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB3AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABY\/PgldcAAAQDAEgwRgIhAK4F5+xyAZ8PgWPavtk6ktZ1Mdq5zCcDAj1dU28RQakyAiEA4DkHuRE6HiTW8RE5rf\/suuvGjdxWguIuLXIbKDGvcIwAdQBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWPz4JSyAAAEAwBGMEQCIEUKuHHg1cOu3ulDL23MIyS7vGphefBcWA43AQQTjyDEAiAwpImJzpyITltxVu+5E9RI6mCB4HmB+34SpNIgXnX3UQB1AG9Tdqwx8DEZ2JkApFEV\/3cVHBHZAsEAKQaNsgiaN9kTAAABY\/Pgk\/MAAAQDAEYwRAIgVkQLEK+aFME4Hb3costoQAwcLpeeMRkWlMpAVlvVKYwCIFBaS7ZLwxVX5ANaQxIs20s7ccOU9sO75sNDOPFjUiVzAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFj8+CXzAAABAMARzBFAiBcPX96Y\/KYUQsVX6QdJU7x5hxNzu6nSgTjsrM4Wi0KDwIhANsnPYmqBlSVUmPKVKXLbePowV4E\/X0udEs\/42bFhpbcMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUC8G3iHj\/iQZjMtUq"}
00440{"flow_id":20,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":957,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139578,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VHAqAEGNHJLRux8AbuMg\/fuHSSRd7AQEAkmRgAAAQEICjCEradWxwSgAQEFCh0klxcdJJy3"}
00425{"flow_id":20,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":958,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139599,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux8AbuMg\/fuHSSct4AQD6+\/bgAAAQEICjCEradWxwTA"}
02379{"flow_id":20,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":959,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139683,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUXUhAAGwGanU0cktGwKgBBgG77HwdJJy3jIP37oAQBAUiMgAAAQEIClbHBMAwhK2KUEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUyMTU3NDhaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhMtAAND9wESkm\/sd3ORAAAAA0P3gAAYDzIwMjAwNDE1MjE1NzQ4WqARGA8yMDIwMDQxOTIxNTc0OFqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNjIxNTc0OFowDQYJKoZIhvcNAQELBQADggEBAIqBVwyEEXU6DdYDkoqozQrVQ3FRKIupPdre3a2OvDuPW67S6m+tIdeZ+Zw9LPj+fsyi8jf2W8ZWZc4ClcyDblg9\/4QFNtwVQXl\/inU56UYBHMz0qJ+TlvszBwql1\/mJBV01cH5ActofnFMnyNGINyReu+UvHJO6dh1AH4X4rEowHHpl+4s\/zexMBK1xfIDEwT\/2vFdefuv46V0LNIY8NDUYTnWXdDZPMP9v2chYYDkVgXP0Tvyu\/anOPVEkkZ\/uySkMtjbbQW5NAC934A6s58ZNbyf\/qkweMbyXW5vDLaf7E\/7QvopkhMOF\/1Jz"}
00425{"flow_id":20,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":960,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139743,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux8AbuMg\/fuHSSiV4AQEAC5fQAAAQEICjCEradWxwTA"}
02367{"flow_id":20,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":961,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139799,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUXUlAAGwGanQ0cktGwKgBBgG77HwdJKJXjIP37oAQBAXwVAAAAQEIClbHBMAwhK2Kn1Qet5YvmxEJQA2HbHgnngQuAR2gggUjMIIFHzCCBRswggMDoAMCAQICE24AFdNPBmaWWBEkr9EAAAAV008wDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MB4XDTIwMDQwMjE2NTgwOVoXDTIxMDQwMjE2NTgwOVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV81X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vbFFZga\/POcMNPw1dgv2un35hrdvRno\/bBLdqRDnw10YI02qHluRhaXn0ywENQe\/0R\/7DYJrN1STc3KeGjgTy+l0QKHrulfQbrYNkE6IWaW4E0pu4LnDLSoWm4NmJ+4Jov8kiKgf6pnHDWf1P4iU9huFQi30sRZshzPc0q9UCMvba4Jsh7h+BB6JFBjoJAw46Iom9tUbSOL6u1zzr4zGGGXhZP+gDSsQX+uQHIyTZU5KE+bs5h2Q8Hglp1KxjESVB0lCpm1nsPHVCgjumm5i+nCLOz1uTn+qk9tk5fZ98Q2Ztg9fwgQigcia\/D53k4K6OFwfw0PzLYPcAS3dg7JLAgMBAAGjgdYwgdMwHQYDVR0OBBYEFCh3Ac5lnou4VSj4K88j38W8dhpMMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFAj+JZ906ocEwry7jqg4XzPG0WxlMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBl5aandQ99EtkjJSQg4\/erMAO+8kd6xjrcNzbKdJmdXDLCCNx4V\/6T7JABdTiq20PBxVuXxEDFndNHE4r+3H25iZpq+0SbezCH2HkHsMK+Yhd+qwkmVGkr84UZ9x\/j0E0FlcmTLn1\/xh8nj2GyImJZyFyUQLPanTgh6OVjauPMIyeAIxPZukDNgGwleiYBsqxVGXTsthPgIuF0gget36zJN653KOQx8lvfjL6rHF4MK91358sodyvFRqjdlex3vDPeaTURZBVpOj4x3f8QJS8Q7laNeMh7rJwqiayWnB74QW3oyOCK3lM7FncffccA0ji9Pnc9E2jIpmGQThL2IUJnN8JNZ6ewmRmmeUswAEThqo1ABfplT\/NqlsAZL0s9NqIq\/1HLWAwpquytNt2cXnCKfACZWHCprz208rNt8GThXTjIE90MnYOMVMtqdNDcQsaqEqqqZy+uy4eCE7Z31qTUc\/XcTHELT6Lj4auGohTDJbF2OeJQmXKV436KIhooSDqO+tUcVatHc9S0NujxMRpwTIX3pzzFdyM9WdRWuFUj77Z2+rI2kxnwAIkAPD0kQTyBOiinMYeWqObfpp2Vu9pkDXQbGz4H+dDHtrs15bXvHVFWI7ZEYk6TiUdJiTMkvMBfEV34nqJyDHYnMUGJWTuOhvWrrR7OQQwN9pF2c9cVDwwAAUkDABdBBOQRcjPcZLIMalgCPqcm4aTgP67kySd3NEaQbnttIfeIp+OzZ1CvLIzF6+iy4yZ3Zw\/KIlpTsU8e5k93GJqBX4gEAQEA1VJR+fOkVWhl\/LKSHbU\/vuLuYw1IUDl\/"}
00748{"flow_id":20,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":962,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139802,"pkt_caplen":302,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":302,"pkt_l4_len":268,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEgXUpAAGwGbyc0cktGwKgBBgG77HwdJKf3jIP37oAYBAVblQAAAQEIClbHBMAwhK2Kx+ZC58DkeMrfhR7U96as3cw+sR7\/rf1hy1qBiX86TIWnkXBHqXFDz7pngVzlpEKfDIDcxHKBTojp1WBGaQWJLAiFfJwhf3B\/PE6LD69PuXrUgzlBkcoammuQLH69vK84+9UGmMsZln5rc8Rwp+oYxiNVjwfIpJEoh+GmG34JsE7A1Doe5ToKKNBCgCHh94ffgv9OYHIGDMPgBt\/16XdtRNLGA7kMik5t2z0IxwLPd3MLF332WEAxDomet8qVnRSsKGssN\/L\/02gB33jzlYISmgtVsgiQz54vJPAdu9sReLefqOrYou5AMQ4AAAA="}
00425{"flow_id":20,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":963,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":139837,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V3AqAEGNHJLRux8AbuMg\/fuHSSo44AQD8uzJgAAAQEICjCEradWxwTA"}
02359{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":964,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140048,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCPpAAG0GvcQ0cktFwKgBBgG77H37toO2hXm6NIAQBAUeeAAAAQEIClUPdxEwhK2LFgMDF00CAABVAwNemFWQkTKZfyBaLuzO97G0quTrEm7BgPWyftzaEzJa0iBuSwAAwHf6a8yXd\/slaOSfyDbI53lK7p5dSy9A7BIMcMAwAAANAAUAAAAXAAD\/AQABAAsADnAADm0ACK8wggirMIIGk6ADAgECAhN7AATgvGLpy2Vku+GeAAAABOC8MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xOTA1MDcxMjUwMDNaFw0yMTA1MDcxMjUwMDNaMBoxGDAWBgNVBAMMDyouYXNtLnNreXBlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALSeVBZeaxVgbEF7BDFpA+N3ExF3ZQK1QrQQqA05Ko2A7Gpby+2Es8MXR3Kj2VRAX9P5YFzjF3SN5faeJJRz+j7An2iOLXkwQNkglDT6\/sjB3LbEb7T\/nzN+yIm+S8blVfyih6JM9Apu\/ik1krtvLJUniVwHJtK2\/rOjpX264mOpTx8SQf7TjiIlSs3HiDphOG0YLn3YYZ8njuADtWKju18sgzmH3TMQYaJ5rR8rrvEPgZCHNBk+XQJFexPiGtcDjF2WCQ1CKqCKZf8hKbpm8Y4TnLNUxuhK2E+6sFA1dP+E8Bm6m26cCfBNV3G7APHf8AN1YKGjnSNcO3xC9CoOmEMCAwEAAaOCBHYwggRyMIIB9wYKKwYBBAHWeQIEAgSCAecEggHjAeEAdwC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWqSYTh5AAAEAwBIMEYCIQCK9TKQMvnjt3bF9IskNoov410+TNUfrflXc+EV+7RCFQIhAOhI+FRSDv5ZevTOA7yjzgGxZ7+Vifwc2fzYuzpyLBBgAHYA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFqkmE4gAAABAMARzBFAiAiHsCLrUDabE9VESRZTt4BikyAq6rNE1j3618pfpVpCAIhALEshKOsZh7n88+DKEMN6Qrti43TvlJOQ0RAjLMbS84WAHcA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFqkmE4gwAABAMASDBGAiEAhlim8PX4pyi\/mpblvrIKUelL3OW87784ne5SOBJO7rUCIQCJx97+HPxXSJjEZtGi1euZMJxoXD7mYyvmnAr9RyA7ngB1AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABapJhOJEAAAQDAEYwRAIgSWpW2jkU6iqzOFfqoMvHGTVxpA4qvulMcPxZZ3C6R34CIBq5beRJMDaP8rIHcokNsjMMe+YTY4GBs5JmQen9SUa+MCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQU3aROfyhw35kc1iGhSMjmHtjM\/20wCwYD"}
02369{"flow_id":21,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":965,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140170,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCPtAAG0GvcM0cktFwKgBBgG77H37tolWhXm6NIAQBAVijwAAAQEIClUPdxEwhK2LVR0PBAQDAgSwMBoGA1UdEQQTMBGCDyouYXNtLnNreXBlLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEACIPKEF9HBi2JkkD6ESYlhdNm8iY+gsr0gL6615hSWh4U8l6lWg6SETVfALvWbJjmw+\/RrBNplXGC8hs5V5pMU16UcIqWwWnwj9H89vNvbl1iKlIVOt4RWjn26oXYU89\/6yhyTFsoYJw14ZgatF4o6NskbJ4jd9eFkmtnA2pAjAkeUcTig\/ViNIaBgLHVSmEQ5VHoKbzaQkh9ExsrhRCPHgpPM725R0vC3YhgcdPvZKXA8fzvgpQbP1cw6DeiKQcXr17A51t6NQt7aUakXnzhmYfATzL77\/894cWiz0WcX4A0aa5DLZm140uoZWtRS26ZRq3nRyaM9dauZygIwi5IZv5dUKrmXINvpHM0KDbRNjj6QWrSnFzN0yfjKFx4W875eT04M\/x3qwsQkxjqUFF7C5v85IFT4eLY8IizHhU9Z\/RzToGnPY9l6O5EhWTtQpY\/KujoJzU1eF3iL2FGSCKmW8\/F09oFcAJ\/Mh5O5DKSlLCLAd\/XZQHUj9ZLL6IV9UR8Oljo5vGaqsqaweuAYLRkQfmzbLulFBfco+9oMqG+FmRopdfTBE6kr017ZOPRobJ8Ni+ncsyKb4w+jv5EC5IAzF20\/PMnQyzSIdBd7P3UkRAFoa4fG\/742U4mzEXZ\/hXTg2kehLVXTw011bmeK431GF1WynIKwOa40miKycFxYXgABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/"}
00424{"flow_id":21,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":966,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140200,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7aO9oAQD6\/CxwAAAQEICjCEradVD3cR"}
02374{"flow_id":21,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":967,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140679,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCPxAAG0GvcI0cktFwKgBBgG77H37to72hXm6NIAQBAXTOAAAAQEIClUPdxEwhK2LjSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQUqShwURmVA+Jp3zLm2A+QCVyZqYAYDzIwMjAwNDE1MTkzMzA5WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewAE4Lxi6ctlZLvhngAAAATgvIAAGA8yMDIwMDQxNTE5MzMwOVqgERgPMjAyMDA0MTkxOTMzMDlaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTMzMDlaMA0GCSqGSIb3DQEBCwUAA4IBAQBJ3b+j9b9amWJnAoiCkmf2UNIwgNLUYY7i2oIxOcCe4FwtfKqAknYBXLXDmybtzIEQGc9zVWPgZbClw+Dn6abFkbXSG0mhM4QP5D5MQbVxhe7SgYoYVGwkJbmRpd4grc+7uBTiXMgAxBCB5kUsxvRwqLqgwU4Ain2W6hQNvDRMAvojfSg3lYkOFvlf7bcTwOK90BIJGU11EABEc5brrKndHE9hje0klAXbzMZTL8AqrbgnzOZi1rf+0+Wq4RUDesXv6I1AJt7EoKj704jMo9fFhVZPD8osr0ZocAW0OSf5m2CQ\/UMENY99jq5D1K0ZM\/O3ik40uY\/GyUUQa5PIKgTroIIFIzCC"}
02368{"flow_id":21,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":968,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140795,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCP1AAG0GvcE0cktFwKgBBgG77H37tpSWhXm6NIAQBAUnjQAAAQEIClUPdxEwhK2LBR8wggUbMIIDA6ADAgECAhNhABSap66sLDo2qRdOAAAAFJqnMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDA0MDIxNzEzMzNaFw0yMTA0MDIxNzEzMzNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1maDM3NHgdAGgJqybRrmWKqSKKEAYvfdrTYPfOpI9FRrz1yFR14GS0e4UDB2rKDlnKsuo9ERf\/Qqpm4JL8SvL0pujmn6ZoeGzO2t5TqMTECkWob1tiLQA1JYOA8RRLKv\/6QsvJzMX0qMbFHNBo4sgrAXoMuWjZcqWxH4fyrsBZdgc0mwpuoYVkD1vOmNWzPZMimjQN4cSMkWQA18afJyhp3Zot3K0OwDCe+wWTKimBMVYuYulSV22tyMOegkWJc5sufvpl383UKGyEuZphpcLBxNnCardIA\/ZTccdHp9K8sF+mKwepxetf1cMDzSEN\/\/lScMw9vnX9v5H8JjKrjnwIDAQABo4HWMIHTMB0GA1UdDgQWBBSpKHBRGZUD4mnfMubYD5AJXJmpgDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAgtIw1XGBca6Erz1OvszgvoWacr5GZbPwH0ImFUkqlkKLrDGX26dw78f6py5VurHJyseUPcKNiqot0YVSXUymap0K7zktMxei7OfRzxrEOStMFRhf4eEHV\/O7\/AyBR9FkstJwucamtnpDISZxXPW9rr05PkrOTdnlVyrAOCoYfaDnEQ+1xPoitDay0pVcsGYu77BrbIohKzTwrNEliVrRyxHwimvvaHfJEeI73Qw0xrKz5P2CAjjq+NS3oq42ShzO\/ZCeXkJIIQxSItMiM\/KixA61UUs2f5UNuYZUE81ffd5fJNZDPejQ32czGjgspCbvyvnAED5O\/ZqaA7YQYaq3nSRcyP4y0KOHUNeWrapkqf2VGf9QXuHcfDAhUX30IdVSnvu\/CLNrMi1Rc\/CZt9f0sLen3IGaj7ifKeBfINsKUj7Utkgl6EdqdMZrfLLmiG6+Y3\/KPyWJtGfIZM3e6ZY5B2wRzMrYYSNTP1k2g+IB3vv\/TAkkF6yAhm3Pz+d\/Rl+lIDcAaXujGd1t6LMRqDJpYUmLJDdwfzEcDT63DedYHw5CsMOyixyuwnidRlHASQQC1dmeOqRbV0dQxUDR0kmGy1yLAB3YKRexpVCttjSYvsbYbEtKmpQHIQQ8GwjWv4W9qsYbbo7PJWc0DNh7tJ43lVbs0jzQ0ajpeayGRvxpIogMAAFJAwAXQQTQoJYD6g8ebuDYZ3TNfiyX7B1Telgu6tp3m42naMlYmauJOKphc\/89F+xdu1RR0YKKWJ0SE4nRHS0ZUXLkE6DcBAEBAEIZWso7nL8yIcjBEQboGQnS0F50lXsOAmMHksMjMesG+hWHJWLYFLv\/CyhQ509vz1h0"}
00712{"flow_id":21,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":969,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140797,"pkt_caplen":276,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":276,"pkt_l4_len":242,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEGCP5AAG0Gwo40cktFwKgBBgG77H37tpo2hXm6NIAYBAVDcgAAAQEIClUPdxEwhK2LSACSZiy6xhZBqFoHfuVJnWThOmXSvs5HXo3nkFTRLqH\/gFiVBrWHZPaugh5f71QBq9sKelJI+oDa8wSlJ5Wt4j3w9VFG\/sQznUFvp8oJAtwYO5QBk3182KbUZxp5sVVXJuFqmJZO+GuUdjnw1GCNdmlSgjR1DoejFE\/6m13ilnZhP9wECEUStxbPasnxIc6wJ5KLpnMUvRkvrC2VBa49EtHON6Sd\/jJ4oOhG9BR2vDdkKCsdYc9u6\/DazX8JYXbReumcyu1TD8JRN0Vbg2sOAAAA"}
01056{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":969,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":10,"flow_first_seen":1587041682077,"flow_last_seen":1587041682140,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":6185,"flow_avg_l4_payload_len":618,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","server_names":"*.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=*.asm.skype.com","alpn":"h2,http\/1.1","fingerprint":"B9:41:1D:AE:56:09:68:D2:07:D0:69:E1:68:00:08:2B:EF:63:1E:48"}}
00424{"flow_id":21,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":970,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140844,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7aaNoAQD1W34AAAAQEICjCErahVD3cR"}
00424{"flow_id":21,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":971,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140846,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7abCIAQD063FQAAAQEICjCErahVD3cR"}
00598{"flow_id":20,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":972,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":141039,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG+N\/AqAEGNHJLRux8AbuMg\/fuHSSo44AYEABmRwAAAQEICjCErahWxwTAFgMDAEYQAABCQQTQQKZeyPBCj\/p5lAGVLYOFivnXhnGHV0uHxCWHexpxHH2i8efa+9lnmebcwDiKsHG1Pc4CMMYS+KXQfwpjzBJWFAMDAAEBFgMDACgAAAAAAAAAADS8+dm2+8m4Tn34wvGsEBUoapDp6JZWBjkwDD4HPrC3"}
00424{"flow_id":21,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":973,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":141105,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7abCIAQEAC2YwAAAQEICjCErahVD3cR"}
00598{"flow_id":21,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":974,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":142066,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG+ODAqAEGNHJLRex9AbuFebo0+7abCIAYEABRlwAAAQEICjCEralVD3cRFgMDAEYQAABCQQTu+YlTGKNSK0JFZRyqdMcvGNFAs8T2GsnSGKY8NwNTGeyVr\/1AlmGpT90ZYfsLkZwIOBCg3KYKsTl5v4TwCb0eFAMDAAEBFgMDACgAAAAAAAAAALUx48gePS5Fp56cO0sk\/WM80Xs1SkLT\/cUJ6fNFiZHX"}
00612{"flow_id":22,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":975,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":143053,"pkt_caplen":204,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":204,"pkt_l4_len":170,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC+wIdAADkR\/U\/AqAEBwKgBBgA1wWoAqgAAmvKBgAABAAQAAAAABmNvbmZpZwV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAHADAAFAAEAAAs5ACEGY29uZmlnBXRlYW1zDnRyYWZmaWNtYW5hZ2VyA25ldADAOAAFAAEAAAALAB8MY29uZmlnLXRlYW1zBnMtMDAwNQhzLW1zZWRnZcBUwGUABQABAAAAOgACwHLAcgABAAEAAABoAAQ0ccKE"}
00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":975,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1587041682129,"flow_last_seen":1587041682143,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":162,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"config.teams.microsoft.com","num_queries":1,"num_answers":4,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.113.194.132"}}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":976,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1587041682144,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":976,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":144166,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGghTAqAEGNHHChOx+AbuHxTqTAAAAALAC\/\/\/vlgAAAgQFtAEDAwUBAQgKMIStqwAAAAAEAgAA"}
00426{"flow_id":23,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":977,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":156833,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0EIdAAHUGPJk0ccKEwKgBBgG77H5W9rKzh8U6lIAS\/\/\/8MgAAAgQFoAEDAwgBAQQC"}
00407{"flow_id":23,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":978,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":156932,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx+AbuHxTqUVvaytFAQIAAc8gAA"}
00703{"flow_id":23,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":979,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":157086,"pkt_caplen":271,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":271,"pkt_l4_len":237,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEBAABAAEAGgVPAqAEGNHHChOx+AbuHxTqUVvaytFAYIACSqAAAFgMBANQBAADQAwMdYvXtwu11hWCpvITmw2DM6JIDDr9YgJ4rTdtCECjTrgAAHBoazKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACLCgoAAP8BAAEAAAAAHwAdAAAaY29uZmlnLnRlYW1zLm1pY3Jvc29mdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAjKygAdABcAGAAbAAMCAAKKigABAA=="}
00750{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":979,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1587041682144,"flow_last_seen":1587041682157,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":217,"flow_tot_l4_payload_len":217,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"config.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00415{"flow_id":23,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":988,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":169218,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoEIhAAHYGO6Q0ccKEwKgBBgG77H5W9rK0h8U7bVAQBAE4GAAAAAAAAAAA"}
00494{"flow_id":20,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":989,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":170306,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnXUtAAGwGb980cktGwKgBBgG77HwdJKjjjIP4bIAYBARcWAAAAQEIClbHBN8whK2oFAMDAAEBFgMDACgAAAAAAAAAABiDMTg4knHCAbQ9Vx3NJRfj8hBMfqWHYQc8rmnwNJ7o"}
02361{"flow_id":23,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":995,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":171677,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEIlAAHYGNfc0ccKEwKgBBgG77H5W9rK0h8U7bVAQBAEm2AAAFgMDFzgCAABmAwNemFWSwS\/ycRm1UxBWjREjevX7sDJBeLh6akA9m4m\/PyDpOAAAlIe4cbnQLpC9a9FjVSPLc99EZ2Q33v9F0b0mR8AwAAAeAAUAAAAjAAAAEAAFAAMCaDIAFwAA\/wEAAQAAAAAACwAOKgAOJwAIaTCCCGUwggZNoAMCAQICE3sADNbH39scQ60ghXIAAAAM1scwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSAxMB4XDTE5MTIxMTAyMDQyMFoXDTIxMTIxMTAyMDQyMFowJTEjMCEGA1UEAxMaY29uZmlnLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrqDBP+YMdR0HfbHcvrOGB2sCn\/Se0vHU+Fn51AKp2JHU8q5i2kBr5zlcJvgJYNjCo2y4+2JZqwxJfi5S4arAjsU4frBsnH1Y9ISrCHeLbLMZOXbUi9eCuhvh9GAZ7zVELu771b0zQiOGD2Y9JVf2SsqJf7XviEWGn6VwYteMLJs6NpanorDRfbpR7ugP9sS\/xQxXEGBbvBlLWXP9RB2Yrh\/4Xury50kZfNzlbVf8pNAkoFvPOjW9\/1hCbzhAj1p9w4MaVOo5BJuBL0rN2nV9fm3P4uSev4C1LVLOnAJ5ibTb17Nqav3\/7Yow3OKxi4nZQXUxdY2C9LlPG7CFQyTUhAgMBAAGjggQlMIIEITCCAX0GCisGAQQB1nkCBAIEggFtBIIBaQFnAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFu8rxhzAAABAMARzBFAiBmvv5B8\/O3v6EPGguvYI\/P2qGKP7ROqf0ovNi97Nz5BgIhAIZGcMhsK+U63M2eI+bAJ9WKJNG5kOdENaLWEuFCBeRpAHYA7sCV7o1yZA+S48O5G8cSo2lqCXtLahoUOOZHssvtxfkAAAFu8rxi+wAABAMARzBFAiA\/o312sro2ci86205w8nBhXgh51C+CLzKeFUsHGAF44wIhAPlqNmDAztceZS3Xynsbz+gJ8JIAzYCsjwloJWcCVXVuAHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFu8rxi+QAABAMARjBEAiB2eTFMm4i3KkYmP4vs8o+pq42SSpLb45iau7FX5j5KsgIgVy5yt1KRup4Xn1x551kicrPWi6kJvL9BWjFWvibdgnUwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBS7S\/DhGe87NYr7Xh2ON096b9XMvTALBgNVHQ8EBAMCBLAwQwYDVR0RBDwwOoIcKi5jb25maWcudGVhbXMubWljcm9zb2Z0LmNvbYIaY29uZmlnLnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0"}
02367{"flow_id":23,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":996,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":171928,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEIpAAHYGNfY0ccKEwKgBBgG77H5W9rhgh8U7bVAQBAE1EQAAcDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAG1TRUu99sGEL6ZKd0w7t41uXw6jE0pCNodrzIEuirENUJwgWtI\/is9UF0WCpEaLq1VnrmgwPmV\/H4WB8vphVSiH\/d1Mt4gC2wehM3gs4QS4K9Fl2Pip3xTHOA2k4b+qzSwGrRZ4LWtYwDqHZBsqqtXgBPOrPjO\/ouOtpIQsORq0nzrLkHaM\/n4tXeCKsbeQ\/nn6O7S\/YwrNpO6gXw80eSaareEDuY0IGWO7QvkH3OSELPjiqsrrne4uZ4SvbgYVPva9T4LTsbUWHkUEio1C5nCmr1od+i5quwZ7ypWlssYzKi1RRJbfPwG6\/vUz3y3t7wQ66gWMyIbRUPMO1FtlHnw+X4HAKrVUTxUi1B1ahwMdgol51yIAfbmSHZS1IefzHuAIbih88eO4JWz7hYX+s4M3r3aL9u27RweOXRvH5VSoI\/nVOcQ521\/o+Ksrfs6E48cBFHX1wkjUmNKybEZPP83hchPxEq0UxDJRjf4M1utegeNooWi0WJD6A2L0GHZhoC93yClNeAL395oJyz1yHwKBedCU1uK1bXGJEwCUGAItjrNNI5Xx1XePtA758wDbmNVjGxUqaJLg+gI2CqlrgHamYJsgLFzA5V6bO1LTYt\/\/RaxSes1wEO5GkApJCs3E5MkWMuIqFF3Nc2K0u64RTHw5zpR51BctXQqA2EQpmoBvAAW4MIIFtDCCBJygAwIBAgIQCLh6UBu+nNotFk0+OVG\/VTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTE2MDUyMDEyNTEyOFoXDTI0MDUyMDEyNTEyOFowgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSAxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjvPxhHV3vL7JpPUWpVMrUGCZ3Nh92SS14XJJN0j+2oaTo30dmksQTXd5fmWpfG424kfUNknQzCQCJxTirnHN2Vd0PBBWGZJKh2L545CNXt7RQRsaph9AoiwejlXXJthoQqvsDd7dXmGVs6xsgc6o4K2vX8qm5FFoLif9VCpxpMy7fpLx9lNRBTHQGYKwymPQ8koAC830aUv0WpZWOSbJnUsKYzQygKUE5eoot8EAwG0a8CjUSo+ArHMZ2PUWL62uCJdiBiz+56XwrUFTf40rMcMUcyHd43hjnFGGtaJIScB5CBVDACuZuEvgx1cHbMS5plQtAVPyo\/KkzNnBVPOIzeRME9OKMyFYrRi\/vjmBcDlpN\/hbpGPvCQff"}
00407{"flow_id":23,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":997,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":171965,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx+AbuHxTttVva+DFAQH9IQ7wAA"}
02371{"flow_id":23,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":998,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":172430,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEItAAHYGNfU0ccKEwKgBBgG77H5W9r4Mh8U7bVAQBAH+RwAAhxpix5oIxdEdXmJ2Ad1p5ji7RLAtTTrGLoDgYHJb8szmjlw6IR5dsDkrveoTy5bLtmp0jI68DhCfG6VAQY+RXHanDvGqOoe3DHffcWovKGFCLZAPcgWrZ+DBe8ucQJrECghEjHw9uqkOHrHZIr0fX0Fqc1T2ZuKg+aY53tJ382kEv7e7PMST\/3IEHLU2nWh\/3\/o5T7L2j7kc\/63tDhUI44Z88khJd5cW9v0A9k+mXm\/nOcBRZT3rsZcw7Oqec\/weLKDfi89zX7UOBkIXJpXs2Kkn0NBllFziP8ooKaUg9MjdXbT\/5t0CAwEAAaOCAUIwggE+MB0GA1UdDgQWBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTAfBgNVHSMEGDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9PbW5pcm9vdDIwMjUuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAwmsadav3vkwgMvoJ3+XagbZ57MCN7qCla9Go+xwsMlt+4S1LkDZw47XhjtXPAHB874Kf\/f0lRlTK40Jup5c+WA4GA1UphGP7Easbff0FGIpyAZusPQqDk86Qho5jQenT2jOjD0iuqK84RWRlE51wHCULr1\/0VTblvbEQ1Joe6oztosIHnIMl\/EwLzzKufHJVQy65kgLuHCl3OpmuyfeM9NuIpUbcl\/NAJ47CtxGIuPn6FJrL2r\/dtMXPGGZipcpMCzsoLPTzs2XDogPUWq3hqh03GgTeoCnaBBqjvF2B8cBATPDjXM0zkN2UI+5Gz6BZ2YSpl9ViUs0UB78BPA3u4FgAHKwEABycwggcjCgEAoIIHHDCCBxgGCSsGAQUFBzABAQSCBwkwggcFMIHHohYEFPZCJyBUiJQZxe5ZDOM2ZtthRVswGA8yMDIwMDQxMzAzMTgyMlowgZswgZgwTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7\/hIjo5oX\/+n0CE3sADNbH39scQ60ghXIAAAAM1seAABgPMjAyMDA0MTMwMzE4MjJaoBEYDzIwMjAwNDE3MDMxODIyWqEiMCAwHgYJKwYBBQUHMAEGBBEYDzIwMTkwNDE0MDMxODIyWjANBgkqhkiG9w0BAQsFAAOCAQEAmQJ6SLm2zVRCwA2vj1iMtXpqFXbwq03+16DkzBYPkd1vJbCD2pK63BUefOP4K7H2MNhfhC9UdrdBqw1hn\/aiAEhRS8H6Uri0oK3BLddQh3Lar\/6za+aM1CIzUMhSO7cZaTzOWbrVqzRvDOHteUSC9izGmLPGOf\/rp1+Ih91m3oXenUwvGJXvzfRSCPcKMrC83N2dGsIwPtSWj64Vs1aDYQ8cKgW6GnG3F+r2W1I1E+3jEO4hx\/9M+TFBKwLQZe2XfQPbHwFNPRD1elltKGsu7cZ16xLxRoZNCw5lforDP15ZG7F8uxAeG4h3nPMxrpNqeTdwrgswsVKIbGKoRCV+EaCCBSMwggUfMIIFGzCCAwOgAwIBAgITYQAStb1WyXtb2s8yhQAAABK1vTANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x"}
00408{"flow_id":23,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":999,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":172494,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx+AbuHxTttVvbDuFAQIAALFQAA"}
02377{"flow_id":23,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1000,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":172680,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEIxAAHYGNfQ0ccKEwKgBBgG77H5W9sO4h8U7bVAQBAHB7AAAEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwHhcNMjAwMzE1MTU0MTIzWhcNMjEwMzE1MTU0MTIzWjArMSkwJwYDVQQDDCBNaWNyb3NvZnRfSVRfVExTX0NBXzFfS2V5QmluZGluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJvT7p2jRZ8\/dmjvHeLh\/yQq3j\/VLXZx+gb9\/gYzTJ1NuB\/fNr+MLJRZzh0ZHkoTOnU7rdrucl91EiuE5B7nZnaSgipbpqErKWG7ldt1BJoxJbVw3c0jWJs70AznmaPQ8k7ZtFvTnBMQ0WnBynR1EgwoKd4nRGzCwl4KDD3XL3IqlH0ccYaShIcyuhkaDQJlSNPBzOoy8PtNqzGG7skD5yyX2jyJunr5KAlOqPUTkQJ4NPWskLkpO9m9cxKSSjrxWittzJ58MG+I4PdxkAxykg0Xy9AXb71oEqTLr+VNh33xYFcQptcCkJevVo9+ql0C2dvsMb9LMJRuZ7hgAUOpntcCAwEAAaOB1jCB0zAdBgNVHQ4EFgQU9kInIFSIlBnF7lkM4zZm22FFWzAwDgYDVR0PAQH\/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GCSsGAQUFBzABBQQCBQAwHwYDVR0jBBgwFoAUWIif1tycSCK3FD7\/hIjo5oX\/+n0wPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYHMm0eByOkWAgFkAgEHMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAGY5nYacL1MJ3uGLUYkLN3TiyuW2utxsRuA4aiy3HDugPxruQtVgJYjFRC\/JWgJmU+a44O62VOtwA5VOouXajEfXeuRrvz\/bG8g2I3r0wfI+FVPM1dXuOYJktX508R\/y9eIqqjN\/gVpqa3sQ8lAlrF0Scae9MtjdmFWTqrmqmRSME+M6a2\/DAbo3T+4hZJPLKDqX\/5eVPprHv1utxtcK4mv2gh3hCllXuRdr9tTWiL31IE\/cErb1MoVZP+lgwRcqQq3vHNOaOswdpAN2\/HhnhOerhptulS9eDFhMUTcJ53lU8rAEspJSc7UyYyiCYgme1LJXW0VEnSFWcgfq7FLhcRLNsnz\/vHrlaHipB\/RRIfH01X6hr96Wn7qbjdLv\/3SzeLKGtOgzb0w1EFpEUWzunpeelOLr3bHN8gWDlKQhH2XZpQlLonrIkxk2So4Oj3pfROmjNZTylKBRIDkQkqdLfcc6bB2oYkKLNiwspvT4uWwL1ky3k+uTc8A2CVnfcZHD0h2qjWl8a3xJpw4R6hRBwNB+X2UrJV2u3\/w3id5wcWfh+DNrPllmdRV8pkGlTYhcHM+tXYdp4veYHXwHYQOdZ0ICSl3IAr1tLMfADF\/u+pZl0U8QnUQdzVEvWZPqZQh8nWy8Ibenx7gHCRYw3EE7jAZvuJvTV3zqCtmgjQBH+5dSDAABaQMAGGEEz3wa8tsiAGQNgfEDLC55klPgDaYrll6Qs4MTgcXRKg\/NeX+pzx54x5hc8v5BTxmoungSR9bm3O0Bp1\/mx35oydSZaptgcdryC8LE9DYpwi+Z315UmzumUWKLLtvDAm0ABAEBAHgISIkHZEujTNP8snwiZoNWGux1b6isjgFFT\/fx2TcRh2KJ6W5kLyV2rnBxCLOKTZdQVMTPihpHeJ\/Rwb9oe4Tv6aBiBhKD5qSanU6OrqInUEfx9hYzxb\/7obzmYCd4ZP0RS3DXyRsxZIgaICgfyYWmG5QDty6n"}
00607{"flow_id":23,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1001,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":172683,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC1EI1AAHYGOxI0ccKEwKgBBgG77H5W9slkh8U7bVAYBAGByQAARJ\/yE86JRqyM\/N5553Gxm\/tllzSdO7xOJP0J9nAsnsIKjxRrloiZfD\/gVUiytWDypyc1x1dhVdcBqiu3UV2YKRrCSS\/a\/94RdsP82tnVqmB1\/xpZ2DxRn50uF4WXCWXA1mrBNkPQ6ts6V5QARJcy187mhiMPKQ0b2stKhCxgkuaAuRryjZ2Y2ecOAAAA"}
01113{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1001,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":12,"flow_first_seen":1587041682144,"flow_last_seen":1587041682172,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6166,"flow_avg_l4_payload_len":513,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"config.teams.microsoft.com","server_names":"*.config.teams.microsoft.com,config.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"0f14538e1c9070becdad7739c67d6363","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=config.teams.microsoft.com","alpn":"h2,http\/1.1","fingerprint":"B9:54:54:12:C9:E9:43:65:10:70:04:7B:AD:B6:0C:46:06:38:A5:FA"}}
00496{"flow_id":21,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1002,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":172684,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnCP9AAG0Gwyw0cktFwKgBBgG77H37tpsIhXm6soAYBARGpgAAAQEIClUPdzMwhK2pFAMDAAEBFgMDACgAAAAAAAAAABckn\/Z2BLcr4a9ceayiTzolfHTKPZZ30ZSgslqMDJUa"}
00409{"flow_id":23,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1008,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":173311,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOx+AbuHxTttVvbJ8VAQH84FDgAA"}
00629{"flow_id":23,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1013,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":178165,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAGgY7AqAEGNHHChOx+AbuHxTttVvbJ8VAYIADQxgAAFgMDAGYQAABiYQRb26wex+ywDP+17p1b9MI22rzxhTPvUAH4uj3R1aCijUUOjCC+t\/YZ8iSpz+BifjGFDzVQ\/fMi4GUMlJTc56I5Ph1ZLk8h2BEOPmGvuaTEz75B\/TOM+hHsiHbHUs\/qYT4UAwMAAQEWAwMAKAAAAAAAAAAADEnD5bI3ciySL1\/QLlDFlnmnam5ZLkjmEkwMLApSrUo="}
00417{"flow_id":23,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1017,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":189817,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoEI5AAHYGO540ccKEwKgBBgG77H5W9snxh8U8C1AQBAEgPQAAAAAAAAAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1071,"source":"teams.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1587041682355,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00460{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1071,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":355684,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"EBMx8Tl2KDc3AG3ICABFAABPcIEAAP8Rx8TAqAEGwKgBAf9rADUAOydaEDoBAAABAAAAAAAADm5vcnRoZXVyb3BlY25zDnRyYWZmaWNtYW5hZ2VyA25ldAAAAQAB"}
00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1071,"source":"teams.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1587041682355,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65387,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"northeuropecns.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1102,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1102,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":369801,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIex\/Abv2sXoGAAAAALAC\/\/+1wwAAAgQFtAEDAwUBAQgKMISugAAAAAAEAgAA"}
00568{"flow_id":24,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1107,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":370931,"pkt_caplen":171,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":171,"pkt_l4_len":137,"pkt":"KDc3AG3IEBMx8Tl2CABFAACdUKtAADkRbU3AqAEBwKgBBgA1\/2sAiQAAEDqBgAABAAIAAAAADm5vcnRoZXVyb3BlY25zDnRyYWZmaWNtYW5hZ2VyA25ldAAAAQABwAwABQABAAAA5AAyEW5vcnRoZXVyb3BlY25zLTMyC25vcnRoZXVyb3BlCGNsb3VkYXBwBWF6dXJlA2NvbQDAPwABAAEAAAAEAAQ0ckww"}
00689{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1107,"source":"teams.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1587041682355,"flow_last_seen":1587041682370,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":129,"flow_tot_l4_payload_len":180,"flow_avg_l4_payload_len":90,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65387,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"northeuropecns.trafficmanager.net","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.76.48"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1124,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1124,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":376166,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+GfAqAEGNHJMMOyAAbuusi7sAAAAALAC\/\/9JyAAAAgQFtAEDAwUBAQgKMISuhQAAAAAEAgAA"}
00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1587041680216,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}}
00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}}
00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1587041682420,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.77.33","dst_ip":"192.168.1.6","src_port":443,"dst_port":60543,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":420333,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8cKZAAGwGWtQ0ck0hwKgBBgG77H8VHmMl9rF6B6ASIAAZOgAAAgQFoAEDAwgEAggKYQa0RDCEroA="}
00425{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1154,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":420448,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex\/Abv2sXoHFR5jJoAQEAlXvgAAAQEICjCErqxhBrRE"}
00707{"flow_id":27,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1155,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":420739,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIex\/Abv2sXoHFR5jJoAYEAmOxwAAAQEICjCErqxhBrREFgMBAMkBAADFAwMlzpQNXKnJso0lmbQsWQ9QP0JUtMkYTF2ySEjqwct4CiA\/IwAA6KEdJo41XGChq4nIXjJi3Ldaf94\/c7z6UnyyFQAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1155,"source":"teams.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":3,"flow_first_seen":1587041682420,"flow_last_seen":1587041682420,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.77.33","dst_ip":"192.168.1.6","src_port":443,"dst_port":60543,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1156,"source":"teams.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1587041682423,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.76.48","dst_ip":"192.168.1.6","src_port":443,"dst_port":60544,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1156,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":423316,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0HMFAAGwGr7I0ckwwwKgBBgG77ICUvjjErrIu7YAS\/\/+TZQAAAgQFoAEDAwgBAQQC"}
00409{"flow_id":28,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1157,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":423394,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG+H\/AqAEGNHJMMOyAAbuusi7tlL44xVAQIAC0JAAA"}
00729{"flow_id":28,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1158,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":423900,"pkt_caplen":290,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":290,"pkt_l4_len":256,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEUAABAAEAG95PAqAEGNHJMMOyAAbuusi7tlL44xVAYIABbPwAAFgMBAOcBAADjAwOLjruZZJmwp+AQ5ixl8mdC3oKgE\/9DUAxdN3dPhROtcwAAHCoqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACe+voAAP8BAAEAAAAAMgAwAAAtbm9ydGhldXJvcGUubm90aWZpY2F0aW9ucy50ZWFtcy5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAAEgAAABAADgAMAmgyCGh0dHAvMS4xAAsAAgEAAAoACgAIysoAHQAXABgAGwADAgACWloAAQA="}
00768{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1158,"source":"teams.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":3,"flow_first_seen":1587041682423,"flow_last_seen":1587041682423,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":236,"flow_tot_l4_payload_len":236,"flow_avg_l4_payload_len":78,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.76.48","dst_ip":"192.168.1.6","src_port":443,"dst_port":60544,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"northeurope.notifications.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00781{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1159,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":440956,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzES9AAEARZ+LAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAHT\/ICoAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
02368{"flow_id":28,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1160,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467714,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHMNAAGwGqhA0ckwwwKgBBgG77ICUvj5xrrIv2VAQCAS9XwAAx23sJOl22cozxfimMAsGA1UdDwQEAwIEsDBJBgNVHREEQjBAgiMqLm5vdGlmaWNhdGlvbnMudGVhbXMubWljcm9zb2Z0LmNvbYIZKi5ub3RpZmljYXRpb25zLnNreXBlLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAaMoTg\/CrkXvH3jnb1h9ibtDE5NT9WRyEmtWPdlMgqhbXA+eyQkb6BYaT\/ta0E\/bOL5hM07pSBrD5uauHzlX4vs6BmFI3X35rS4lnHgq3cUKdaq3M5dfcGtIoKERK4KHEXYdDhAF8RY9DfZJta8j9hj4NqjvMcG7hzkZJWkwVjeh7J49fLI2k+ojmtb1lfRr9wT7N317pl9QMlUj3HrapDo2fvCe\/9jktj3lbttPHLsuaLesAF3dE1wm5y4UOzoiawZGA4Fu5fMnwFxWfpzZRwMq0O\/xKMAg5RkinWwDyzGDnwCbl\/c52s299ZBhbtM6yURpSqq0aQFxtyQoGGDw\/qhMEVa25dds5d0iBdM6KFgBsOhenjJcJxMzPvvOPmkJltWXhqnxSJWsJkaqh7zSNoA5U1JZzOXFYRt3uw3OVIBSfQ21T75pEiBJReA5mMtRoJjyJYo4d7ViJlpWq6D+qmTq9MD3A+u3+2YaocGXunqdlchKzuckM3C3Mck\/119eusSb9+YO\/2kHgBIQsNEyRtMbVXs6aJDUwnxYYIGRAPR16yCXImFMfJYah5q6a0OgPBMYG1cJ5tHN0+DQkL0jj0N6DmBrUSDSDele8PSh59PdIzO8wgJ\/BtAAk1rmVDiVhBV4spP7GSKWzbAS3cC\/0tn2xGj\/VdVxgHiGox4WbcNAABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/Ra"}
02360{"flow_id":28,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1161,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467743,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHMJAAGwGqhE0ckwwwKgBBgG77ICUvjjFrrIv2VAQCARrYQAAFgMDF7gCAABeAwNemFWSM6lG7UcIyFTu+ZAqpmou+1b9cSMUroQIXKhIYCB8QwAA2ApmCUiPkE7sFwGKZX+v4TYcZTXmXturaOIeDMAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsADrIADq8ACPEwggjtMIIG1aADAgECAhN7AAGtxR5ngEfSKjQjAAAAAa3FMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xODA1MTQyMjQzMDlaFw0yMDA1MTQyMjQzMDlaMC4xLDAqBgNVBAMMIyoubm90aWZpY2F0aW9ucy50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhBGUsVZpQSij1FrZ7UA10MFYiBlB5qoAYVuQvi8fG6euixViIn3J51NZJYhGR9o9SjpExVF2F2DFovz9yE2Ia\/Js6elboqU3tszl2KyanJJeYoaK16pdijTSVQFhN4OdbERR3KA2WROPO8wQk5QxhwLnXHsi9CWFTyGcRk+vPFwlw5KqW\/M10uCMZmhSG7qvFaAxU3WMhxRZoulvHCtLsLixgdLwHdgneRl6nZt63WXT6bo3+kmkw\/xmDwfJ7D6TraPEOZ2o0yk5oxtTbOwZJn7SB0bf3p9QQt1xurYAgml4fxfJApv2JqBVXOI\/jmUvTQYhdO3HrtSogk83Ok1TQIDAQABo4IEpDCCBKAwggH2BgorBgEEAdZ5AgQCBIIB5gSCAeIB4AB2ALvZ37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABY2DbozwAAAQDAEcwRQIhAL7yA+kvf6VyrXY9vRgMDH0C7\/Io8PJ\/yV1QUmCPOwVMAiBP29xDfTKiXeL\/1YyqeVregr5YN5oWtRBikBVJd3jVKwB3ALIeBcyLos2KIE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABY2Dbo1MAAAQDAEgwRgIhAN0fi4bS99twLR1xFEbYoEf1bxKtPOSefKqtncETvlpWAiEA6RdOI\/5bz9mmM0V4jVAIKSzQNqshYo8T7WxtiLn0NBEAdgDd6x0reg1PpiCLga2BaHB+Lo6dAdVciI09EcTNtuy+zAAAAWNg26TrAAAEAwBHMEUCIDw9PjnuwJTBQuMPh48Xf9EW3r7JbJn71l0K1\/daUahFAiEAgGQAyryExjVwDZyDMNzwvajRi+xQMrmc2fF++zZqi7sAdQBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkGjbIImjfZEwAAAWNg26eaAAAEAwBGMEQCICcGgSBGxMNucL7euSSv6ARrwjTQ8vyMwA5w1wb5qCDvAiBmX3aytg2JYDJ3fuGlFzcm5ghqLXlUCo2l8o4CFVrFOjAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYEFIpXMi3QH62h"}
00425{"flow_id":28,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1162,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467813,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+HPAqAEGNHJMMOyAAbuusi\/ZlL44xYAQIADRFQAAAQEFCpS+PnGUvkQd"}
00410{"flow_id":28,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1163,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467829,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG+H\/AqAEGNHJMMOyAAbuusi\/ZlL5EHVAQH6WoOwAA"}
00410{"flow_id":28,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1164,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467875,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG+H\/AqAEGNHJMMOyAAbuusi\/ZlL5EHVAQIACn4AAA"}
02381{"flow_id":28,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1165,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":467929,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHMRAAGwGqg80ckwwwKgBBgG77ICUvkQdrrIv2VAQCAQruwAAllY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQU9kInIFSIlBnF7lkM4zZm22FFWzAYDzIwMjAwNDEzMTkyOTI4WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewABrcUeZ4BH0io0IwAAAAGtxYAAGA8yMDIwMDQxMzE5MjkyOFqgERgPMjAyMDA0MTcxOTI5MjhaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTQxOTI5MjhaMA0GCSqGSIb3DQEBCwUAA4IBAQAmz9ZvF3CIuw\/+oTN5NSzh+y5sIp+g5+Kodu0tkCZ1\/Fizx3wZwruEMYfwQFufGhQNWp8YYem\/8VFzY64Oxcb1PCmvzlydMq58lQhFy86lBpGufLM9p9r76iKaMMLhpWx4lBYPJNyQFcE+1ih8h0qTk7V4YjRx\/Kzou\/Pd15cMjwgwrpB7hibf5VjTJU5vJto8XFqgBjId2\/kwp\/N7SQYRpWDGiX\/rMxToJmduH978sRpintcRGeQzHuCepzF4phR9iQf7M6cbAS+fsAX5i+ZeJnpudQZSDnN92pR51awK"}
02366{"flow_id":28,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1166,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":468053,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHMVAAGwGqg40ckwwwKgBBgG77ICUvknJrrIv2VAQCATJWAAAn8ExSaOymFEybtqWEmFRwQUO8L3SCEL+ZMG8LT8PGXDPoIIFIzCCBR8wggUbMIIDA6ADAgECAhNhABK1vVbJe1vazzKFAAAAErW9MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDAzMTUxNTQxMjNaFw0yMTAzMTUxNTQxMjNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm9PunaNFnz92aO8d4uH\/JCreP9UtdnH6Bv3+BjNMnU24H982v4wslFnOHRkeShM6dTut2u5yX3USK4TkHudmdpKCKlumoSspYbuV23UEmjEltXDdzSNYmzvQDOeZo9DyTtm0W9OcExDRacHKdHUSDCgp3idEbMLCXgoMPdcvciqUfRxxhpKEhzK6GRoNAmVI08HM6jLw+02rMYbuyQPnLJfaPIm6evkoCU6o9RORAng09ayQuSk72b1zEpJKOvFaK23Mnnwwb4jg93GQDHKSDRfL0BdvvWgSpMuv5U2HffFgVxCm1wKQl69Wj36qXQLZ2+wxv0swlG5nuGABQ6me1wIDAQABo4HWMIHTMB0GA1UdDgQWBBT2QicgVIiUGcXuWQzjNmbbYUVbMDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZjmdhpwvUwne4YtRiQs3dOLK5ba63GxG4DhqLLccO6A\/Gu5C1WAliMVEL8laAmZT5rjg7rZU63ADlU6i5dqMR9d65Gu\/P9sbyDYjevTB8j4VU8zV1e45gmS1fnTxH\/L14iqqM3+BWmprexDyUCWsXRJxp70y2N2YVZOquaqZFIwT4zprb8MBujdP7iFkk8soOpf\/l5U+mse\/W63G1wria\/aCHeEKWVe5F2v21NaIvfUgT9wStvUyhVk\/6WDBFypCre8c05o6zB2kA3b8eGeE56uGm26VL14MWExRNwnneVTysASyklJztTJjKIJiCZ7UsldbRUSdIVZyB+rsUuFxEs2yfP+8euVoeKkH9FEh8fTVfqGv3pafupuN0u\/\/dLN4soa06DNvTDUQWkRRbO6el56U4uvdsc3yBYOUpCEfZdmlCUuiesiTGTZKjg6Pel9E6aM1lPKUoFEgORCSp0t9xzpsHahiQos2LCym9Pi5bAvWTLeT65NzwDYJWd9xkcPSHaqNaXxrfEmnDhHqFEHA0H5fZSslXa7f\/DeJ3nBxZ+H4M2s+WWZ1FXymQaVNiFwcz61dh2ni95gdfAdhA51nQgJKXcgCvW0sx8AMX+76lmXRTxCdRB3NUS9Zk+plCHydbLwht6fHuAcJFjDcQTuMBm+4m9NXfOoK2aCNAEf7l1IMAAFpAwAYYQRwTmaIddjJM5+xyjTotSur9rpyRXMDrEXdXsKrSKTLUpFySo3jAnVTqsYHzcEPE3ccmMEO69SKrqejxqr6DTlqJEH3DC\/efe4pultp6D2eoDruPIPLr4MM\/voQ"}
00779{"flow_id":28,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1167,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":468055,"pkt_caplen":323,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":323,"pkt_l4_len":289,"pkt":"KDc3AG3IEBMx8Tl2CABFAAE1HMZAAGwGrqw0ckwwwKgBBgG77ICUvk91rrIv2VAYCASqlQAAlHY0M7sEAQEAG+Wv\/A8XDfKVCa5q38wMMmGRqM0DGXbOCv+pOYZNP0Csd4WnCZ5Hr4PhlQBnSommCohBf1FaXmcYdjw1bNCz6ewtqZUBo20KTT6jEffQMwyJAJZ2iCcrwEnUfRZ6KNFmygANoAR5JuySrXa0RCvvNUU2YBbSCIrDzUWWaOGt\/R2T+3sky0mSva1H2cAMmkXauZKns3\/oot1AEkP89jHgwMTvZIZE91DBv+8iZd0UEeVeQK31SVt4N57dEKcTERlBzBUvjXluqCj462Q\/7+UvgxAaXlE0uYqXla6U0VbAFQF\/TRPmg7UH2v3JrGnuhAllo2U\/OFkN\/PN1OXVAkmRJ3Q4AAAA="}
00411{"flow_id":28,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1168,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":468088,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG+H\/AqAEGNHJMMOyAAbuusi\/ZlL5PdVAQH9KctgAA"}
00411{"flow_id":28,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1169,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":468092,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG+H\/AqAEGNHJMMOyAAbuusi\/ZlL5QglAQH8qbsQAA"}
00628{"flow_id":28,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1170,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":472525,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAG9+HAqAEGNHJMMOyAAbuusi\/ZlL5QglAYIAAxQAAAFgMDAGYQAABiYQSk1SzOlNkn3TvkAIK+ewa3CfPyMYY0yJbfZF87dVti68QZu5uKzYQwlZozCfKM9LUBL\/N\/TsCPypM31+PQZMGfyB7ATYTUNeOASoLSrG0zFHIJVOVquOk3QmxnON+\/xzMUAwMAAQEWAwMAKAAAAAAAAAAAKlU1UkpvLQOv5JywXfbapExhtnFglvQPLDdDEhhrR70="}
00537{"flow_id":28,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1171,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":482268,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"pkt":"EBMx8Tl2KDc3AG3ICABFAACFAABAAEAG+CLAqAEGNHJMMOyAAbuusjB3lL5QglAYIAC9hAAAFwMDAFgAAAAAAAAAATv\/fmkNA8srfTw9POz6SHJWPHORYN0dLo05lhLI75yvylmYmY82WgzQ6aOFftCYSMNwJ3JMKQHh4xoNHaEnPJFLKwI0e8zL22wOzWYZBdcI"}
00424{"flow_id":27,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1173,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":484937,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0cKdAAGwGWts0ck0hwKgBBgG77H8VHmMm9rF61YAQBAVitAAAAQEICmEGtIQwhK6s"}
02366{"flow_id":27,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1182,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":556973,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUcKhAAGwGVTo0ck0hwKgBBgG77H8VHmMm9rF61YAQBAW4eQAAAQEICmEGtMwwhK6sFgMDEGYCAABRAwNemFWSSRK4\/xQ6iMc5QRoeyZdMxKTzVKhyjjD6\/QuLQCCjQgAAk2B6jpiMP4aNnNPzeGx44\/6X3U2RH3y64O03zsAwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02360{"flow_id":27,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1183,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":557183,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUcKlAAGwGVTk0ck0hwKgBBgG77H8VHmjG9rF61YAQBAW7MAAAAQEICmEGtMwwhK6sLnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00425{"flow_id":27,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1184,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":557246,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex\/Abv2sXrVFR5uZoAQD9NK3QAAAQEICjCEry1hBrTM"}
02215{"flow_id":27,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1185,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":557307,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfcKpAAGwGVa00ck0hwKgBBgG77H8VHm5m9rF61YAYBAVk8wAAAQEICmEGtMwwhK6sBM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdIDfWWwwgxiTFT55Er7HGo41C+OpZwd7\/OsY+usepf0tUBAEBACC92gd6UwTVfl0ckkoWFysP\/qHVoA38Pawo6\/4V7MR1X\/SCKBW84BAY597xBLPkkL3MNo7qeLVUG7snH2EW5DBKKNaE0iQRZniHtEt0r4H4+eshqsOgXo5S+v1XTK8F4rXQk\/Ss2RJtNLsjfK+sYQaTu8Ccn4OunImZAIMFFAi3mRTek4f8o0qlkMqcCaxcB38MFjQzOCTHltKiMBSJIAz4SR0XttE13q2wsa8AlCxCsrJlltMqQbqDBWkePd66NCb2I64Tjma+ae\/ZFHoyZwKeS5oI7IGnK5dXVKDc6kGe7tQSTERt6eb7P1a\/SpSk1zZJhfDRFm6O\/2I3Ley6340OAAAA"}
01311{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1185,"source":"teams.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":8,"flow_first_seen":1587041682420,"flow_last_seen":1587041682557,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4409,"flow_avg_l4_payload_len":551,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.77.33","dst_ip":"192.168.1.6","src_port":443,"dst_port":60543,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00425{"flow_id":27,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1186,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":557342,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex\/Abv2sXrVFR5zkYAQD6lF3AAAAQEICjCEry1hBrTM"}
00556{"flow_id":27,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1187,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":558763,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIex\/Abv2sXrVFR5zkYAYEABZEQAAAQEICjCEry5hBrTMFgMDACUQAAAhIK\/sgoqbP1FUk5z3uBhISmpZe7zNM7WCfNmacEg0wRVeFAMDAAEBFgMDACgAAAAAAAAAAJIf4wDKViT\/AGT8JuQxf\/b3YbtHGUgi6ofrTu7kIdPE"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1189,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":611214,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1189,"source":"teams.pcap","alias":"nDPId-test","type":38}
00425{"flow_id":27,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1190,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":625355,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0cKtAAGwGWtc0ck0hwKgBBgG77H8VHnOR9rF7MoAQBAVQ3QAAAQEICmEGtREwhK8u"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1193,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1587041682668,"flow_last_seen":0,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":58,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00474{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1193,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":668456,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"EBMx8Tl2KDc3AG3ICABFAABW2rQAAP8RXYrAqAEGwKgBAeC6ADUAQqKILzcBAAABAAAAAAAACHByZXNlbmNlCHNlcnZpY2VzA3NmYg50cmFmZmljbWFuYWdlcgNuZXQAAAEAAQ=="}
00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1193,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1587041682668,"flow_last_seen":0,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":58,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"presence.services.sfb.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00583{"flow_id":29,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1201,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":697730,"pkt_caplen":181,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":181,"pkt_l4_len":147,"pkt":"KDc3AG3IEBMx8Tl2CABFAACny9dAADkR8hbAqAEBwKgBBgA14LoAkwAALzeBgAABAAIAAAAACHByZXNlbmNlCHNlcnZpY2VzA3NmYg50cmFmZmljbWFuYWdlcgNuZXQAAAEAAcAMAAUAAQAAASwANRRhLXVwcy1wcmVzZW5jZTQtcHJvZAtub3J0aGV1cm9wZQhjbG91ZGFwcAVhenVyZQNjb20AwEYAAQABAAAABgAENHJNOg=="}
00696{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1201,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1587041682668,"flow_last_seen":1587041682697,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":197,"flow_avg_l4_payload_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"presence.services.sfb.trafficmanager.net","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.77.58"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1202,"source":"teams.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1587041682698,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.58","src_port":60545,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1202,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":698689,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG913AqAEGNHJNOuyBAbtgCOGqAAAAALAC\/\/\/jdgAAAgQFtAEDAwUBAQgKMISvtwAAAAAEAgAA"}
00495{"flow_id":27,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1203,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":711586,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABncKxAAGwGWqM0ck0hwKgBBgG77H8VHnOR9rF7MoAYBAUBLAAAAQEICmEGtWcwhK8uFAMDAAEBFgMDACgAAAAAAAAAACnDPFg8JobiAasYkqEjH3+CRacPkKTu59duD23yppKN"}
00427{"flow_id":27,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1204,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":711680,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIex\/Abv2sXsyFR5zxIAQD\/5DxQAAAQEICjCEr8RhBrVn"}
02362{"flow_id":27,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1205,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":713948,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex\/Abv2sXsyFR5zxIAQEABGIwAAAQEICjCEr8ZhBrVnFwMDQBgAAAAAAAAAAW2TdgB90fLaE+l2mrykb9hvYu939KmveqzgkF0ciEQXQY9a1xArbH7Orn\/bQOMMGotiSYyD6MjHgZ3hb9wFSqufWKVzzWXKjCLkZRswQSVQs0usMW1nBbLytPxUwwF9hz7mzsypTSvNYXwzZj9Nw2kaq2KASnOWBrZoUncgmQHKzqRWxoRDJsPwWnLP8nai4rtUoR3pX9JfMVJ9kJmHsx6Is9gHyhqXOI5QnEwVM0mBf4p06i3EuefZoqTOTKc\/lMpV3d7k1xWBT8YQFSJdqLJMAsV+pXDTHjfZHHNxcKV+Cs0IWXYEFfpO5gkHYz2Cj+UJyk1MlAAXInKiekWnizUeSMNVxbmhuqvVzzFjYaydAZR5y8jBWiwUNpzWlyMe4aC7lrpnabAcAyD9dBnEuwtHtrrVuB0hfF+fAZMCKZd2ruzlm+pNxjNUwwKkkMDJxPtluPObrfBg7Kvoe5G0kXHDjRRfsRpzLoE+6eqyPCBdu9FUpDvvO5WEkWfxN6u\/axUC145j8W+YGBowx03GhFQ99jOA2lYC383lvWl5s\/yIjv+znbjeAqpwr44dC\/qm2+5yAYsAlwh+Ne+DI7ArhwFpx3WuAAlgFqchf7I9n91ViX3sdDNtyJV\/\/ht+VQidC19xPKjR7XXVO4Qdvg9AA1TVRZ2WFLfzTA5os4pAULwQhPBRQmmPadjN50kGNqTVaXa06gTtPDKjiskmZGwIELAK12bjXmG+IE\/CBGgdV3cZz4qE245ayZxWvUITsJSQQ6LyisnU72q\/LWADJ2eitkpeQzQxwZ8x64SilFz69HAHvWjrN\/fq7t9UPNCb9bdET10yT6zyxX6WTUd52coU9HR2g1JOfzn\/\/tkuFyZc2vR9SoIByp6fiu+QFEkYBzREXL5pkwfKe\/eLfSrXSfSb9al2DF0B4paBSPfyz0rYJ6OrFrwWlXrKajNLyzDwBjhH7yXrWN28UmqRFAUN93OWfZiiFh+vMswzguHncaqaRyLvUEJJUgCCkEEguOiolwkk3QI0HbqNPtAKzOZlpRrr0+LPTR242d5BzGjuMVVf3UwvsTaCGUwvW+rOMjZkH+ro4RO93OOBGkWDxX3sSpaRowzN9PbS6x7jrMhNHVBsQ8TldDJFhw19yTc4Kb2zE83r7L4bFRX99JlXlcJQHeW7ypKHpJ9Lqw1ONfZp6\/Svhs13ISgHvVVCWDIMU0BPQ5MRRTFS5JgOhdXyE\/5fk6yCZ09qEDZ329FC6ja5Czf+OoTKcFxmu83zfqDUqpWyuMz8mcYJDZz3nWINwdE6zaSprtWyg6m1El7FPLYldV6ct3tpSj7fT4jtQ33hDWLbBUWoUj\/2NG0e6z6gJZ3VSwFpnBEj18W5PqXbmifKO4a83GoK1bqqJu+cFUaoX153xup5adH2cHQ\/E8PjH1e4eIIEK+DxEB1g7vywTMPpEaCeHINwVclqgj\/wUFNcuIESWloQTKHzxIGpGOeUMa1ZEirIWXTjyF3CM4g8W8dESGc7svXRJrI3MQWauSm8\/uGPwu0feSA4Sv4xgDPc2OaeFW\/VsPbMJkeB+okvXJ\/4d5a\/krtDq3Q4eD2plufWJYp8pkmPyG8VsIzOVMNnyf1dT7QPxAiSgFE7V3DH9xScH+YjgU6LMMSMK8lUYjmc+tvpDVYtttjpctyvb5U5rdnVSBJLuq9goEOUKBg5OMqWUDwvBN34goN6jm2XuSmzxC7tydp5hkBzDDG8D81Xhax4MtNCdtKYN8iYxm4ooe6WgzdvHqkkMcK9ZI8svGp1KYmrg4AhRztpoUs\/jmqqZDgo5bB2BZjqOyalV\/hgZueIuU2\/Kz9D2t5MBjXPNDOzX\/VJu4KLdWxuDDHb04vICNrhepXqycgccP2XIYQz"}
02378{"flow_id":27,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1206,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":713954,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIex\/Abv2sYDGFR5zxIAQEAB8tQAAAQEICjCEr8ZhBrVn4thJaMbUvvbgufCvGZ7jx3PczRsf2Arqz2n5BFuyIODGzi+8QdRylyYCJTnJjkPT5mLT885uAoFDU\/G4FKgdBqCuWp9iKSYeX91S4YPodIkt86nL2wvLwjWlNwOrUMA+DCf\/uOMkTK3P3b9nfAMt1yYRSQs3w\/ic3NS8GQ3UthZ7+kh\/Ze1glfi5egYx\/KBdyWFUWDhtEO0x42vlbu3s5H\/fCw\/VlyoFbcS2rtKJ\/a9IrRZPxQsTcxlIiYXsVv3N9T06I0cFwXytznOcgpTWM7Rq\/x+90gAp7lA6vKEppEBx9lZmg\/1HUjslS9KVIycj6NekvHlzQpD8r3q7hNJ1BbmhJh0M2Qm+q2Im9JvuWob1rBL97MK8OO07RMHZghXL3KnZOApaqJ\/uAimAbCxSQi\/PDqo5JKBhcO9H1Uot+WAMzK6xfb+tZpu1W5mu+f148PxCC0ytclplp0MKzp\/XQELY5JDJOq0wnJfsIhSszMw\/I3mfrRT21F7RBpesyai8T8Ej23OoxMpoKXaODCL361OAo9X8tr1HYseG0c13Q\/QBoT0c16yZntoRvoUNK3l3VuxSJhHfcxs1RcoarVl2scMRPl9NNJG38phU9HlFXrD8P9OjrMG55cZ6Vpp8pjNpQxYFqhcBQ57q+QljXwNSUaiudr\/x8tf02eDUH6+HztcQ8crSCOoPx3D1WAOrAA1e+JLhJLe84zUtFPNnNaj2nxkISrKXLWtYDm2jxqaae\/drnXyBXgfOipmw6sDswWJD5m6auaZOAB4QOsMbUfAIJ6Z3GxkNVJS8f+dqNgR+aK3YZAM7ROLvywhZjybwj3s7QpjpNlqgBicYLn+M9r\/wOcyOYbi\/b+ToCX+raIH5AUV\/9zcGcQwLTmUpNvB+2TFTEwmJjcr0WNbIWa6VB5ORR3adGUyBbK05skxOq46L5vJe\/ZTupT3z2TC7thSUgZ3w9krZ6DPky409x+mh3fZwzJfJq+CndGi0O8fjxBM9\/U\/kSJBXOpPVOfVGlPP0xi208b5rrsW5nUauLmvX8\/Uq8\/oc8nP\/4QUU5dWOrsbz4zZbO2uvIujzooY0dsgBwOG5nQo93uqvuvW2V88L3nqdildgEQxfIlxknd1GBbXiNfVMZHm2oMtJazBQkKuZF1IX6U22KVYvlMIU5EjMXnGMgAEf7uquOimoOC+bqm0HGj0fBFwhy37BFLtimw4uFctC2FSIBrPkNlngesdy2SIZSkLsndMVU6P92jZGge6pKWh\/\/Q3tHgIczSLKFKYEL\/xOIo9ipW5N5\/3HtFhHAYPsmHvDNAuiQKyxn9Ors8jY6+cl\/l4TDbN8alcxyU41mYYMTwEhveQWAz1njZSLtjndg+o06Az\/2M0E3gAK7hJcIDo\/C15Nmk9Ucv10WnOLsUFBMzofujGHBjoh1hOAA8T7PvYLQwgCqB\/xUEHhRixqh4xc2zbbn77x1Ye4cwuIvW5AoS55KOUfOneAweKhQiMOrB5Sgkpkm7wiOUjqdh8Udmhd6rFXPchIE0E\/4B9mJT5af6J4ieloUlwpnMj4OiG04UiwN+zSi42Eh5ZKqvnmceOJHqOCswrw+rlMcwMmMlQtsOmfu+ZYl7IonXFNJFJsGIi\/zxtpeJvdb\/Xfc2X6rVc5qoGA1cotWdg4KBCeHNIClCEq8WzVIYiEKYnBA0p7evq7ebO8A9RiaPOvQqWxg7Aoe+5wg5eZYrz8Bh7xNbAR2gpppHuFIM+AN+3I8AzoU7tB4uAoOANs2RfX96\/Anwttfm8OeAIbG2aYPTHiOd+oYD4zW9EkEiT5KiLuQrKyj+Tbnk5mC6fD\/b8\/p7Vg35vfMXW23HO7EbxiQq7THuo1hQLdB3Y4+2JjP\/JeLsiDLC8WuF\/bJFUGHgLCoBXZhAMXufGD"}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1208,"source":"teams.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1587041682740,"flow_last_seen":0,"flow_min_l4_payload_len":233,"flow_max_l4_payload_len":233,"flow_tot_l4_payload_len":233,"flow_avg_l4_payload_len":233,"midstream":1,"l3_proto":"ip4","src_ip":"162.125.19.131","dst_ip":"192.168.1.6","src_port":443,"dst_port":60344,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00743{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1208,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":740607,"pkt_caplen":299,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":299,"pkt_l4_len":265,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEdws9AADEGDl2ifRODwKgBBgG767gSqyGfi6a7DoAYAWi65wAAAQEICpHNoqswhBBbFwMDAOQAAAAAAAAACKmKftpP18TObpudfRHF+x2Q26rJbEiP394UtjZJPj4wSIR\/hp3JlNrAGtpUw45IgQ+\/Td3gBgwIaydoMxwS3i93S6aIvQahVpj\/c5RwIn5XTgvMLlxphbaNgBQKVcUBzOyFCFmX25bboaZrE8yGPewBV8YF9rPw3wiL2qX6gOrVwGBD+SxN5WBWFI2hGO+JWJUmRSYMjHC+44xSTFiyxGwuYeySW1fNosn1ZrrnxmEfRHvkqjQUYvkmRW87MNYmA\/nzpUUAJUjx7fyAlsSNV0cWWtSO31yX1lU5orE="}
00425{"flow_id":31,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1209,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":740712,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGwxXAqAEGon0Tg+u4AbuLprsOEqsiiIAQD\/hw3AAAAQEICjCEr+CRzaKr"}
00426{"flow_id":30,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1210,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":744342,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA09YRAAGwG1eQ0ck06wKgBBgG77IG+FZNKYAjhq4AS\/\/+qaAAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1211,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":744445,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG93XAqAEGNHJNOuyBAbtgCOGrvhWTS1AQIADLJwAA"}
00704{"flow_id":30,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1212,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":744658,"pkt_caplen":273,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":273,"pkt_l4_len":239,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEDAABAAEAG9prAqAEGNHJNOuyBAbtgCOGrvhWTS1AYIAAsUQAAFgMBANYBAADSAwPkbX85xJUsmCJfCQtb2nqS5r5NxitfmjfkWtCVFh+GIgAAHEpKzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACNCgoAAP8BAAEAAAAAIQAfAAAccHJlc2VuY2UudGVhbXMubWljcm9zb2Z0LmNvbQAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAABIAAAAQAA4ADAJoMghodHRwLzEuMQALAAIBAAAKAAoACAoKAB0AFwAYABsAAwIAAkpKAAEA"}
00751{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1212,"source":"teams.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":4,"flow_first_seen":1587041682698,"flow_last_seen":1587041682744,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":219,"flow_tot_l4_payload_len":219,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.58","src_port":60545,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"presence.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
01247{"flow_id":31,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1213,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745381,"pkt_caplen":665,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":665,"pkt_l4_len":631,"pkt":"EBMx8Tl2KDc3AG3ICABFAAKLAABAAEAGwL7AqAEGon0Tg+u4AbuLprsOEqsiiIAYEAA0LgAAAQEICjCEr+ORzaKrFwMDAlK2BaXSajSAVWEKj3frXxijYpT3GD2Cuos6bxaeeEb0O6UJhzmzPZI\/SWy+fgBnTfneCwusduYkx4s3F4xCn2MY3DEvpr\/P48ATzKlJ++OHqI7OI3KpokJ1bF8YwJjJpFyWkPT0\/gdDA2C0thwexYlLgVCHe4dECfAKO3ai6a9AkpIGftSCmWnSsB7\/GodcDd1wDIWHn+mS6A9bTO\/2sRCfLQjmwaqnM\/0Kd1DorrQMm9TT6\/w11NzOyGJGqVRWfthWKCJ2r5CEFaogXR64MxPpr2FM6spcuDUY4C3Hc53Q7uc97BndljPBEgsGGu2WIs1hpBKyBrbp4cakeWFrgRHILDge\/JLjoB\/we0ie6rPfHdzAzbH+CVHboc7ECVvIV6N2Rd\/z5fI6cJ5y1i\/CGpe9JS\/DjF+npNlL3gVvBs3y7VpT4ziTRBRlbzG6hzfaYWVE\/I1GNwloup0kRP0\/\/fFg59buQBmTxdHJsfm4laPDQEGg2\/E9TD5wbcmagME1tYB8Z6HaDDAe1MbrBXtLSM8VMS0ZeI23LZfgw6dIscXGQh+EZCVohYQ2K\/dCOtZqYIGlXsZd11O+bX\/KPVaVnsGCQqimWVbYkJXTdkE5fdL4ibwUdj8vI7+8IXUv8oArxAdVEWB2+pth6d9Zti7C4SxMlmajA50jkJHElO8G4w6Wzb86qkyK4WbkuYLazUSRxEvrQrVtZjtDDcEAhbB3i\/CCiXoyK9403MAI7UV+NXn0+Iqmacnoi+GSVKkccDjbrlFQ3qxHSBpnh\/Zt22FSB4TV4eA="}
02358{"flow_id":31,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1214,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745498,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGvYHAqAEGon0Tg+u4AbuLpr1lEqsiiIAQEADIXgAAAQEICjCEr+SRzaKrFwMDIBe2BaXSajSAVsA+S0rbnqiekP4iuZq32HuCU1Zk8b7DobfyXAMC40RMGMmv03seNmRLB1WBKOAndSNsjwejL\/4UdAY51oTzt\/idB5m9EO71\/T1MmFynzxV07rmvd3Y7KFXQR\/+x23FlX8GjLiPfQFhiUhRh28ymzOk2Fma1O328pbgtPmfOm2\/I1HthpOnXap2OPKovdSqIn\/dOEzmEXK5RH4Vhc7yfPS0tJ3lq\/j9Y4mE4jZEoUqARpTmnt\/EmaVbJrcge1AqzkW+CZ+w4JlO7k9TdFEi5TByHM4C1T005glLtZNkRmPpMGHQbjibw3NTyD4LLOA7ibrI0r9IDNmoeUUfh8DCZdpfo3pxnEzyt7oapZ3bsP3f2dkvlxSg+Dlv55qlRYMXtNU7tnt3+G6vIRUNWvNYWxEeaewlxO7D31DoGy39yf6\/Uf40kqlYmjJklCFuyytx+XwcWqT4ARI652Z\/KTokqiY0d8hvIMHweZqCdsZ3sZLcS92z0hCZYB+QTk3oNwXMxF3HPTJhWvhOq0wqkZDSVoE431Wjz26KTR\/D\/dA5pInq8bEC3yVuUKN1PLZW9Mz7MYJyzusjyBNsPLXM5O8OEeeK5MiWTYDXzmOLsLkb2vkB\/HV4y3Ev95rIiSF36Cpgqv6+0aR866vdj7FtuF34EidwFeCf1Bf+A5YjRmGj3oaiwxanjseDhhtnxhUTf19iNoEFSzhAIqnGHRAvLOkI5d3FBbQQt+YdQcTmf4uC9ThNnySNA0HXREePQs7huoiwdf2bLMzadvLcQRiRnWU7Hl35DzJo7SAfHQVc1y7a5SVG8H0C\/gvRNuAfv3HAV07QuKJAR49iIkFCcVRaJ\/jE5NYdjrNiiLdvzoxuEZ0dWMxMftRotvm8FM6ig5uEvIZbx9cs5I19iYZQ+xjuzmSG9hz4iz+WjzAoY1dmLOtgbT\/XB2FXmqmn+QhnOY3Ljx0J2ha7XjBQ8hWDhzClw138COO6BoFzaLcXOQXTKJXlqio99G1EHem2LSJs4Fip7GdtxGPNIMZ40wLG2DFzen08a5EPl23FFXPX0SR69Sbx3M0R+hQyRTGJvzQ2b0FETVcaGBWv\/AJUXgawU3fpNn7TAnn6usnhvfGudG7WV4wZ6vkSA+LX0MCVzjn7ur93PxY\/kpdqz3fuiKZIsdz1qUGtjG9iABsh28XZ9j4vR0VSK81wLD3NNpJ2yPv0bwOqpCaovF6tXQ1Ews6XsxqJi5G36BrzaJ5\/NXawhnu8ri1Vz28LUjmOZPpd6keVddX571\/oIU+Q3p3lccmI7+gjH3KqlUBiHCmpfZcYeOnCUEoJ6+9LH3uDsI4lVcAzp2csO0NXDwcfvMalB6gajtPszvwIJElID7GHKx1BsawLle+AuhD6lA8\/ePLwyuj37+iokrx6+vklOjmfe4s9diN429ybZIsLrxpS9gvhCcqJjHRib1BY+X07qe0e72A4QTMrUQvOqVAnCJ6MepkVyL+TYwE71AQhIyEcdhSMj5NByh+Ps2+o6B6TxNGxL+Hz7Gkx+JsBR2inYY8O+Lv0UT9kVL4KGsfhNjVDtOQlSBGenVIqSWzA0IMPQo8+3Of8Hq4M82zM4CAZ0HSDgvnwrTIr12aPKQZeXdT79Zkpu9xzzr2tssbkalNRSPafbicgt9KUTproDv5wkhK7YwHiqPcGR0QVqeIcuyQotM2kpYtKzEsnaTsMsANkeXwUSaYMnhtvVUO0AlG4\/nEwlNMBHzNthJE9IyucPPp6lNbtpzJXbzjnbqhKzr1pBPW1NzcsmUvTf4AThdCxRFDDYC8Q9bGPZ8M76S438LhtuVyUo\/lD6YFPci0DvupTGZalsukVJfD\/0b05qjSDFI9eEwsvlchodrzNqwexfGQO0oqhK"}
02358{"flow_id":31,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1215,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745501,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGvYHAqAEGon0Tg+u4AbuLpsL5EqsiiIAQEABs5gAAAQEICjCEr+SRzaKrei53o4vFQHMBld1Fh\/SJ7lY\/Br6V6nMJYu3OAHgdn1qCcCSFYKKt9BOxyQf3yfDnlntHKN9zdEPSvXN\/0hi8YerzFHTzlE9CpJ2R08FI9jE11z3fnVvhf8e7OcEQqRZgxnPlEzNldSNYqEcmHkXvJhZMq8lx7wyR4LUbGNhgoKdPGH278UPChna6A3t6rVbTyY26njMEfo0Zm6rhpJo44iHLRIKvpaj2GQsfRT+cQeJIZ7CCI7T1q2PUyZhm1ySaJCt2LeO9BPdVU6xJnGhMV\/aWAPQcJ6kB0bxcZrLoRiXTU5Sjkns\/IiFNL\/xvNJTPnSiFRhwUoHK+lhufNQUo13wAlnryX9ux9knlEKyd0St6x6x3\/0AcGE5iocc88TMKvbPeEJdROrTHJPBGw3wEtTcJnsCO86HHTsshAVdGVqkIx3wKVLP63U4Kblp4jy32ZZqt5mrVmtgkvfyXyOjEWSHg9\/kbER4PSr77Twprpqx983VEq2Hcb9Z5Mm3nOhfwTP2T3g\/CCF8QgaWGZrUDu1iiRUPI6K2BHYirquzyMaFufY9V8GpIhq1n1xceUiQLPYGN3l5fQJCiBdXfFafOcSFxIjVpojrL2EOuqK2nuMjLQQp+4Aqc6WZPgm2ebUN\/iKkfC2yH2bLExo2MPi3VUFi92NENpciPyW+eXAFY69MJj5yxa5BiY59sQ5ELiBJlv7RkENWrGuHIllIcpW3ItUf5UzQsbStrqU99fkGX6jKCwXrvMoRcz4OdAQSCuL42ekbFYHiL0ne5NvHaRIqcek4\/JcqoZpMdpQey7y+2Dl6doTImRGjrtsYDDKgFGhDU4N8dTso9ThZ3fuQI5GnuKCyDE7AIeVXiQlYv5F01woYov2hCUZp7ZcJSt2ohbipTR8\/9XsRLAxqgXB5GsFcoOvfysdpEjckn3ixs\/e\/E+9YhRVwcgw9hwvaxpOHeSVNLQn1UC1jd6XPsedgr5CYCUUWjOwS77pYeBf15DMuXoTC2DTw4N0qK0I2k9jO2h06\/VwS+DdyYzdZyIEDJootRjKr6+oHebS0B7nXpok59GLbGxDjEh9wakV1SZs7RvQXUIMtwshnqDiJum9ddTnNB2+bpdzgJa3FjnjCyxjYAJBZhtEPLvmmDoY+ugXE9QtbOp299K6ArOZPB6JuK4rlVYneXIpSl0yfeQgFoaNPTPCWdaxvM+AfcOB7YkH0w1UJu2dyLSmHw42qCGfzhxeXIbZVNdJjctQ0Cqo5zXErR1874K9\/40112SIrZY04P1wdyAy51DHX6xP4DMvjfqz6wVaf6gJ\/DZxBp20paRElTtDQN\/dHqjokoah04MvpFxBCi0Oy+R7CfKweUnqAqr1HqpFAPT9qsa8YrIc8G0wUUzeAax4URzLWOt85EjAnPLK1DAQYPq0v9Q0KLOsGsn1kbSvDpNs37iMzwcZRFzWoLHwwnKhxoV5ph1YHpzct0GfB5TMtawMLt6xx8fpDVN\/qmtv7vr0PwcpkWAe12mwk6YMCBt5BjA8f7N0hNc28Z18gN\/CgGnUTUJNyHOY9\/otIhpyZk2nAcBRRfiJ1pLKbDvtAKXiFEDhY9R4CdMU31jbFPykJh6n2eH+U5nfePcR\/NQL8CGF86lRBvbS1BffGRulEfJVi517lk3dtmRmFX4czmj4U5S0fLX7dTEWdkjlqGvyPwcgdLRBZYccWZ3e0IwyZLzh4ZvqC6GXgR\/YxXU2EyExTuarC8OxvaikQEuWDLdXLrVfF\/5zh5AAnOxdXMDpgpl7zVyHlEg1yLy9mLgj1yQgKUqwCNhyVJZLyPBjuKvSewLkE6Yb4TMgTQzgnkGvHFjAbR3wnBeO3lqHZFEbIHcmklDS0L5Y7TchFMURbahXYDs4fVUOyQ800EYRGVfodFdgqI"}
02369{"flow_id":31,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1216,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745504,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGvYHAqAEGon0Tg+u4AbuLpsiNEqsiiIAQEAD\/xwAAAQEICjCEr+SRzaKra4JCt9UbNdEcAZvC5Wcl98ZezmljBqx8+d7\/ALwbCM9NZg\/SyZX7gfrprMljQoLS6YyL9cMML72\/CgkvcCJ\/JzO69aO5QyFygcbPb3+I+xFF5m7P7RI4sjcOxG1R07p\/hX93jyV9gQMYsybMVsxVMzHUgn3WGoO+sTI\/Fof7Cqomu2SbzihuLDQ6SOnFTgpNh1+FtjT0p9ypzrEN6d5\/1MdWQMLfK2czJgiTXf7iPD66+d2N51IgiW9EuDJOgEqGtbhODv9Hp4CQZENPSCzCNBh3BBONJTDXQ11ykpvQEfflgmYmANDJ4FOtD3gifnduI9bRjZmbmdHhNl5yYGgF2IFE7jeEC1473lBM5CNxDAhaIAomCLLQ\/CtyAW2g7mewHoZNpHb4rgBwBKudKTkjEgkBQ+szyxqMP3Sig\/cXk07+KRhkea16SEvIZz+uRY2ytK1HaSg\/f9vCwYuNCkxj60PyBYnxJZ3yp2dmG8O5OZGMDb8hhYx3PWt2MrQjX0NHZhNdllRRG50tZtii0pVAYRTQU6SFR27BDU+gvU+yDfPRib+8Vjh0VqOD0x6Dmhfmqohv6Aj0ld1GawCwiZZt+MklAJRp374F5SWbd4CpsDS5KNzDURH5007qW8+cvQdKBLITH6cz9pq1PS9rYxIFRIWABHuCn3YnnEt4HQr625880CnHE\/zJYirbtOUSttkZ+nl4iSUWoQabY6sXcplisZzS2iFGRLYvdtVyPzq4weAwMeL1FMB2R5vO7rmDQv2tcQP9rN0gP6GU7gbrkWlrarGO8D2p2\/Xv\/JJ+TMipXwtVIwKvunlI1H+WC0dPJ8ak8GdbLz7pSRSEiG8+3sDw\/81Txkp9SJEMFmHos8Zxk++koyagzZ8p8FT2\/\/36Evq5\/bUA+6ZxEPd13kFW6FGuo\/wM7xXzuyRWvDOJYD0+gV\/mOe7E8HbapiK8O635Wp7UgdW+M0ava4BZvfc0zIHYqicHi6lx6\/TiQe40Kvyzg9RMLmRmAtYkXZu4RKaKHuIUtyaTVn9Yx8QSGPb1iwF4AzTqY\/13BAvluod4Vsh6A4KiR3TNryVwZ7wMw464RjeYq3myjjt29EG5+rnipXa4EcPbGFgmhgas9dGR2MybbuOPVgowxJoqpCWm6BaD8Wl105zsyh9yNWzMcvpuu3eSYGmJcwDapu9nOKsJM7eB3mE6EjS3vOMH9gyuLGohp1Z3X85Aisnoc6q596BTeyogfBq2wwOpvbcp0YXt0eXT58sXtt5NQfDZgIuiQ3ACb7aNpNwmK5CfyL0GE+g3jM6RSNeXFhDcGppG2811swszY67Xg1aLurKp56DDjXHoUsfZReqxaWlsNm4XGUYYFVgCtScyaJkgXXjdee6gS861f0+oCZO8BprDT\/VsFtIUsq8NL1j0LMBbzsvglLXKgUoQZmGUMGMmySzBGjNthZciWcgjPUIn\/BSxhUi84g\/609scUB8bNLsuLLAuo3qQx9d0iEh7PioYM1L01R1gvea\/4RXxL5+0QGyOLN1o4EJT5BWc988FnjUA9Vb\/lGODcZrWStK2WOj3zaMTV9\/Eoy7Y4EVCv3zaElsCuu0WYsYSg2wH8s\/5Kgs9XlYZTMA4ZiWh0LWaKRFL1gCeggoUYJxzVpIt9k9MZ8P5ZJ3ZE\/QFeLESOP21Kp66Tcq9OcXXXVCEePC+oO2ADrFMB1PnNDIxblr66OQN8j8edMdgF1BPGQkhtJf\/2yGv2zO0RfC4W2B9RcIO5HyuyXq6ttlfsvcUtl\/lEtEmMkeN5cs3KAiTFpwkKbKG5\/+j3D1J549C17FI+EkYntqntJUxm2TTojkqOAcMoM\/ov\/Bfob5XSsGHVqSnGdagPo7laxsBgDSvGpM8RldFUAMl4u1EAD4dhREwd+cnB61E"}
02360{"flow_id":31,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1217,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745506,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGvYHAqAEGon0Tg+u4AbuLps4hEqsiiIAQEABgMQAAAQEICjCEr+SRzaKrG\/pRRmEUpDL2a3ilen0m\/qkoRLkQ7C7gKQKs1RMX0kXnK9Fnqai9StFnEShHQs0WHl8XhQ5pq\/j+p0IszeqDziSdQa0RXxGQ2cQbvwEdR\/wOhJHeiXNrL9geEselYgF6BQLNKl9FSnK7gWJKnnYQYYYu03BB\/DXJpJ40vcI6G+WHfKUmir5O1cRvkvYSILLoYmnfli6dRKJF3cQwM4\/skPsH2iMZxWy+hJ9ebVR7e449YkYNLtM6Im1SPnZUYd95DZnc0+jRZjbbwdBkwaXmOc1yvv0Q4vQaZ4uVgMgjsKMsQ\/GhEIXPm8Pr90eGNAvhgmZX5ZWqQ2xL5fb0NQnl7ItCI1ICyvY3rurEJLzTP0+nVIjyAapg3X+I+\/Z7euQl+7fIEYfv7IdSsfecfZSLGn45hUFug4bc6jhYRX00TXiO+yOq0GFLSsyd2bdVAp4eAYfenXtWtxIwMi+DS9BH5X8fjLqRK4KPD0iuR40O4muvj3AW5sl07GzH1pO3WdybWbjj1D9J4ZPW+iYBcphAjF5BDbXrNjDnkZ59T\/cSGEgyqWnkfqhjZ4BT70GIT6Xa0afl+uPQB04TV5VbrU46SD4UKo9Qscoihtfha61yz30v7+b6KGVIKEFHaBvH\/F9FlCuhWz7IhA3vFH+9nWYsX+G9mGxqySuMf0PkDSeGQLh\/Hn1xDl8aznwhmLmGT8TfFTC6SQ4fksO70nO83BrsT8j4j7\/86AeZzmjdv8xMt77GsftK5+i0nZAqcbHbpd+sYl6QGFIlrmgPEHZZmgtdjSWunXe\/Sa1sPDOKHeNIjrfyVzw+uUBGeFq+TcIHjQp6tKE\/dIbOPnGyfYYpfF4E7y\/\/S5\/bNmJ6NXXN4vsiqIA9ryQc+0M7YRQ5KgbPuFb4H56jnYHDpFc20tV9a0o0YzyXlZp42KqQM+kFQlyNjPpMjCLLeXuPHCetEIWCPomQFoWXoZKjC34Jm7BzG7ucioge\/OYqc6zTWhRRDzJ+EAoQgrg6ah4HIb1iwbcz3iqEvVELJzdGlbNFj+ppRbBEJ5L0+QkOFNV5OaxefprqgV0NdOFoBY7E+ul5ikKrVKKJuwiKvv98fLL8HH3m1+j0FFQuBrg+G+9gsHh5XBWsRWo8oFKM0vDTIjhTAunUNN3G5US3gw0dCG+v3MiBu3vNgS0GXTjrBHbzHS+poFdkYL6WjPhqxuiujH71d3IYogXzaHYRwbgfI6nDBZx4f+Xq8NvmA0Yh8LPTKlHL9a7E0EShLCCHS+TX7CotZ2jfXr34hZPbf0NPC1ScdnXXEmzN46SDkYVtKsf4IVufXXaYs+2g3GbGug6aZ9a0SU6Be0cLoZ\/S0vp3hnw0PrD3drVtZjOkjwJ+avMwaTM5CDORarnl5QNCGs8tRSrOlthp5KZ8gpIRwZBfjdCazB\/3J0ntUGvobg4bI1iGZbHKv2bGSWm2RJxE9kM1MmbCtOvdgrNcG5zS3uwjsNLclrUa+0b2X0ejU7x3vDrvUbAIDMPwCStV1qa156H3tlIZw0vqVD1C8tT3jKB+kjiAurjQuqG6jwyG2DuZREX6pYgnu3rsICU881HPHJChAgb72bBB6gn0co8Nw5\/svjDERfPNSuGnjeK92XzFWNI5GbhdQS3LVBUPOI7qFQHsdTQ9ucHGE0MicAkZbW3+hLuUCfSNCvDLXrbvaFLiN+kAajwGTaBETRYPlV8TXuuI954Rp+Ejk8HoU9p3ZNBKtn68OALTAvNr01FSNM0rw+NRdVmC2doEAK49cT537LWi21csQpC5PrQ4tydgCZHuNFfnIrZ0Axf5CEeEC9Mot84lfJPHtIio+mh\/07b0MqMOKjvup\/fiL6nAmduWmTJzP\/p80Nk3\/u5+pCsQu1lqwyMv1YK\/R07bVVB6dofc"}
02360{"flow_id":31,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745508,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGvYHAqAEGon0Tg+u4AbuLptO1EqsiiIAQEADeOgAAAQEICjCEr+SRzaKrzYW88e2CfWzNZAm7YGv\/GC3ueZTnRSVLBw7pYNrOpAiG38jI6Qt4Kx2b9WtYxpyjUoW9tcNvzBVTPMSZ47JvbZdCFPZDhCuw89DktdDgMhAd1cqt4pJY6R\/dfRGgq4A0d4K6bNZwTGby4vBzzJQSoq6lTgpL212+AqtZqSL9TOxJQNIbru8pCu+eMC3+UxABZh+vjVlApYEEgleR05OUu\/t0ujQt+rbsLfKhW7NCCrDcMsxA6eHyjOKvbJ5BKitSMsOxomxwN\/mBhwTXNMDIj9ipB8SqDCzyo+fGerdB7iJocdi94zm7ElNcLku7Fkp2YUsg8wo8tZdFBsESUChXBwnIdxBSsTyO6s4320AGbG5ZjxV3qpQkibkjjdMMfCsMZY3oBhr0DTEYU8KvT1SwPF5vx7D6QegGVkIuICWyZF2PnmGvQLX0gqS3jgF40PnwJRJzl\/m9YMakzCu5aqeLYJD8gpEgpEthdGxx\/W4+YL+SRhOZVTukaxO2LOzvCuf92CTq0stJna8lX6JLX7DZaczLtO7LC3rPIOiPLnTruqf6No\/X2XDOcAT\/PV\/vIRkGM4Q7h7ULoH+mIz3a\/nhwP2xV3Qw4Lkn5GWlyWBF\/qD09wJN6UiF0mBZft7Isb0gQFdOJ\/BfGrJPoFo8VUR6TWBWpzrRCj+\/syx4UndKeFRHBn+VCE+1ExF06Dm3FVDsYtrPd3OsrJrI0NXwvVGjIWdGZpB8ZB04HdhSVxrGF97QIG8HvrdEonhKd1P6C0+MG1i9Z0BIK3WhN1kKg+rLXpVb63wcO\/jE3a1PQdWrwy3B3ZXGMnzznOHWeDb0eyclCIILos94wv1CLlLZnqt09oWc6XqgYF5zxId1dMQx1b3PAfYfCJg0J+Dq1TOCSccXEaA0a6dvSWmYkMqwsWnElh0D5KycVZEJvl764RsjramQGkKDPi6hBKviZWsNog\/kzxfL1R9vf5wCA1gYmO\/JfPTUl9POLlJiy5UUhICv2fDbeiWLGx\/QrsYmze+WP82w58PobpeyRPnti+tHCxgBf6HiJwOJ1ZttfW4fEwBCilAYsOZU6tHYQY1YK2BKuDrStkHw6a7KHl0KqG3iooGUWp6IzjSRcIViXeJHxrw0OqqXd\/fNTQhEsFlDzRZW9RukuqvsDEeWPoqhyKPs8QjyrMUsenEh3qEvB5IpAhEjmmAlAPa\/H33u8d6jyZEl8PfSH4iRYM1QqcAX1JRFgzCTwdN\/mpNCLjnKIhoeYU7sCX2oJzJqPy\/OW6JHYizKQ+9iAwWUya8z2+xzJYoXx4IwEya8zVQ+LhzTxSMlkIsyzoW7Jp7h6QyC0ZwPQDgTncg52ARx3v2Ck3lQDqdFGD+KAXD80Uz83Ctkvhj6jRSpSKYaFNNulMvi58fPa7pMIPYIrCPvv\/x9xW5Thb7R+DA\/g5MSa1IqqAzpfm7G7nubnpoRaf3jIlfytao1ROi5ncT0GG3dHR3zJLHDt8KBhl3bZV79ey9RjNKBsK3ettdL71X1lyPM3UkuVanC\/4oqtS4GhOsxP2qPvCYvgk2VhYLDPXT6rg9M3y9PPoNn7nxwulsFhsI5ov83PwHfmEDkcB0HqcPw97APEPSPzsbVbRB1EKqAEQwjWILqZ5iO4bS5Wr4PvUbvJoNyD8icDNiUhUtTr\/PULeiFkd44sBoX8+LoD15PvgP8ukZzYLgeifLtc2BZw105kBEgC6px3i9a2EXIJuR0jU8kH1cKv39FghJJXxknSqLGsBaalCSfK4F08eIinwMmoXMoAccgGVwxV71PwsWBNuC1TaPs4iDYx+6HRqMhZSTW9XgJaYKDG8chMAnQpXNq6f8XvUYO1VHIrF0cqYZZM\/+31r35bmFvCP5CuO5kwYP9Y2qjfYOW6IppI99MciTsv"}
01895{"flow_id":31,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1219,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":745518,"pkt_caplen":1146,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1146,"pkt_l4_len":1112,"pkt":"EBMx8Tl2KDc3AG3ICABFAARsAABAAEAGvt3AqAEGon0Tg+u4AbuLptlJEqsiiIAYEACL+QAAAQEICjCEr+SRzaKrUcekj25buvWVEyDist6EWj7nSMcAAAPWnm+\/Y8UgdvxB5ik0vpglnwbZjNZi\/L2+ohGioSrVtlJHDgII\/cfhamGYE8Fh5whtTV4V2P433tSwQKAMT7h7ad+kvBhuQ0pZ6Qa56qZvsjK3zfXKElt7KA4SNfdepJp06Q3b1UWhT0XYG9pbRB8XMmehWZnNZU3dFzdngj\/KU13XQTlBHRgIMmMUxV6bV6zF5gpHoXjuL\/VQY8JOb27q7i210Y20y+BgL5xTBw9XjPkKu2yK0aEzh9VhHJSzbc6WYduE05nGyOZgp5WzrzeprfkjgfBEAj9Zhvot9JfzCYmMhNxvlEyD1lU\/W7WqZZO39rzGlFe4QcCUVZvdan4DZ+HFymdkpBHnuyKwlpKHLFU50rpeo+1vfGwLtCaU\/PI8UGwXQUswaW0Z0oGqbE1ZwNozAlLsPj\/JLJgTFexx\/hKAAj0nCQtekwQKyF4Ewj8acdwmbKz\/0s6Bo\/eARzdfh3OMwn0uCL+bmKyXhD5nitC7UJozlyyRVWc2FL2O6f2ErUQKFGdZsa0o0jBhswMyCmSaKJZIryRtL5mKC8hZcURlJFw7spsObvWA1yfSbKf9CGGUTFJjkDusRIToxMkFSPQIFv1+AviF\/7JAUpz0Q8pWfWnoZGS4Q7v00tJO6qjCUmz2EXnXALOr\/8Ni2k5BMA\/+nlXzKdTw1O8W5hovkTZPBu+FML2qJdUyh52sMy7AWzDcXhRmG9ZQd5lzUxxs8pErTk9yfaovWs5GYdjJjTyBGhgWa7OtDAjsFTGQGoe7IS027h3F6XoXlS\/2gTMhaUMg4Mvash4lJNy1bz415nD8lfMCx8J9lpDNAa0uT9LdF8G6AB2xFZ\/sBP6Hr2790LhaO3rgCOgvDyJewAO6ViLODY6grPVzOO1x2l9X5LaQpE1LPkJhBSfyF54XITiLg31WjHheR9tXntNqJyZan551n6NVANz\/Z6cxa9RDcyuwkSdnUQhQRUt7gSybuFtn1X3TklrTeLKMkes6zT8uFrotJ+ABImmmcpopgTGf6H\/3rYf\/ZJvXBqF6wuAeBTu5yfd\/\/PJmxvOWBVAZfX3TERp3nbD99wSvejdyvMPszVnYgr0lXqW7pvMMmI571JNeat0BuQCu5mUNXNkbZUTgss7AYz5eeizQ24ppkSYbqbH1LUIyzSaQJHGGADw+GvzRTog4\/92saVIJvIpacrBrOHVAKPKowCj91HZ8Ch8KPJqjSzZvzz3W0yHXnGnNpvh2WzSlCM4yvBsHfYKFPmkv0y4WC3SAGWiPgnWyV3ZGV2AurlrMwcXi5hdCK87FPTbH\/MX0Rwhnt7TMPs5WUkpsx3bw2cxwo\/p0ogPJ2xn6CTe1zQojimj9SL\/GZaqGHjTvAT0hFTpljZSyVCb4uDUjkTrRUoLqW8bqUPo1yr807KBd"}
02363{"flow_id":30,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1228,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792228,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXU9YZAAGwG0EI0ck06wKgBBgG77IG+FZj3YAjihlAQCAQbpwAAahz3MIwwCwYDVR0PBAQDAgSwMIHfBgNVHREEgdcwgdSCIyoubm9hbS5wcmVzZW5jZS50ZWFtcy5taWNyb3NvZnQuY29tgiMqLmVtZWEucHJlc2VuY2UudGVhbXMubWljcm9zb2Z0LmNvbYIjKi5hcGFjLnByZXNlbmNlLnRlYW1zLm1pY3Jvc29mdC5jb22CJSoubm9hbWRmLnByZXNlbmNlLnRlYW1zLm1pY3Jvc29mdC5jb22CHioucHJlc2VuY2UudGVhbXMubWljcm9zb2Z0LmNvbYIccHJlc2VuY2UudGVhbXMubWljcm9zb2Z0LmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAFfJmXOb1G3\/gkDpDClarQB6kon6qcwX4Kh295CbM2AS5Vgj29434HX0cY+Z9iv\/MTbIOmx9325DU4Jkds6+IU\/YaIPC6iJQpcE2e349x3dnDm3opekdQpM9PDa129MKr2YMPfEeN8v0qTyUuQZhGs4n0KhbSGQjx5\/B9gHGSpxe32oG49c+UQMe29vQ918eWYGlRxmosgaDo1O8G3hucKxVwq7wwZImn3rzlX2p3MvbHeLrrJ0NnlDsEaTwHS4Q6zzFHSGKHEGxwFQAn8mD1A4CEULHR5utg70c+5SvpcPBwDRulBAl1YVyuiG0lQXudeFRPjGil0p6dBb5dVHM6sDa+2bhTnT5Xrs6ALFkSOC2eT01f34o0LD\/iYJpYUBbRpunp7qdsCEujVxZR8n0k581k760zp6eOKdldSwGD2zCkU49qbfX71ampz0Sa7apdvaSE3KDX92BVUqVgQf0FXIZml2UETl7GkuJ7ywmJNZy\/VBh5fwF2G5tkeqqgUFl6Pz5ffSKavNMdYdiF0oJdwf95BiDLfhWMFAZ\/Az1Qj25O939c39zHdQmU2Gk65JAtVnlAhmcxyqDVZJv7WCLyYv8x3gCNb27V5dMzb8gu1mMtVqxF0t9OtLhe0ZVbT57TWBzaMHvBs\/e9XYiw9V9PDcm\/ctwDNyy0pJxMD8+96LUABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk"}
02362{"flow_id":30,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1229,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792258,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXU9YVAAGwG0EM0ck06wKgBBgG77IG+FZNLYAjihlAQCAQo4QAAFgMDGEgCAABeAwNemFWSi85YgqbyA05fMdvo17qEAY3DOTMZeqDbOUD95SChIgAASQAtxsG5t0TCS1OXbpDRYVav0tO\/D6HKZ32c0sAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsAD0IADz8ACYEwggl9MIIHZaADAgECAhN7AAHtTIoklILl8snvAAAAAe1MMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xODA2MDQxNzI5MzhaFw0yMDA2MDQxNzI5MzhaMCcxJTAjBgNVBAMTHHByZXNlbmNlLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzd1dyBbcL1ouyZc1UdemSm9CnloxPnQTIeZLR1he8lRQvhBQVKxfoZoWvWAgp8wCNj9FcelfIQY2UgCBdwBETmO5UeujVxE0QZIDb5rVqW5FZPmQZ4mSf9dQd8nYJiHOsCXg7VKhlSWmlmABvINsEiUlQtqKUVMLKl1F3DJkPxvKoyERAro478pQZmhTWpMtaPTfE\/9wgv5CIMz7IIc754mpDtWu7uxDeZq8naT0uapTms3uRJw6GZoMWs7Ocr5FkqzwAuBf1wUqd\/zQe6kiVFYcp8fGqoDFCCXXTTCtlQkdF14RWghr01zX0BENxz1KnKB9ovhkF+3txIpaJcy+rAgMBAAGjggU7MIIFNzCCAfYGCisGAQQB1nkCBAIEggHmBIIB4gHgAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFjy+IZ7AAABAMARzBFAiEAs484R9Yj60CO3mFVasNRtmgHaup\/goj7nKmGFN3U9H8CIEAii6fEY7Q6xS8h\/sSiovfxzt49EnY9tPqEVXHFkS+HAHcA3esdK3oNT6Ygi4GtgWhwfi6OnQHVXIiNPRHEzbbsvswAAAFjy+IYJgAABAMASDBGAiEArTIFsF+tMP2\/rA04mlXhOCG2170YU8SEakO33OteZGcCIQDIwi+qiQxO4vaaHnOlu16LTa\/KmMefFRQW2aL5kR5ETAB1AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABY8viGDEAAAQDAEYwRAIgeF55y6kXo1SnVzzeCG6K86w2jHAfJiDWCIcH1BYK8zICIHnc1sbCynkaLrnLCpfbIAmSl7ti0P7iKy\/uALUZyIdqAHYAvHjh38X2PGhGSTNNoQ+hXwl5aSAJwIG08\/aRfz7ZuKUAAAFjy+IaGAAABAMARzBFAiEA23b9nIOsqhopDEUhqBGkl9OvsOnzEq925G3JnF2RIrwCIF6dgum31POwnJ+Iq3lUdURus1zHXhmtCkThw\/44vt2mMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQU7Qtd+Lyn5Dj7UiJ0I9VO"}
00424{"flow_id":30,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792330,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG92nAqAEGNHJNOuyBAbtgCOKGvhWTS4AQIADgbgAAAQEFCr4VmPe+FZ6j"}
00409{"flow_id":30,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792347,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG93XAqAEGNHJNOuyBAbtgCOKGvhWeo1AQH6W\/TwAA"}
00408{"flow_id":30,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1232,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792430,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG93XAqAEGNHJNOuyBAbtgCOKGvhWeo1AQIAC+9AAA"}
02379{"flow_id":30,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1233,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792460,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXU9YdAAGwG0EE0ck06wKgBBgG77IG+FZ6jYAjihlAQCAQh\/gAA9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQU9kInIFSIlBnF7lkM4zZm22FFWzAYDzIwMjAwNDE0MTczNzQ5WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewAB7UyKJJSC5fLJ7wAAAAHtTIAAGA8yMDIwMDQxNDE3Mzc0OVqgERgPMjAyMDA0MTgxNzM3NDlaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTUxNzM3NDlaMA0GCSqGSIb3DQEBCwUAA4IBAQCIRylfjiknvnxXs2D8t7+6D6TkrLlDwFapINw8x6fmlyqRJ2q9BzUNYJF3hLh4kATN3GTPBagXOPj\/a6h1yuXV4fVtpwe0iJ\/0IGIY6w9B"}
02369{"flow_id":30,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1234,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792564,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXU9YhAAGwG0EA0ck06wKgBBgG77IG+FaRPYAjihlAQCASYlwAAvzszdpO9SI0+GjwRlhLHsPDA1ObNqfw9JA+vzk1dS\/Iv21FWLOtm+mgCJWpqgX5uFLTsEGAnCvYUw4KjgqSD9ex4FGfSKOfFUnXUe3Fz5Uk8bbR7Z7Z4+5Hb3z1o\/YnZDnxkrf+7mqHD+M11vCshIL4YS+DqvxauIUZEwbTANGdJA8VwJ\/OhczonpCdMqnB8XEv1NsWsO\/ER8mucYquKFKwBL\/aHmUPSXSqom1rrZ2KEoIIFIzCCBR8wggUbMIIDA6ADAgECAhNhABK1vVbJe1vazzKFAAAAErW9MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDAzMTUxNTQxMjNaFw0yMTAzMTUxNTQxMjNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm9PunaNFnz92aO8d4uH\/JCreP9UtdnH6Bv3+BjNMnU24H982v4wslFnOHRkeShM6dTut2u5yX3USK4TkHudmdpKCKlumoSspYbuV23UEmjEltXDdzSNYmzvQDOeZo9DyTtm0W9OcExDRacHKdHUSDCgp3idEbMLCXgoMPdcvciqUfRxxhpKEhzK6GRoNAmVI08HM6jLw+02rMYbuyQPnLJfaPIm6evkoCU6o9RORAng09ayQuSk72b1zEpJKOvFaK23Mnnwwb4jg93GQDHKSDRfL0BdvvWgSpMuv5U2HffFgVxCm1wKQl69Wj36qXQLZ2+wxv0swlG5nuGABQ6me1wIDAQABo4HWMIHTMB0GA1UdDgQWBBT2QicgVIiUGcXuWQzjNmbbYUVbMDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZjmdhpwvUwne4YtRiQs3dOLK5ba63GxG4DhqLLccO6A\/Gu5C1WAliMVEL8laAmZT5rjg7rZU63ADlU6i5dqMR9d65Gu\/P9sbyDYjevTB8j4VU8zV1e45gmS1fnTxH\/L14iqqM3+BWmprexDyUCWsXRJxp70y2N2YVZOquaqZFIwT4zprb8MBujdP7iFkk8soOpf\/l5U+mse\/W63G1wria\/aCHeEKWVe5F2v21NaIvfUgT9wStvUyhVk\/6WDBFypCre8c05o6zB2kA3b8eGeE56uGm26VL14MWExRNwnneVTysASyklJztTJjKIJiCZ7UsldbRUSdIVZyB+rsUuFxEs2yfP+8euVoeKkH9FEh8fTVfqGv3pafupuN0u\/\/dLN4soa06DNvTDUQWkRRbO6el56U4uvdsc3yBYOUpCEfZdmlCUuiesiTGTZKjg6Pel9E6aM1lPKUoFEgORCSp0t9xzpsHahiQos2LCym9Pi5bAvWTLeT65NzwDYJWd9xkcPSHaqNaXxrfEmnDhHqFEHA0H5fZSslXa7f\/DeJ3nBxZ+H4M2s+WWZ1FXymQaVNiFwcz61dh2ni95gdfAdhA51nQgJKXcgCvW0sx8AMX+76lmXRTxCd"}
00409{"flow_id":30,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1235,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":792597,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG93XAqAEGNHJNOuyBAbtgCOKGvhWp+1AQH9KzygAA"}
00973{"flow_id":30,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1236,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":802460,"pkt_caplen":467,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":467,"pkt_l4_len":433,"pkt":"KDc3AG3IEBMx8Tl2CABFAAHF9YlAAGwG1E40ck06wKgBBgG77IG+Fan7YAjihlAYCAQZjgAARB3NUS9Zk+plCHydbLwht6fHuAcJFjDcQTuMBm+4m9NXfOoK2aCNAEf7l1IMAAFpAwAYYQR6tpUy5NXM+b9iM+cFYLOVoxfQQZAdwAwBnNQmG89SfktKZlW1KIl1BTCDvw7+QCqfKCn71umzwivv\/OxwflljmAtGVmYZEXl72dfa4QN\/9Zz78swbEJx7nM3\/Z4J6EI0EAQEAX4hrEkMZswhAd4kvFhrJWBKypARC1W\/VDRiL9L2a20hFHCbF63QBpCSoqAZ0cIMepddQpbkm67\/2TOnsGaqPw4Ay3HFBScGNfPK8cYYSH6skTXrDeIptwlk8Q18J1h37eiUbcJM+0Vcn6oALdz+\/oknqpott++0+3AzjceHR7Y\/M3JXD5iAuqZVpz7ieAg+lETDEi\/Zeh8v8R1D\/F6nHSzm0TVWSvPEBmPA+O3DHRvMGghrclcEQpQ+pcrVPxOH1Dpfvugnu15dQI7Izh93WH1cJKVYwlyVc0Nbkw0t8XvQm0q++3QqX7Pd9c2ycMnVUvXc++SHTEQiUFxLaTWWrLQ4AAAA="}
00410{"flow_id":30,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1238,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":802547,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG93XAqAEGNHJNOuyBAbtgCOKGvhWrmFAQH\/OyDAAA"}
00626{"flow_id":30,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":806046,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAG9tfAqAEGNHJNOuyBAbtgCOKGvhWrmFAYIABmlQAAFgMDAGYQAABiYQTSMCeEivTxD3Uoj1CdT6hnMeYe\/myCoo2If6kFa6BybMIfvoTvwWLHChyab4ek7OlUsui82X66GcwpE7Y\/aYMptrPdMlXK1hZpM8SFPp4ImRqqH2stb3E18rhOlY6kH5gUAwMAAQEWAwMAKAAAAAAAAAAACbY+n28jW9Z51qMsjh6WbX8j7sNwJiUHj8kay0XL5hY="}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1249,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1587041682809,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":809173,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+gHAqAEGp2PXpOyCEVImrEWfAAAAALAC\/\/+rgAAAAgQFtAEDAwUBAQgKMISwIQAAAAAEAgAA"}
00426{"flow_id":31,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1282,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":852443,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtBAADEGD0WifRODwKgBBgG767gSqyKIi6a9ZYAQAWh8ogAAAQEICpHNoxswhK\/j"}
00426{"flow_id":31,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1283,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":853827,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtFAADEGD0SifRODwKgBBgG767gSqyKIi6bC+YAQAWh3DAAAAQEICpHNoxwwhK\/k"}
00426{"flow_id":31,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1289,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":854555,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtJAADEGD0OifRODwKgBBgG767gSqyKIi6bIjYAQAWhxdwAAAQEICpHNox0whK\/k"}
00426{"flow_id":31,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1290,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":854567,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtNAADEGD0KifRODwKgBBgG767gSqyKIi6bOIYAQAWdr5AAAAQEICpHNox0whK\/k"}
00426{"flow_id":31,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1291,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":855429,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtRAADEGD0GifRODwKgBBgG767gSqyKIi6bTtYAQAWhmTgAAAQEICpHNox4whK\/k"}
00426{"flow_id":31,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1292,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":856185,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wtVAADEGD0CifRODwKgBBgG767gSqyKIi6bZSYAQAWhguQAAAQEICpHNox8whK\/k"}
00437{"flow_id":32,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1298,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":862686,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGBganY9ekwKgBBhFS7ILLfLe3JqxFoKAS\/ogNbwAAAgQFrAQCCAoTeRnVMISwIQEDAwc="}
00424{"flow_id":32,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1299,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":862738,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyCEVImrEWgy3y3uIAQECwqYQAAAQEICjCEsFATeRnV"}
01123{"flow_id":32,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1300,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":863165,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"EBMx8Tl2KDc3AG3ICABFAAI5AABAAEAG+AjAqAEGp2PXpOyCEVImrEWgy3y3uIAYECxutgAAAQEICjCEsFATeRnVFgMBAgABAAH8AwOllRwzFBLD2fGS0RdMQwmyeJX+rt9niSTc6LgefMaOGyDe8bvsDQaKZ\/SHTClTSUEpcKfm8tnRcB\/XxmDM4wjf0gByEwITAxMBwCzAMACfzKnMqMyqwCvALwCewCTAKABrwCPAJwBnwArAFAA5wAnAEwAzAK0Aq8yuzK3MrACdAKnMqwCsAKoAnACoAD0APMA4wDYAtwCzAJUAkQA1AK8AjcA3wDUAtgCyAJQAkAAvAK4AjAD\/AQABQQAAABIAEAAADWRhdGkubnRvcC5vcmcACwAEAwABAgAKAAwACgAdABcAHgAZABgAIwAAM3QAAAAQAA4ADAJoMghodHRwLzEuMQAWAAAAFwAAAA0AMAAuBAMFAwYDCAcICAgJCAoICwgECAUIBgQBBQEGAQMDAgMDAQIBAwICAgQCBQIGAgArAAkIAwQDAwMCAwEALQACAQEAMwAmACQAHQAgvrFq4xkMZjK7jeeGFDXjFBVctkvDk2bUa2GIO\/qlb3oAFQB8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00847{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1300,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":4,"flow_first_seen":1587041682809,"flow_last_seen":1587041682863,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"TLS.ntop","breed":"Safe","category":"Network"},"tls": {"version":"TLSv1.2","client_requested_server_name":"dati.ntop.org","ja3":"7120d65624bcd2e02ed4b01388d84cdb","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
00424{"flow_id":32,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1344,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":917091,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wZNAADQGRHqnY9ekwKgBBhFS7ILLfLe4JqxHpYAQAfo2WAAAAQEIChN5GgswhLBQ"}
00634{"flow_id":32,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1345,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":917561,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"KDc3AG3IEBMx8Tl2CABFAADMwZRAADQGQ+GnY9ekwKgBBhFS7ILLfLe4JqxHpYAYAfqVNQAAAQEIChN5GgwwhLBQFgMDAGACAABcAwNj9DFW90uUp62kpYH0gZzusgJkAmnNdPklOGghCxgYwCDe8bvsDQaKZ\/SHTClTSUEpcKfm8tnRcB\/XxmDM4wjf0sAwAAAU\/wEAAQAAEAALAAkIaHR0cC8xLjEUAwMAAQEWAwMAKMmzRIH47MLZIGbvoCJbTEvrZpOUBHnePc1mxcuJT5HZCR1Sfyp+RIk="}
00901{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1345,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":6,"flow_first_seen":1587041682809,"flow_last_seen":1587041682917,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":669,"flow_avg_l4_payload_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"TLS.ntop","breed":"Safe","category":"Network"},"tls": {"version":"TLSv1.2","client_requested_server_name":"dati.ntop.org","ja3":"7120d65624bcd2e02ed4b01388d84cdb","ja3s":"410b9bedaf65dd26c6fe547154d60db4","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
00424{"flow_id":32,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1346,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":917621,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyCEVImrEely3y4UIAQECcnXwAAAQEICjCEsIMTeRoM"}
00494{"flow_id":32,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1348,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":918603,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"EBMx8Tl2KDc3AG3ICABFAABnAABAAEAG+drAqAEGp2PXpOyCEVImrEely3y4UIAYECcphgAAAQEICjCEsIQTeRoMFAMDAAEBFgMDAChs678blRqlXKUex844yXqkDF719MGcqIK3P4stu596NYJ2PZbeVYuz"}
00423{"flow_id":32,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1413,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":10449,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wZVAADQGRHinY9ekwKgBBhFS7ILLfLhQJqxH2IAQAfo0+wAAAQEIChN5GmkwhLCE"}
01723{"flow_id":32,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1414,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":10530,"pkt_caplen":1021,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1021,"pkt_l4_len":987,"pkt":"EBMx8Tl2KDc3AG3ICABFAAPvAABAAEAG9lLAqAEGp2PXpOyCEVImrEfYy3y4UIAYECdxHwAAAQEICjCEsNsTeRppFwMDAyds678blRqlXbuRkaoWIOM2vBK\/GiLY86XxBxfqP2D9sr\/G+ZebOQIk4724QYnkThDJTDT+SIF1KwECFCn4YJGmBvPPD6cT55yRvc8XE38Vr\/8zBRQp7n+c\/Au0fPrtw9bDpJJd9UeieHzdSWcUDImwRxVT0FTXAUVS1q6l2t24ZuMwyiSqWAETyapm6EjUw3W9YjYlauUHoKHEOk4HSxUeAMxfHZoCPis9OD+mT33JU821vikltW8KJsyDg1Zbk\/tkjXx06bZhBQzTnmtP0Gpp7t11FTTMWRXohDGFBqqBkduPCIqattSO1m7NKgMd\/CgU3UJ2gyplvgAbPBMwlHoAqY\/7Fq4Anq2ykULypnGECEopo50xq48UHO+KctRkiHcBylyjqFBvEhuFEJbcRnkLhPe3qMy4qjFfWtGrLMJ0k8Y+jZvQhAk0FLz6TJWXCBF9d4V6usLGQmdTlgdkMb9ZGneN+pFRibhDwufvOZKosVuZeBZ+lfQZD4oO\/izUcbqdo2OV8xTYa+JTjzuWsWWrQxEbUClcHWjZi4\/QYMAoxtNBcJtn5h\/Rrkwz1N+8W3EQOeA6hzKJOCqlUjJSmxoQg3WDrxX5xMq6M7QhXPTuWx6N+FWBcGM7CXGJPBVWx6q2tO+06hI0k7i9stdhfXnR4SJWgDYRcCHjbkfxF\/xi7knd5hrgJ1hgqzpOe8g4IdLYBQZescm0TT3+I2QQqbJSZfLeNk9C4lXGL8XEQIdSOO3NPZqxBW3Z2XYN9x0gsuwIcyL3JL3qPeCBNPebepaO+X1ILog4q9HLPNpxwHjba7V\/eONksadHNQf1EakVi0FsRDJYf\/9uYLkoaMyLrJrK6x3qMsKak7VjHchh2RE1x4Jc8nvR7fuK7dw2ryKEzLwuSQYonC97QkyRxTbvud\/azxX8FCPmrJ746rH1kA\/OnDsXsVXC5vtae07MTgRuXJq7V7i2cOG\/Z\/np0eGkIi0h1DxYUQjALZAq4PilfeTMkNS+3FlPtvrG1BecEcIiMR6q7bLuh7OneBZW8WtO1DPUkpcCymgUV1R6IWD54osy1iIwL1FDjX8XAwMAimzrvxuVGqVejT11xPUN5B57ybelp1+nEDUKa54BxJUtVQ4A4BERq5T2cklQEPuisHqaLniF816V2\/w3XYnBrvKKu65t4Yk1fHp5PM7QjtnynVju5kKLEoAxED368fEEqEd7CSCaOHYz7Y6ARtfqhgDYmoWH77vOyeiJQ0OhSI09ayWgsbp0VHQnAg=="}
00424{"flow_id":32,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1433,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":59472,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0wZZAADQGRHenY9ekwKgBBhFS7ILLfLhQJqxLk4AQAfUwvQAAAQEIChN5GpowhLDb"}
02085{"flow_id":32,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1441,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":134358,"pkt_caplen":1292,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1292,"pkt_l4_len":1258,"pkt":"KDc3AG3IEBMx8Tl2CABFAAT+wZdAADQGP6ynY9ekwKgBBhFS7ILLfLhQJqxLk4AYAfWd3AAAAQEIChN5GuQwhLDbFwMDBMXJs0SB+OzC2msrk3HDfuo1F9oSu2tMpdc5amiX3sP3+HF3T+eUlrMKwLu5vpRX2sY6Qgb2AfcqUJbzNahAcjl+AgBrxnDW3IzmBx1GjxIf54xU7CDOWBB6h2asl5Y0jc+NBtT4wwHKlGK7aTIDJNKtZpQBrtKu+wC1wThAEhnwiJCMcZrlw3JmUaM8hAcPWiv+P2f4HU7kVuR6SWFtZOY\/fBG6AA4hICINInUXNSPR\/9S0jS0+Tu+TIJ\/unj8qEMubqIQCh\/V448Q5nnpg+m97oZrqoHkU1CldcnFv99miigRKhMTB8UhJojHRmQkNNuSqkYUg1wt2+YPyuyggI93J3CSs68a0sNXTEXI8hPLWv745fuMVK+GzYpn3QIWpwecAc8ojwFk3sYFYGc6Kr3niKjvleeE9wyMd31MixrWRPeRyiEuUWD42A1y13fLADAszjc75ai96VXjLbCKwl0noyJq882kPNRilUNVn3DopZ1sxVJmeonQsuho+5bzSM5XTbWli5afK8uq4VkO1JTnH+QCaWxMcc3coahz2TQstp35Riylbla3PZIwtYbAltxp9HvMr2YRvetAhN583PQgyTcSglBA9VLQMuqlDS+Yp5l8M6wZyJzO21eJigfJi1o\/n0C6Jl9pe7P96S2qxZwHKbeC+ollOwzuEsW6W2euMv5Bty7uHkH95xBMzwiarDmQ+o1Ei+q2YXDkKmEFKmLcmSoD1gJV0NJfr5r7g39mk42G6pLB1NBDrBN71b4WG1g\/5u0a3rqw0V9i7QnL9BlX8fxEEmTnz9iZZ3YLsygkbuA7AHtVSjftrngTxt6ZxhwkU\/9bPSsV5zngK7DqCVeqwznry2Ak1K69ATi4hxBM6vJm4J5azYrQKBdtWCpMP6MD86FiPSrAXBunH0b4hPq5tzuqdO0D+jBbTb4Wuyuo2mJh3Wdi0GgAny77koSTNopgL0vMBX\/vxnEJDucvwdPHZyocOBrw+JRn9zmCrcQ0Y9Q0ezNl4QGHwMISpDuDI3rn5Latk4ocMu5N0vMsbOO1\/gQG9gmVcYiZsj3DHKbeczYMtV72zfzt4zMH0+e6uu8iTq60uJMXwyI30UG5fzVxRJ4j\/UD4W6mchwCwMr6q8+gd6YplByjwds617qOLrlHt36ra5Pk7X2fO+uom00juBLnsnSYzThqYa7AtStu7Ns8fxifn\/O6P+gzFrmtBjaHQA\/1xx17u3yi7XFhplKfr0jTUgN4p9G9TDE1YDvXCLgzdejZdoinUNYt+hdtAOR181o9OXHQQ+xZ\/Iv3h2AhVNwBkYN5nU8A1alX8Z3DnlAKQt\/+z+XcHUI6niPCc2ejcpuzXcezHBSBFte4gprIQQh03wzDWXI8qpvQafa7vTvNS+kOicPxL+ziFk1R29VK\/Tlcj\/S6eX9KExxqzooyHpqkZQzSaFvny7YFcXNSIa65RZq2MYCDgk\/dnxWHjsRaDEqCSAKbU2Fq986vwayL1+sL\/Zf1k26dI2qd3cUitCRLJhXhcARrcLsJcnB0d07VW1y7nmsSoLB3uoEg6LNbIgzreGXNOpkcDmj7mkRp8bmBxNM5VFiS++mkDQD2K+9dRHKpWlfUBTooQQQ3cD6RayBt1mpz8="}
00425{"flow_id":32,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1442,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":134460,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyCEVImrEuTy3y9GoAQEAAdJgAAAQEICjCEsVMTeRrk"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1443,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1587041683142,"flow_last_seen":0,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00460{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1443,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":142905,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"EBMx8Tl2KDc3AG3ICABFAABOVgkAAP8R4j3AqAEGwKgBAeCgADUAOmwyTTEBAAABAAAAAAAACmNoYXRzdmNhZ2cEc3ZjcwV0ZWFtcwZvZmZpY2UDY29tAAABAAE="}
00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1443,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1587041683142,"flow_last_seen":0,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":50,"flow_tot_l4_payload_len":50,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"chatsvcagg.svcs.teams.office.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00635{"flow_id":33,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1452,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":184989,"pkt_caplen":222,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":222,"pkt_l4_len":188,"pkt":"KDc3AG3IEBMx8Tl2CABFAADQTcNAADkRcALAqAEBwKgBBgA14KAAvAAATTGBgAABAAMAAAAACmNoYXRzdmNhZ2cEc3ZjcwV0ZWFtcwZvZmZpY2UDY29tAAABAAHADAAFAAEAAAAMACoVdGVhbXMtY2hhdHN2Y2FnZy1wcm9kDnRyYWZmaWNtYW5hZ2VyA25ldADAPgAFAAEAAAEsADAWbXNnLXVrc28tMDEtY2hhdHN2Y2FnZwd1a3NvdXRoCGNsb3VkYXBwBWF6dXJlwCnAdAABAAEAAAAFAAQ0clg7"}
00695{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1452,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1587041683142,"flow_last_seen":1587041683184,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":180,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"chatsvcagg.svcs.teams.office.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.88.59"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1453,"source":"teams.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1587041683186,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.88.59","src_port":60547,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1453,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":186164,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG7FzAqAEGNHJYO+yDAbslAEUuAAAAALAC\/\/+uKgAAAgQFtAEDAwUBAQgKMISxhQAAAAAEAgAA"}
00436{"flow_id":34,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1454,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":220355,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8HR9AAG0GokE0clg7wKgBBgG77INQlxoFJQBFL6ASIAAufwAAAgQFoAEDAwgEAggKAdQEQDCEsYU="}
00424{"flow_id":34,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1455,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":220462,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG7GjAqAEGNHJYO+yDAbslAEUvUJcaBoAQEAltDgAAAQEICjCEsaYB1ARA"}
00728{"flow_id":34,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":220741,"pkt_caplen":287,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":287,"pkt_l4_len":253,"pkt":"EBMx8Tl2KDc3AG3ICABFAAERAABAAEAG64vAqAEGNHJYO+yDAbslAEUvUJcaBoAYEAkhLAAAAQEICjCEsaYB1ARAFgMBANgBAADUAwMl\/B1Vk9A1CXIA2wtxg6SSBUkcTlC\/1\/z0\/eteey4O7gAAHJqazKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACP2toAAP8BAAEAAAAAIwAhAAAeY2hhdHN2Y2FnZy50ZWFtcy5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAAEgAAABAADgAMAmgyCGh0dHAvMS4xAAsAAgEAAAoACgAICgoAHQAXABgAGwADAgACSkoAAQA="}
00753{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1456,"source":"teams.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1587041683186,"flow_last_seen":1587041683220,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":221,"flow_tot_l4_payload_len":221,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.88.59","src_port":60547,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"chatsvcagg.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02359{"flow_id":34,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1463,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257226,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHSFAAG0GnKc0clg7wKgBBgG77INQlx+mJQBGDIAQBAUMBAAAAQEICgHUBF0whLGmFMuT5WpzTDiCSYT3xi9v6V14KwZXMAsGA1UdDwQEAwIEsDApBgNVHREEIjAggh5jaGF0c3ZjYWdnLnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDEuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBADlaSLft\/Il2mfNfS96UN1u6SRdI6uOdxV\/SghC34ek6RV73kkGH\/KgGm5Qpn7ZmjaE7sCW67DpV9CSox9Z3dhmyY3WubiTFoRkhvmI2ia7VsKC3uTVFKGfcG3LipFC\/23JDrzT7qcdgDJzOLWf3MLJd1Kyh6NVC9EjRBrGrjji8xmok7R0RS8CcrVoIMxOsb4aFIvlKHgOLGwrUEg+jJK1WekigAR\/pyb5Ve0qqD3wvtdis9OWT8zz+JfQQtYBGzTf3Zo2YdFfy+cLVdoneW08GcCeeO0e+2qhhnfoQYTUFxVDlSKesMCCZ19oghBpnMirb2zEgWNe+6hV0VBHo0qa0oI+8VxV0m5jsWGKpN5r0RSQeZVBFjmNPja7EWAv9BG0nDBvzPaTNS9lsRoXc1ue7UQ2fGyQcImPgttcAOrqAGM9U+s0UrVqPi9GRGdpB+ymstXnktW0UVXqemudrGvUxOJRKDRvwctjZP2On9XpkEuwYzeJ7edeTKIXaTMPr5bSi6KtPMv8scypPxl6auLwwuyW3phPvh3sr9vdYmG1LA+UpioWKxGVlTy3H5MrR\/a3CRRhXX1OZmYh1RDRwmACanys8duLXWdgmjDNNxzIBOXG7wiGPQfS3+9iG0JTdXjbTpu3jNtZbvAVXCu9kow13tCXvpYdCShakHGed8k9wAAW4MIIFtDCCBJygAwIBAgIQCLh6UBu+nNotFk0+OVG\/VTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTE2MDUyMDEyNTEyOFoXDTI0MDUyMDEyNTEyOFowgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSAxMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjvPxhHV3vL7JpPUWpVMrUGCZ3Nh92SS14XJJN0j+2oaTo30dmksQTXd5fmWpfG424kfUNknQzCQCJxTirnHN2Vd0PBBWGZJKh2L545CNXt7RQRsaph9AoiwejlXXJthoQqvsDd7dXmGVs6xsgc6o4K2vX8qm5FFoLif9VCpxpMy7fpLx9lNRBTHQGYKwymPQ8koAC830aUv0WpZWOSbJnUsKYzQy"}
02360{"flow_id":34,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1464,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257259,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHSBAAG0GnKg0clg7wKgBBgG77INQlxoGJQBGDIAQBAV\/qwAAAQEICgHUBF0whLGmFgMDF3UCAABeAwNemFWTX+wdGNX8oxlCGUFyPvBvLhwa23SJPmbGfiAFTSAKNgAAYI5Bn7yZok1NjyjltU+IxFQsPzvZ6TxxnxJ15MAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsADo8ADowACM4wggjKMIIGsqADAgECAhN7AASlfowIISvJ5X2hAAAABKV+MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xOTA0MTcxODA1MTFaFw0yMTA0MTcxODA1MTFaMCkxJzAlBgNVBAMTHmNoYXRzdmNhZ2cudGVhbXMubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANU1qnnBvmy8C7Js4SASBv8VhKovjO8KWcEBXJYH+nL92c58HW+\/O2tD936VWFXybN3aygUEbfsRDQxqdr4H5fX4AK7vRTgqqTK30Q27pyykcZLAPNVHl5CT3BDbK26mvB0bkclFS5N7mn2BO7jTdrLK2tIK5SlMnU69OwQAz23VGD4+wXMnI6UljEmHMh9LFdVrr0t79PNKfbfZYvlADsP84DPPW08tKNfSqe7UKmsJ7MMYbT0CJg98Hydo0keIWo0LvEudSSFVo66eTVpzBQ+lF9+LHRn3b3pHrs5Ur09HenhHW09yEF7fSCpJVCA4GnB+ZE5zHw2TzKxckD2Fv50CAwEAAaOCBIYwggSCMIIB+AYKKwYBBAHWeQIEAgSCAegEggHkAeIAdgCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAWosgo7HAAAEAwBHMEUCIQDxsZNzYkLbM868bD3SMkNLWXX8lEALfvxqPoQGY5x2tgIgDEcJW3p8o64LKSWQRQ0+hsJn1\/JDWZihSsbo+ExTPccAdwBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWosgo6rAAAEAwBIMEYCIQCVNmWzXEcKUnDtdzYtY1zrJRprglbAs8n2Ye0VfgyrhAIhANdbj8+fopl1sUicALfp38YDI4gwAAs5\/Cl8K38eMOLqAHYARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFqLIKOrQAABAMARzBFAiBZfs1DPFEJiU6\/3XIJfgFRhP6k6Nx0f85Q3SaNv1cmwgIhALcW2jWl+eD\/\/wQgRUpHHHxjIdpbgQykhNksyH6XUpOWAHcA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFqLIKOwQAABAMASDBGAiEA3F7dGIpug0aCn6LwM2SYyuKjt9KzmSMxBdPRBbC+H2kCIQCd1JR1wwjqsINPZmZUwAHCOJo7tLF4e9bN96ALAzkBTjAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYE"}
00440{"flow_id":34,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1465,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257321,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG7FzAqAEGNHJYO+yDAbslAEYMUJcaBrAQEAlP3AAAAQEICjCEsckB1ARAAQEFClCXH6ZQlyVG"}
00424{"flow_id":34,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1466,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257341,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG7GjAqAEGNHJYO+yDAbslAEYMUJclRoAQD69hCwAAAQEICjCEsckB1ARd"}
02372{"flow_id":34,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1467,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257449,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHSJAAG0GnKY0clg7wKgBBgG77INQlyVGJQBGDIAQBAXjtAAAAQEICgHUBF0whLGmgKUE5eoot8EAwG0a8CjUSo+ArHMZ2PUWL62uCJdiBiz+56XwrUFTf40rMcMUcyHd43hjnFGGtaJIScB5CBVDACuZuEvgx1cHbMS5plQtAVPyo\/KkzNnBVPOIzeRME9OKMyFYrRi\/vjmBcDlpN\/hbpGPvCQffhxpix5oIxdEdXmJ2Ad1p5ji7RLAtTTrGLoDgYHJb8szmjlw6IR5dsDkrveoTy5bLtmp0jI68DhCfG6VAQY+RXHanDvGqOoe3DHffcWovKGFCLZAPcgWrZ+DBe8ucQJrECghEjHw9uqkOHrHZIr0fX0Fqc1T2ZuKg+aY53tJ382kEv7e7PMST\/3IEHLU2nWh\/3\/o5T7L2j7kc\/63tDhUI44Z88khJd5cW9v0A9k+mXm\/nOcBRZT3rsZcw7Oqec\/weLKDfi89zX7UOBkIXJpXs2Kkn0NBllFziP8ooKaUg9MjdXbT\/5t0CAwEAAaOCAUIwggE+MB0GA1UdDgQWBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTAfBgNVHSMEGDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9PbW5pcm9vdDIwMjUuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAwmsadav3vkwgMvoJ3+XagbZ57MCN7qCla9Go+xwsMlt+4S1LkDZw47XhjtXPAHB874Kf\/f0lRlTK40Jup5c+WA4GA1UphGP7Easbff0FGIpyAZusPQqDk86Qho5jQenT2jOjD0iuqK84RWRlE51wHCULr1\/0VTblvbEQ1Joe6oztosIHnIMl\/EwLzzKufHJVQy65kgLuHCl3OpmuyfeM9NuIpUbcl\/NAJ47CtxGIuPn6FJrL2r\/dtMXPGGZipcpMCzsoLPTzs2XDogPUWq3hqh03GgTeoCnaBBqjvF2B8cBATPDjXM0zkN2UI+5Gz6BZ2YSpl9ViUs0UB78BPA3u4FgAHKwEABycwggcjCgEAoIIHHDCCBxgGCSsGAQUFBzABAQSCBwkwggcFMIHHohYEFKkocFEZlQPiad8y5tgPkAlcmamAGA8yMDIwMDQxNjAyNTQ0MlowgZswgZgwTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7\/hIjo5oX\/+n0CE3sABKV+jAghK8nlfaEAAAAEpX6AABgPMjAyMDA0MTYwMjU0NDJaoBEYDzIwMjAwNDIwMDI1NDQyWqEiMCAwHgYJKwYBBQUHMAEGBBEYDzIwMTkwNDE3MDI1NDQyWjANBgkqhkiG9w0BAQsFAAOCAQEAkGxsmza8HqjkxFu7fydx0ZQY2Ts2Q3XgK1QTnlIVcXA6yVF71Th6Bs6ddQUMT8CTHijCpil51E3l70RSv5s5rde5Z8ZVKMXa8mIkogfqr3DRAHn\/BytRPIlYhXRed6PUydmPy+AnclMCFNY9PsclGVwJiqAmPwKowiQOkIXcJCt6lrTVSmJg1chg3e3YO8b8kngQu57XkPbNe2kp7gmgIbvqp96tOBCHXPw44cD+VRZ5zAp2fIDd8arqy8uxsJ+5lEn0nfbTVio2gUhWe11pXWdKkW4qcIcdjuQaFk7A"}
00425{"flow_id":34,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1468,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257512,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG7GjAqAEGNHJYO+yDAbslAEYMUJcq5oAQEABbGgAAAQEICjCEsckB1ARd"}
02370{"flow_id":34,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1469,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257569,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUHSNAAG0GnKU0clg7wKgBBgG77INQlyrmJQBGDIAQBAVOzwAAAQEICgHUBF0whLGm9N7RLZxEmshPicngAt8gk1329RdLuJJIty\/fggAjQzUUQaCCBSMwggUfMIIFGzCCAwOgAwIBAgITYQAUmqeurCw6NqkXTgAAABSapzANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwHhcNMjAwNDAyMTcxMzMzWhcNMjEwNDAyMTcxMzMzWjArMSkwJwYDVQQDDCBNaWNyb3NvZnRfSVRfVExTX0NBXzFfS2V5QmluZGluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJtZmgzNzR4HQBoCasm0a5liqkiihAGL33a02D3zqSPRUa89chUdeBktHuFAwdqyg5ZyrLqPREX\/0KqZuCS\/Ery9Kbo5p+maHhsztreU6jExApFqG9bYi0ANSWDgPEUSyr\/+kLLyczF9KjGxRzQaOLIKwF6DLlo2XKlsR+H8q7AWXYHNJsKbqGFZA9bzpjVsz2TIpo0DeHEjJFkANfGnycoad2aLdytDsAwnvsFkyopgTFWLmLpUldtrcjDnoJFiXObLn76Zd\/N1ChshLmaYaXCwcTZwmq3SAP2U3HHR6fSvLBfpisHqcXrX9XDA80hDf\/5UnDMPb51\/b+R\/CYyq458CAwEAAaOB1jCB0zAdBgNVHQ4EFgQUqShwURmVA+Jp3zLm2A+QCVyZqYAwDgYDVR0PAQH\/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GCSsGAQUFBzABBQQCBQAwHwYDVR0jBBgwFoAUWIif1tycSCK3FD7\/hIjo5oX\/+n0wPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYHMm0eByOkWAgFkAgEHMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAILSMNVxgXGuhK89Tr7M4L6FmnK+RmWz8B9CJhVJKpZCi6wxl9uncO\/H+qcuVbqxycrHlD3CjYqqLdGFUl1MpmqdCu85LTMXouzn0c8axDkrTBUYX+HhB1fzu\/wMgUfRZLLScLnGprZ6QyEmcVz1va69OT5Kzk3Z5VcqwDgqGH2g5xEPtcT6IrQ2stKVXLBmLu+wa2yKISs08KzRJYla0csR8Ipr72h3yRHiO90MNMays+T9ggI46vjUt6KuNkoczv2Qnl5CSCEMUiLTIjPyosQOtVFLNn+VDbmGVBPNX33eXyTWQz3o0N9nMxo4LKQm78r5wBA+Tv2amgO2EGGqt50kXMj+MtCjh1DXlq2qZKn9lRn\/UF7h3HwwIVF99CHVUp77vwizazItUXPwmbfX9LC3p9yBmo+4nyngXyDbClI+1LZIJehHanTGa3yy5ohuvmN\/yj8libRnyGTN3umWOQdsEczK2GEjUz9ZNoPiAd77\/0wJJBesgIZtz8\/nf0ZfpSA3AGl7oxndbeizEagyaWFJiyQ3cH8xHA0+tw3nWB8OQrDDsoscrsJ4nUZRwEkEAtXZnjqkW1dHUMVA0dJJhstciwAd2CkXsaVQrbY0mL7G2GxLSpqUByEEPBsI1r+FvarGG26OzyVnNAzYe7SeN5VW7NI80NGo6Xmshkb8aSKIDAABSQMAF0EECyZwb\/z8\/fVquGks61PWTsNEX00tNgEaVObOwuLa7dGZETmWEfg9xmDCkg3hS+AduBfupEdScrsQzR+cwcVUDwQBAQAnZaSsKxsVP5nw"}
00770{"flow_id":34,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1470,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257571,"pkt_caplen":316,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":316,"pkt_l4_len":282,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEuHSRAAG0GoUo0clg7wKgBBgG77INQlzCGJQBGDIAYBAXjWgAAAQEICgHUBF0whLGmPnH4YmtZOu6GMruQC257Q3dc\/8pw9\/ie7cc8j0NsI9WLanx28OKtxQVz2r+HoIpjHmE1yckU6+O7y+1gODmc08tzcI47YNCYFmYnHLY44lsk5kuYbPacslPtdaYNzzbCG0qnuLWVQvcQZW+El\/G\/hVQQlb5z3dOTDFV484qzmq8OlTbS98cZUc9rwC9hiPK3QqulatiAjRfxVJV0c0b\/qshk1CjWPxbley54TTxPeOY892DrdvM3cbiF62Im6scY3GSWh09Ooc1FfF6ot9RF9flslwdcwuCa1uwy74tyd5kpLdlfm50CD4LKaC1t\/U1oGu1c8PB5DgAAAA=="}
00425{"flow_id":34,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1471,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":257610,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG7GjAqAEGNHJYO+yDAbslAEYMUJcxgIAQD8tUtQAAAQEICjCEsckB1ARd"}
00596{"flow_id":34,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1472,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":258621,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG6+rAqAEGNHJYO+yDAbslAEYMUJcxgIAYEACBEQAAAQEICjCEscoB1ARdFgMDAEYQAABCQQRezSsAnQlWi0lqjQ4SpHGDfX17OXxqfEsHS8ZLdzsrGwBaBZFaQaUp8s6URLRqDEULI2+tuWAliD5jYvlhw6DSFAMDAAEBFgMDACgAAAAAAAAAAJnk61cTj4qNF6lQxeOyYfjOa3e0tTslesD1nI3CMPG4"}
00554{"flow_id":34,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1473,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":270660,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG7AvAqAEGNHJYO+yDAbslAEaKUJcxgIAYEADGawAAAQEICjCEsdUB1ARdFwMDAFgAAAAAAAAAAU4rtga3rq\/SDasDr\/c8RLmPqsh8im3OWQrnz2JH7mVci39ydqqhqXreT6iBJDhCtIoiv56M41zLr4M5t0Mld8g5EWihM+F4YqGRaSsS8K2G"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1492,"source":"teams.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1587041683333,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60548,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1492,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":333389,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyEAbsX4foHAAAAALAC\/\/8Q\/AAAAgQFtAEDAwUBAQgKMISyEgAAAAAEAgAA"}
00437{"flow_id":35,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1493,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":378966,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8VAJAAGwGd3g0ck0hwKgBBgG77IQbiSB\/F+H6CKASIABpjQAAAgQFoAEDAwgEAggKYR77TDCEshI="}
00424{"flow_id":35,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1494,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":379074,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyEAbsX4foIG4kggIAQEAmoEAAAAQEICjCEsj9hHvtM"}
00705{"flow_id":35,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1495,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":379360,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIeyEAbsX4foIG4kggIAYEAle8wAAAQEICjCEsj9hHvtMFgMBAMkBAADFAwNQ2mjoGM5bceT+50qedBeC2QzxBSnWB8x+XpaOKMz6dSCjQgAAk2B6jpiMP4aNnNPzeGx44\/6X3U2RH3y64O03zgAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1495,"source":"teams.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":4,"flow_first_seen":1587041683333,"flow_last_seen":1587041683379,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60548,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1499,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":406443,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1499,"source":"teams.pcap","alias":"nDPId-test","type":34969}
02365{"flow_id":35,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1500,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":430778,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVANAAGwGcd80ck0hwKgBBgG77IQbiSCAF+H61oAQBAWFnQAAAQEICmEe+38whLI\/FgMDEGYCAABRAwNemFWT1kX8u9ATY\/YCwH831ucgt0juCj9cD9NieB4F3SDMFgAAPSmx1EB8rJYwgB6DDk65Ho1qqYZPmBoFpBpgkMAwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02361{"flow_id":35,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1501,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":430816,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVARAAGwGcd40ck0hwKgBBgG77IQbiSYgF+H61oAQBAUL2AAAAQEICmEe+38whLI\/LnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00425{"flow_id":35,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1502,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":430891,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyEAbsX4frWG4krwIAQD6+b9wAAAQEICjCEsnFhHvt\/"}
02217{"flow_id":35,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1503,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":431072,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfVAVAAGwGclI0ck0hwKgBBgG77IQbiSvAF+H61oAYBAVk4gAAAQEICmEe+38whLI\/BM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdIFmAFbN6pEW7KsGaZYeH9XkA5bDQyl7+p6tUu1Mmf\/12BAEBAInrImOTUJcbCIQhdFRlAi3IWodeZq3y\/CMsb8IHyRAKdguL6HVOMPEMCjN5\/h6+bQOYvmkJNymua9YYwLCgJPZydwWvzjcG53SXOc6pk8\/Mrbq\/tArMd1+ucmZQYW7GGuy\/c2vDUTAELDZuXxWJ2yYh64vhA6mFlGcF\/DVHqgghv4bhk6A4KK64jygxjd5enDraCuJpfckEe6ASLLIW8qZDRlb1eGsVeJKluno5vSmx9sIhuYoA0jCfPC8xi\/WJYcHpQ\/+NzumoFHPo914gQZKU8AWtCe5f+AWv0f8LkMhch75nRssezrgIjd2xDyUaq9dlODpz+BfPMEMxxBygMaoOAAAA"}
01311{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1503,"source":"teams.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":8,"flow_first_seen":1587041683333,"flow_last_seen":1587041683431,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4409,"flow_avg_l4_payload_len":551,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60548,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00425{"flow_id":35,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1505,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":431113,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyEAbsX4frWG4kw64AQD9aWpQAAAQEICjCEsnFhHvt\/"}
00553{"flow_id":35,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1506,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":432261,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIeyEAbsX4frWG4kw64AYEABxswAAAQEICjCEsnJhHvt\/FgMDACUQAAAhIHlHECyVYXiIWBhXkzZvQlMWaCVu+lDMYkV1pzAo97ByFAMDAAEBFgMDACgAAAAAAAAAAM38DY8prudyLmt15rCEEidJ0bawdrQJHah5FREcDBRP"}
00496{"flow_id":35,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1509,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":477093,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnVAZAAGwGd0k0ck0hwKgBBgG77IQbiTDrF+H7M4AYBAWmfgAAAQEICmEe+60whLJyFAMDAAEBFgMDACgAAAAAAAAAABrg34hnZWwieIala85MwkRBQ90\/5OmnCY8VKC399k19"}
00426{"flow_id":35,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1510,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":477199,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyEAbsX4fszG4kxHoAQD\/6VkgAAAQEICjCEsp5hHvut"}
02369{"flow_id":35,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1511,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":478319,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyEAbsX4fszG4kxHoAQEAAbdwAAAQEICjCEsp9hHvutFwMDKRAAAAAAAAAAAUUODMzgm2m0aoacC4EX+KtbEScdeMAK8412cD4b9DmS8SjTSHKvAOmVeSGJn16AqYWZmcvQArPdqGVAa8r0muKYlib0Ph53agjTjh3CFxVN+ZYmpiK7QB4b3OXAr09AS4sL+nSfVxS1eomdRwaTw\/UyJpGEHoYRv1lG8aBkQfL4BYTfiJgzA8JJ8CbWmK\/IX1Sa9g7asV2DFYoqEJekKJNmUfy8Okwx+V812rmCuo1WTsN0eO4og4VYhWm3ZNstwHwd0tjzaY5WtuiyVoVYAcGJ5rvPOTSDY+S\/g8eAEu6uoF+TiOVFbAcZIj868kWhmK68WtkPfuulXa3PjL7gW13uASH7cjkN3JzW0NiPAzu01GKehulwmylzYfxgKzifvBYVI9GpssFmvpuKWCDwLtb8qYAn4cbkzhZtbBDWOzgc0zlHFEC+G1j2Zqu4pbCFYWQnuXfhRP0DWZ45ISPd8lqbhXTSu6P3\/q+7hpHMD+wTK\/PyK5byrUA\/yP\/L1GDVs3vATRCyd5CnFdSyvwJtO8xP7XzpzPccyueKOINJk+jT9Fyl5nocED5eACbt9jjwuwsdWGXg9QWSY6Sgy4TYGaYF0CKXzb9tOEzs8SJVfyi4wG2GLSM0w12n6MdjaIyRERwfMLLDtS8426A24VdAw+L6W4E76QmccgDyjf014llRFYyTJ1Jxo7Hi7l8rqPLrjWcb05PY4RinWEXvqI\/jeKG3ydAeRkzUZ7KhWlaOJfbF2Tv1Q20Y4jJsqfX0Z+UwQ1neAU+3iiiqbS\/9Tl5c6idqWqCLaR982rnr3BdNyQnmCPg6DlRyExKVCS2\/qHnmFQ4v911+8T9eVXqEeOXrHxbJHjx5z8wYL90qNk7+IIBlrpIZqq5RBBngF5hR0Pi6gLcqsG8HZmLUUxq6F6OgZDLr3lmB37h0SNMU1\/\/mAXTkZIRWyP\/\/zPNh39ZonP3jeduE6hHt5il2UEo8PiSW9e40\/1csUFxafcrpoh153SD0JCjPW3XrlJb+Txj5rIXq2DApKbZBNUlRXoDuPgnSERUqJYEpt7WSOPYf\/RjNUkMpMb0iipOv9ugkzxstSoUOUjd2\/MALglKdfr3M\/km5DywP\/NX2UP+1kEaouZfK+PvW3uDcxYUxDKaq7iv6w3id6uwx\/Qfpyb+hMyWr7jPSzUKicMqTlCPlI5fw3O\/nNDLwk+NhXFxluUFooY6Bnfcu9pZA+SUMpPN0o5U6oUdPolyLvaNj0nalL4jSCnUoprrsqDKxaN2TG\/Z7oQBxIe7Loi5OASU6EUmeAr6dgBNjHVdQA1Tuayl6zspa5NQD7pGA8IZ7Q4KSVmZCTLJAAl2ZtIEynPh8WAZHGSYm3ZGPtL3BhFnVROYuOVp75VTV3xBCM5KBLrqHcHqY0wdSIU3e5g41wNyPFgFlXCzZBYTJQXyHKGAc\/FjdqI0Mt7YQ0GB6+6MxUvJFWvqEYtnxuw0L55Lfmdd7GSBqEnT00Z4ImR4gEXr6BvMiN4vlfZt4otMi1yJpVvVGr5\/ejGllwBlw++t3eYmM8ZoFsuv7S3B1j6B0NJpn0ZBnauTr6CTQsKHM3w9VEkU14REYHdGRvI+mL1E1lJdFylFGldpV1adyOAiRVPii1JDutGRXmeDTUe+mknu1\/FHrOpCE3GdX\/YxCfOn4gd76t2mUGOGl2gu0cUVJalsSKsW+ovtYS8n4+fPcszXYQlsph3OTA1Pw\/5VfARnCRJkRvJuhNNQEg+0iMONm98AEk\/OqswZ3DQ6RYuCXGdwE78WxRk2EFm\/OH\/jMSGBNwCQtN9FOrUMIX\/wxGpDpzdBCFpTyHwom\/h4G3WfSx\/HBKBrGKWg1wG++r6JNhNCcTxR2D5Sv8u+KvNcDqkvd7rv\/UWaJ"}
02369{"flow_id":35,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1512,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":478323,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyEAbsX4gDHG4kxHoAQEAA0ywAAAQEICjCEsp9hHvut41HNShvkoqONiQ48LSVK+ZOos8GcBweE0RqlKz1BGCZnz5h6aGdzM9OMZh+4feRCuiZFwnG4ScZh55PD+BUZNuS0tJR9lGTgVcJQl9odAQcL6tqLwsUtRu3Q9ql5fSztbsr49CaQ0zKk2MUtI98aM8EHUufSEmBGW3REAZtwWbVHwe\/mXpSJa9Ra3DPPEKfkntknolh3tvrnc83QFHrUNFbcO5JDtPKvVqSx4l9IQFtbbGHqtWsC4yBQ5i16bj2SMJl8hg7b5CT09JqqHP7amRnysRsbSP7eAVVlQryFpQOq\/ixRkVWPcul1UbCrvlkd9hAQd96f9Frf+zixTYGiiRzEqadQzmYBnFrgdEK+ZMFpj3NSoBhPjlTTl\/ZOaw8\/uW\/Urm\/G78rYQDzFk9BDbWh7lxY\/7RKYqicAV2++EGYrJlSf\/4ssZDSWPRjdGtlnsaP3tc+s1iH1Miy4M8EuuBPyMYaWol2xJ1dcEBb+D4msWBHvojOqT8YAmXhRNfaIanQzH5UulM24R1Vj0+fua7Pw3J1\/cOXvBo9\/KhW1lvpvDyQ3dspXRWGTbKoSoGKIVzDc4EFvjf+EVgfhhc5lFAQZT8BPDgqRSCBv60nJ3Jetc5K1YrKQH3XrYPoaTjVbDNaxgeoBsiEmTbL1I0liv4sEbbylYJ90JixfYUJ59syLnDkryhXCAVRzmglcMFIJFkm6F2373\/Wp9p7w2sp0fnj3CadvL6Ob147OCapnOFRnjizLiAvgnGfvZq9d30zvnd2MV5dyA3ecwN\/98q6Fodf4LXqw00ljM0+Kt3js3SASDuBhVvPtRj7J5TWTE9eEecnsbVUz1aaJOowWMhXak2\/0lLnI+lRCYZKl7zq02THsti7YS3DHKnSF1j4BIl4hCmOstEAy8THUTmkSAIOqr8PjdvkJMCiBzg6qBeQPml\/pnxRRJlaT9kYcAkpUx\/xc+wt+euiWxKJhT1QqL7lb0KukLo5KhVCvssxxkJJOzVinrhN4n+ymyDDzsq+hijJ333Cxg7AW\/mPFJW1bjSn09D4STieFX4scRrfDYumkTC1k8iI8DHf+bW2y3\/hHMWti0yZb\/Vs1ZHKw\/8QaYN5rZaGRJ7otqKsxw8tu25cOW\/1iPQZpd4OZviEQpWBlsf0ToRt8+gONS5lg3PX8hkvldMidVPsK5ZB63RX5FmCkYTbklrICM4Kz2MW\/nQtP6aIK9vXostvElrJH32rxa0EiFTk3SigaQewlv9a3xL\/SG8\/Vk7oWPOUqzH80J+\/xiihydKdN87ntPVZGFYPWx+QI\/i6JvsyB8oZGWJ5CyNmTzBGfO+LHDMnAHpnvsjEHGbN9Hpd6fTJUHBuVERVKDZ+5Q8fALmKTZBiWSVcTZ5fyM3psS5tJExt0TAuNuHtzI40mL8JU6DxYgwuEahHuvaJsb1nmsdVDzPgMLG6asrA8Irdj3BD3G53X3jlIZ9Lur0pNae0mgRuvB7WmyfHcQ0IaVBzi5aelPJCZT9xTfna5EavaYm0SoC5aA8glJGjbts39z9R9\/uE4SCyLwkXAxQKIgvIlQz8NpaIrsue1kprezwYr41XgfAextKBbDpuWhJ1Of3uwd4u7Xbi2ggS7dFdM5\/+26lxKeE1ySnK5f7Oy4cblRYeaqX9jl13ySDSCjRag3Jd8ZoRX6XSP7\/WSYCmnYTyF4JCQrIGAFoYsjJ+EauuIFux60a7YoHfImyhsd4JospcwHLyzfBPKI9EcM5abIyYyVd5ZlAPKfv74TZEek1GXZNor50zZ2BvyKQ+bEgzy3qA1V0S\/eG009BGaKmw\/uPv0yq5kIV\/l0UWlHKLZuYHla98kfnqO90AD9PzZXe\/IqxTFLGmOmcv6gCh7n\/wtt9u0q0DDZYee\/D7pF0SIiArzmlgL"}
02366{"flow_id":35,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1513,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":478325,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyEAbsX4gZbG4kxHoAQEADx9gAAAQEICjCEsp9hHvutDHcc6klo6KPNM\/o34DlMc1ibh02AeqxSFguVn0wjv2VBZ0Uy2yjqYc5jWwho+xIl5aFaD98VMWIrCG0\/OdNBEK82cBBsZa5JVCcYSMZ8k4dNNSH1mYpYEcLqvd8UOhGdqjjFIp0N1D+XhCCV+1O4VcuqBth6zKbwPyKBmzqgJu1akbfmUT+L+iuzUFYMnc\/h4nCsCJd158nFYa76wgSFedaCApeMH7GJ0KPUsQ5syc1J+oGFU16iFpZCPRORSz\/MrtwphqEWC+s1YGpRHaVHlNvALGyK+y\/2+\/TvmmPzplwOJA5zBWbuv2BJKLFoFTGSy1jOYY6RNWxB\/ZMdLL\/K1B3Dg3ml6tOR1Epk9ca8bl+3UUkkp0CCyeWTNk9p3btiLZ6ouLe2w+mc7bBM2798faPPaS0pAwFVS8rTPSh2bO\/2aBvWrqB\/zCLD6dgj14JqpC5qcboCYDdQaAlq6IqNWyW3ummOJmnBLqKzTV2Vu7IPs3tloj64MTEiG2mhuNVItgYG9hqKQrL7HCC3WoCSjuOf+07RIYY1sYYtyjtOTzVaJ2PA8LtmzItJLNgTZ40x+uWZmxgiEPEWqPEK\/w2HA\/i9Iup2s7hjqJ0rnbXna93wRPqpmEjh086UoDYUTKqBoyADI90ORGt5+VANfWNpg9wL4LFzRf1lYOuD8HZMV6Y65Mj8X9fVc3+e94N1EbLc+8YizKV\/+p4grn0w6zP\/KL9SJjkd1vveXC3pGJEBXRHmQkUUbijxaRZh5vSyI3FNxllOpRtWv0VKaNZ80wFiB7Jv+3M3g9YQ9m3Yj328FjMxFv29V16GmoCGaxvSwxGlBVLC45EpnwWqB6oTbemsqU7c3TOadjxaNMpztZ6xfJNG9CRQ7kSQdwxPpbWk\/CQD0X4GvF71DS2151YMZJ5waUgJD+tIYhG+TbJ+kCxhi4xBoo9Dzco1vNd2FNIf3o13omRdlM4t9aTYNwzxJuY9hrXkXwEArBWhcGfxga1I1ForDLN84XDpE+1O9WNrTkd3ZfzqgJOm1OnEMWBSF4tJsmvLON2uH\/AJ05AzOvjl467HIrQ6Lz1tLInUvwI01pRMg\/P\/tDOg52jrj9rVGkFuqhcS8JMgu2Pl0kyAT0u5v8RGK7hSRn2rVVsnGr+I1OEj8i5o9M3BK82HXYzo+gg4wYbdAKpY48dNJbbAyFQDvaHhQ\/PTVZX1swJtnVN41ka6qjxYlHRt7jxBaHe60FUHdh8jirySuknOvTZHIqIlApkZto28LhsC7RMTsxzW773z0d19kEPAxEVD\/hymACh1ENMbIlknGUIBoM3rAq9Sjqushq6edWyRwXdkd8V1wuMnnEzZdJfslGQ2R2Ze5qt3WwXdsDt8UXz7giku8wB7BweHAeoIxWhSWO\/qow\/rrr72qZRZnJS2HVDayPVZ5U2lfACJOnVI62VMHKp+yLOOVwu5ZLgLSsMmk9cTU5M0I0qdaiuLkxRnmfN2NAHEz2GOX2KflxOvplnt5ym7kLiJvQvQWXuIjwepcwoZTE8g3C+1SHA5OZIsZiQIgvk\/wbEKGYguOlbR4tw9CQk\/0u8q2RmnX+OShSmEH+2PxeRA2cu0PKi3Qfy9f3UarU7W87rgVjj5rxeSEl\/QAGrDSQM2qwQfLfNuj5\/ME4MMwZw4D\/oWnhr4TX3TLY9Cee3mCV49Ootz4LtlMTb9Bks67ue3P+poGWHIH7HFDr\/2ZyLxTFAPx5nAdxPdOqeLnE7bmbOMBM1t9sMhNzaWT1pgyojF92fKUG\/5JJ7P7h7hztYsnZ77KB4r+JhCm0\/BwDnubdUfF725ro0KvmEwbuH+Wq+EVkWY44J72rxSTMj1dFHHzY589FN7F8Z11X6wEwEnbD0giqOfLrGogRIKiVptmo6fJjc3g\/gB"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1533,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041683,"pkt_ts_usec":611241,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1533,"source":"teams.pcap","alias":"nDPId-test","type":38}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1685,"source":"teams.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1587041684291,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":59403,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00444{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1685,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":291077,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"EBMx8Tl2KDc3AG3ICABFAABC19sAAP8RYHfAqAEGwKgBAegLADUALnZLN+4BAAABAAAAAAAACXN1YnN0cmF0ZQZvZmZpY2UDY29tAAABAAE="}
00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1685,"source":"teams.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1587041684291,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":59403,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"substrate.office.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00627{"flow_id":36,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1686,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":304618,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"pkt":"KDc3AG3IEBMx8Tl2CABFAADIzNlAADkR8PPAqAEBwKgBBgA16AsAtAAAN+6BgAABAAUAAAAACXN1YnN0cmF0ZQZvZmZpY2UDY29tAAABAAHADAAFAAEAAABCABQJc3Vic3RyYXRlB21zLWFjZGPAFsAyAAUAAQAAABYACAVhZmQta8AWwFIABQABAAAAGQAoEm91dGxvb2stb2ZmaWNlLWNvbQZrLTAwMDIIay1tc2VkZ2UDbmV0AMBmAAUAAQAAAKAAAsB5wHkAAQABAAAAoQAEDWsSCw=="}
00696{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1686,"source":"teams.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1587041684291,"flow_last_seen":1587041684304,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":59403,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"substrate.office.com","num_queries":1,"num_answers":5,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"13.107.18.11"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1687,"source":"teams.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1587041684306,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"13.107.18.11","src_port":60549,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1687,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":306115,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGWZTAqAEGDWsSC+yFAbvNnLiZAAAAALAC\/\/\/7GwAAAgQFtAEDAwUBAQgKMIS1wQAAAAAEAgAA"}
00427{"flow_id":37,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1697,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":317619,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0FJpAAHUGEAYNaxILwKgBBgG77IU13hw0zZy4moAS\/\/\/HZQAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":37,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1698,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":317725,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGWazAqAEGDWsSC+yFAbvNnLiaNd4cNVAQIADoJAAA"}
00696{"flow_id":37,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1699,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":317987,"pkt_caplen":265,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":265,"pkt_l4_len":231,"pkt":"EBMx8Tl2KDc3AG3ICABFAAD7AABAAEAGWNnAqAEGDWsSC+yFAbvNnLiaNd4cNVAYIAB7OAAAFgMBAM4BAADKAwNT9yhcRBpq6+zC6hAkiruFzkDB0iUODZ2vqxEjURraCwAAHGpqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACF2toAAP8BAAEAAAAAGQAXAAAUc3Vic3RyYXRlLm9mZmljZS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAja2gAdABcAGAAbAAMCAAK6ugABAA=="}
00756{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1699,"source":"teams.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":4,"flow_first_seen":1587041684306,"flow_last_seen":1587041684317,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":211,"flow_tot_l4_payload_len":211,"flow_avg_l4_payload_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"13.107.18.11","src_port":60549,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"substrate.office.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00416{"flow_id":37,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1701,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":329497,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoFJtAAHYGDxENaxILwKgBBgG77IU13hw1zZy5bVAQBAEDUQAAAAAAAAAA"}
02355{"flow_id":37,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1718,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":361997,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUFJxAAHYGCWQNaxILwKgBBgG77IU13hw1zZy5bVAQBAE1xgAAFgMDEScCAABiAwNemFWUxi40371SEBsRoSvi3K1qS7dk8re7yQqXzV6fTCDWDgAAEZy1g76FcVx8iRxcs1H3LDFiTCTdny4ZR8Qn1cAwAAAaAAUAAAAjAAAAEAAFAAMCaDIAFwAA\/wEAAQALAA1vAA1sAAjQMIIIzDCCB7SgAwIBAgIQB2hUBcDpx4XEzZrxIUolfjANBgkqhkiG9w0BAQsFADBLMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSUwIwYDVQQDExxEaWdpQ2VydCBDbG91ZCBTZXJ2aWNlcyBDQS0xMB4XDTE5MDcxMjAwMDAwMFoXDTIxMDcxMjEyMDAwMFowcTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEbMBkGA1UEAxMST3V0bG9vay5vZmZpY2UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7+Nra7fKq66KQLN4DKrA0VnlSVepnT\/oHFUN09PHVOIi7oIBLhWjsVBqFAmP7Gvo7MbUy9kMq0TvmUUptU30SReC5mTFyD4zO8TNxdR9JPw96iUXWdQlXrYfS1dnwMgxGbkub+csPd4PL3NOPVyo1dRsT1B4jZ13Me0JRl4Um40k8h0i5XD6GrOfIdKinMEamE0dNEDqD8kvBR5fkH2bnLUv4EM4l5i7SRrOz9iLyy0cmw\/GDqCNBRqipSW0ywd6Wkhk42sgG1SK2czbZjKs1SeqOMRrmzmJkxgWAHJ9pxwvazNb+F+VfrRD8B2v7mI1gp3c8zJVWl7ap\/lrTf4RwIDAQABo4IFhDCCBYAwHwYDVR0jBBgwFoAU3VHQojFzqXOuj7QBfl2MV8uf8PcwHQYDVR0OBBYEFEvzprbM0Zp6vEsA3rmSQigYtbvmMIICIwYDVR0RBIICGjCCAhaCEk91dGxvb2sub2ZmaWNlLmNvbYIdYXR0YWNobWVudC5vdXRsb29rLm9mZmljZS5uZXSCIGF0dGFjaG1lbnQub3V0bG9vay5vZmZpY2VwcGUubmV0ghNib29raW5ncy5vZmZpY2UuY29tghBkZWx2ZS5vZmZpY2UuY29tghplZGdlLm91dGxvb2sub2ZmaWNlMzY1LmNvbYITZWRnZXNkZi5vdXRsb29rLmNvbYIUaW1nLmRlbHZlLm9mZmljZS5jb22CEG91dGxvb2subGl2ZS5jb22CFG91dGxvb2stc2RmLmxpdmUuY29tghZvdXRsb29rLXNkZi5vZmZpY2UuY29tghlzZGZlZGdlLXBpbG90Lm91dGxvb2suY29tghRzdWJzdHJhdGUub2ZmaWNlLmNvbYIYc3Vic3RyYXRlLXNkZi5vZmZpY2UuY29tghxhZmQtay1hY2RjLWRpcmVjdC5vZmZpY2UuY29tghNiZXRhLXNkZi55YW1tZXIuY29tghR0ZWFtcy1zZGYueWFtbWVyLmNvbYIPYmV0YS55YW1tZXIuY29tghB0ZWFtcy55YW1tZXIuY29tghZhdHRhY2htZW50cy5vZmZpY2UubmV0ghphdHRhY2htZW50cy1zZGYub2ZmaWNlLm5ldIIQYWZkLWsub2ZmaWNlLmNvbYIUYWZkLWstc2RmLm9mZmljZS5jb20wDgYDVR0PAQH\/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCBjQYDVR0fBIGFMIGCMD+gPaA7hjlodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRDbG91ZFNlcnZpY2VzQ0EtMS1nMS5jcmwwP6A9oDuGOWh0dHA6Ly9jcmw0LmRp"}
02381{"flow_id":37,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1719,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":362087,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUFJ1AAHYGCWMNaxILwKgBBgG77IU13iHhzZy5bVAQBAGr9QAAZ2ljZXJ0LmNvbS9EaWdpQ2VydENsb3VkU2VydmljZXNDQS0xLWcxLmNybDBMBgNVHSAERTBDMDcGCWCGSAGG\/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAjB8BggrBgEFBQcBAQRwMG4wJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NweC5kaWdpY2VydC5jb20wRQYIKwYBBQUHMAKGOWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydENsb3VkU2VydmljZXNDQS0xLmNydDAMBgNVHRMBAf8EAjAAMIIBfAYKKwYBBAHWeQIEAgSCAWwEggFoAWYAdQC72d+8H4pxtZOUI5eqkntHOFeVCqtS6BqQlmQ2jh7RhQAAAWvnKNL7AAAEAwBGMEQCIFbofofUy9ktak4PriQRRgfrb\/\/YUBTYLuzVUeWLPNoHAiAioRFLut07EprtxaQiI\/9Rt7gXRYKun6JeXwdIx2uTBAB1AId1v+dZfPiMQ5lfvfNu\/1aNR1Y2\/0q1YMG06v9eoIMPAAABa+co0zgAAAQDAEYwRAIgEVb+llytLDXFaLeM916wyeaunc5wOnHG\/joEXgg5fZECIDCL4nvgXJcKX\/dhEP\/NBmkp2wU8xtwPu2NSvmr2oYluAHYARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFr5yjSQgAABAMARzBFAiEAwKcUB0l49\/P4tNFKoTeSduAoShl40L2Cz5dlG2pZ7KkCIFkr8DwT3VrMX8xNpgd1kCRNM08sc6SGi0BCGha6KZWKMA0GCSqGSIb3DQEBCwUAA4IBAQAWuauuUY2aQwCm\/RoC4+uIQOS1azmqVkslnqB35KSxJas3tRxoeEifxauQp6WRjYFK4Fu4SsemL+vPwDq0ObnMf6w9ySMoB\/QlWejUlaum98h2UqthxLIKniT4o+Hfp8UTyjSdgGFIf142\/naakhcaZ33JndSts2u98OrXalNgf8sjAHzyeg9WqlXA8ZtXQBKwxE4ITfDwAevAtpw1kCSe+DLygQ83fbzlfXBqFrD6QtsY7SInkQedfawfF4VQhIMwCfiKEuGNHRE5I\/E9Vs5xp6wxpEeqR\/axNK4iH7WxgQEkbJFJXHVZolr\/j\/ZjjLsI5WWFpSEpKZ\/ddN+5mUn3AASWMIIEkjCCA3qgAwIBAgIQAZ7Bxr0\/WXuyDDM45VHYdzANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0xNTA4MDQxMjAwMDBaFw0zMDA4MDQxMjAwMDBaMEsxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJTAjBgNVBAMTHERpZ2lDZXJ0IENsb3VkIFNlcnZpY2VzIENBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRrfaHFHlUJ1fHLwVoPJs8zWfsRRAshPKkR8TZU0JFCbvk\/jPB17xGL9GL5re1Z3h8anC+\/bjltlTPTF6suCJ0c1UpCHPIZPfQlQkOeYNQv1\/11MybQmGOgAS5QarOThKZm6zWxb5bAnO1FqSrcWLUmOpAOYWm9rsv6OeHwov2nDLN7Pg+v4nndCOCS9rqv3OmJTz9v6nlaP\/4MKJgxzsuo\/PFfzs7\/Q8xoXx0D9C\/FMS9aPGl52un35sAfkYlTuboE\/P2BsfUbwsnIEJdYbw\/YNJ8lnLJfLCL\/\/lIBVME+iKvt81RXW3dkHQD8DNP9MfA"}
00408{"flow_id":37,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1720,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":362150,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGWazAqAEGDWsSC+yFAbvNnLltNd4njVAQH9LcJwAA"}
02369{"flow_id":37,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1721,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":362334,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUFJ5AAHYGCWINaxILwKgBBgG77IU13ieNzZy5bVAQBAEixAAAPlZGR69zIIvcej6j8l3\/AgMBAAGjggFaMIIBVjASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTB7BgNVHR8EdDByMDegNaAzhjFodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRHbG9iYWxSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMB0GA1UdDgQWBBTdUdCiMXOpc66PtAF+XYxXy5\/w9zAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3RVTANBgkqhkiG9w0BAQsFAAOCAQEACCnEyKb+tDgo96MZZ4zqBTsOS0BiYh48FMYF3DanTzJxRgVegB1ca\/Btbdkhdgu9RsS5ZpdN\/4AUeodphLLW\/8kWcL6jzIshre5cjSStwo+Z4MyeigkDuA+atVuQKyr316UvSmWoxOTFx3GplkZPq21LKhbL8ak79h8hObTrrWAEgpsSv96r0kYdDA07dgL5C9XOU4VCeylNRtGLzWTsIRZPLwFDWNFl7Vyl+0Sg0lDo3mbEtjGehzMDsMnGSxLnWzWU2UbOMeu\/uPaeC4SFgiJWxCOEVOdSMwwlyxrsRFUPY5Zys80ZXn4OJ4XVpOqw4qXcBiklkOjOLOnp0HzvzhYAAdkBAAHVMIIB0QoBAKCCAcowggHGBgkrBgEFBQcwAQEEggG3MIIBszCBnKIWBBTdUdCiMXOpc66PtAF+XYxXy5\/w9xgPMjAyMDA0MTMxNTMyMjNaMHEwbzBHMAcGBSsOAwIaBBRItqniEpOzwCCxKs5Oc2SaPGfcmwQU3VHQojFzqXOuj7QBfl2MV8uf8PcCEAdoVAXA6ceFxM2a8SFKJX6AABgPMjAyMDA0MTMxNTMyMjNaoBEYDzIwMjAwNDIwMTQ0NzIzWjANBgkqhkiG9w0BAQsFAAOCAQEAurQ3e0uI2\/3QkXdKtO6HPFwkivYaluy4DwK1QvLUfqePLndtpNN8rsupNb7b\/oo7qhnkfY+aPOaVxIdkWedm3ej5ryG4h7BDas+S0IgWxBRCJCIJezKZ2rLUqHIgGtfo1If3nSrVtTlE7E0LOqjMAqi\/7ttk\/ztQyN9xOGxQGuO7ZKFfJ6iJrFpCGrwKKruaHeFdfi9EZpajkk0OzX6tLr1rW+TMWGmCl5K1kIOCQocnxk6ZQ1LkFDHPXsJ\/N7UncZNkWEQJlYSYExY1U9QqoJVKXkJQYwJucq3+pmOUTbBYX8JRfA9eAEhvetTvhBj7ubZmVqbnQ2UOWb2bG4H\/LgwAAWkDABhhBM3oeauFr\/+yDZmf7u6HI3wTfUAx0qmvQiJb1VA8dnP8BFmdEg1HD3CFvQtnFzldT60cf66xT1pxU\/vheLykWn9qYtFtB2LBAywLyeSS1+E5f+d4eFrgYscIAxDCl69sZgQBAQBQ27XZvH1rV2pUXV\/lggIb0Wd7OIg0w8iduLLGNJi6RuH+K+KSLtule2pvwGAy7uAJjAv5I7CIrUGIj1\/V5FNvQ4vdk+ifuw0OzRTDtGXxV5PVwBDdKC7jFKqB5z8lOYtDr6seiApM5UMkvPMgD0iAhmeoE2D88GvyCSY171XvVnfeLHMH+TkJvNlLsjSpG+p66s96vTtTZaH6Hb5VDzAyRIdBteTyFTmXgxbAfzYXWJPrvGY2LunIPSMDrxTYfWYYMp5aKEuETmsefIq5WE3Z2OlYaBi+d+DPhPwI"}
00465{"flow_id":37,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1722,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":362335,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"KDc3AG3IEBMx8Tl2CABFAABQFJ9AAHYGDuUNaxILwKgBBgG77IU13i05zZy5bVAYBAEvfwAA2BU6FLOqezFGRH8EDwiDKQrqoWuDQ8c67wKl46tlInnEsf3RDgAAAA=="}
01577{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1722,"source":"teams.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":10,"flow_first_seen":1587041684306,"flow_last_seen":1587041684362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":4607,"flow_avg_l4_payload_len":460,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"13.107.18.11","src_port":60549,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"substrate.office.com","server_names":"outlook.office.com,attachment.outlook.office.net,attachment.outlook.officeppe.net,bookings.office.com,delve.office.com,edge.outlook.office365.com,edgesdf.outlook.com,img.delve.office.com,outlook.live.com,outlook-sdf.live.com,outlook-sdf.office.com,sdfedge-pilot.outlook.com,substrate.office.com,substrate-sdf.office.com,afd-k-acdc-direct.office.com,beta-sdf.yammer.com,teams-sdf.yammer.com,beta.yammer.com,teams.yammer.com,attachments.office.net,attachments-sdf.office.net,afd-k.office.com,afd-k-sdf.office.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"a66ea560599a2f5c89eec8c3a0d69cee","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Outlook.office.com","alpn":"h2,http\/1.1","fingerprint":"AA:D3:F5:66:06:48:AA:F8:8E:9B:79:D6:7F:1D:53:EA:3F:97:03:A2"}}
00409{"flow_id":37,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1723,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":362373,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGWazAqAEGDWsSC+yFAbvNnLltNd4tYVAQH9HWVAAA"}
00627{"flow_id":37,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1724,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":366212,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"EBMx8Tl2KDc3AG3ICABFAADGAABAAEAGWQ7AqAEGDWsSC+yFAbvNnLltNd4tYVAYIADR3gAAFgMDAGYQAABiYQTJ2e7AKWBQ04e1oVsTbr+Pd2xAGivzg\/UtbmFTalVk6OyMTpkH+ppXobE+32uV7\/D6XXEPCiyHu9Fj+T5kVMU86jwjuCr9Zld4aeEx7Ov9VdAH0mPX8DQpk4RPAjXOA4YUAwMAAQEWAwMAKAAAAAAAAAAAk6diy7+2roS\/v+tTXTMj5Lt7gLRyYvp53RvO8TB8FLY="}
00537{"flow_id":37,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1725,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":373953,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"pkt":"EBMx8Tl2KDc3AG3ICABFAACFAABAAEAGWU\/AqAEGDWsSC+yFAbvNnLoLNd4tYVAYIAAp8gAAFwMDAFgAAAAAAAAAAamLj9A5OPT3Qblu0RImM1R5UCQzMjbveajEvsmKdeWImBylqL0J4JcD7voAm+GUiwTzCBvruK8wFjqXhmNh2gqVGlRZ9RFB0TkonutwnTL2"}
01147{"flow_id":37,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1726,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":374278,"pkt_caplen":592,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":592,"pkt_l4_len":558,"pkt":"EBMx8Tl2KDc3AG3ICABFAAJCAABAAEAGV5LAqAEGDWsSC+yFAbvNnLpoNd4tYVAYIAAtOwAAFwMDAhUAAAAAAAAAAnoEFa1O6O4jB\/9Rs\/uZd2wnUxMOKQMhYYzxudiX9cneG\/e0hEbY\/V1I2kmd2n450RDif7N5YTIR5FfNYfrnoC9Sy3\/CmEn9xtjGkE2Du1g\/jOtL3bvVbdHctPyvqzE3wZFS8e\/ahk\/\/n49oSGrDg0UsLvlAplo1cBoBcdHHQ6+6JPEv6ytDzOg9ihyXhcdPrHV418BMh07FRMKWOFxVA8DVNQHYeOB5PevyZaFQj2vGvsOP\/XbQRKmM+0Kl3Z9wGGChJqjOAo+Mdzdv\/xNunKVinnfZ4r5pBudKfqepaGpNiF9OBLGC5Z961BfvXED13ZUfY3p\/qrfI\/kR6AZaeOBEUlOQRq+0Za2KQhPZKO7fevbCk3w+lDHDFkPwjf3h\/BoYqudB8T88mstgaH3Ttm69ksRbcNKcWl0XKWIvMSUlLH6TGLhBc6HRxiC0ePrX8oazeKfIOeXj0mF6hSGeZ6WTMrbpI5OzAqY1BOC2XgCg6ArsPGatdxByekknB05kddbw2wbP9ntZAvba5cJdQJ98xnWpxPe6ifZ3O2WlHMxi063Kl3b08VxTaPKkdTTzzhqVGsdoE7ArZxw3hNS5G5jx5WTbHrcvlmiDvkCu0Amnc2alBu\/YgRS7Lwdz9kWOgrskwsuh0Yzic3WSJbjevm14M+bOycMvakGAVYUu8OVIxXMzaUeF3LBF89iEK3g=="}
00593{"flow_id":37,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1727,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":374350,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"pkt":"EBMx8Tl2KDc3AG3ICABFAACsAABAAEAGWSjAqAEGDWsSC+yFAbvNnLyCNd4tYVAYIABWVQAAFwMDAH8AAAAAAAAAA\/r4V7fKCRvENEHp2g9oFooWRNtbwacjQp5ot\/N9Dpu1\/XRH0KkXCfxdbarfm17nT4djYDWdAWmnmNu\/aTLusJ6kYlOwsB+guT1ONQ8OI1tB+9TDyiNT0a2qyBQ+OOL4BWjVA16FFnxWiLsBk7g\/adWO6XttK6ej"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1753,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041684,"pkt_ts_usec":611243,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1753,"source":"teams.pcap","alias":"nDPId-test","type":38}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1775,"source":"teams.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1587041685090,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":61245,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1775,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":90830,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"EBMx8Tl2KDc3AG3ICABFAABJHhYAAP8RGjbAqAEGwKgBAe89ADUANcKVVKoBAAABAAAAAAAABGV1YXoCdHIFdGVhbXMJbWljcm9zb2Z0A2NvbQAAAQAB"}
00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1775,"source":"teams.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1587041685090,"flow_last_seen":0,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":45,"flow_tot_l4_payload_len":45,"flow_avg_l4_payload_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":61245,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"euaz.tr.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1776,"source":"teams.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1587041685091,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":53678,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00478{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1776,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":91534,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"EBMx8Tl2KDc3AG3ICABFAABZE40AAP8RJK\/AqAEGwKgBAdGuADUARafs9AEBAAABAAAAAAAAD3Ryb3V0ZXIyLWFzc2UtYQd0cm91dGVyBXRlYW1zCW1pY3Jvc29mdANjb20AABwAAQ=="}
00679{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1776,"source":"teams.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1587041685091,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":53678,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"trouter2-asse-a.trouter.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1777,"source":"teams.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1587041685092,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65230,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1777,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":92516,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"EBMx8Tl2KDc3AG3ICABFAABZD5kAAP8RKKPAqAEGwKgBAf7OADUARYKEB0oBAAABAAAAAAAAD3Ryb3V0ZXIyLWFzc2UtYQd0cm91dGVyBXRlYW1zCW1pY3Jvc29mdANjb20AAAEAAQ=="}
00678{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1777,"source":"teams.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1587041685092,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65230,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"trouter2-asse-a.trouter.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1778,"source":"teams.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1587041685093,"flow_last_seen":0,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":53,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":50653,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1778,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":93044,"pkt_caplen":95,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":95,"pkt_l4_len":61,"pkt":"EBMx8Tl2KDc3AG3ICABFAABRstMAAP8RhXDAqAEGwKgBAcXdADUAPUwYqlcBAAABAAAAAAAAA2FwaQtmbGlnaHRwcm94eQV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAE="}
00670{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1778,"source":"teams.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1587041685093,"flow_last_seen":0,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":53,"flow_tot_l4_payload_len":53,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":50653,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"api.flightproxy.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00572{"flow_id":39,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1781,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":104871,"pkt_caplen":173,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":173,"pkt_l4_len":139,"pkt":"KDc3AG3IEBMx8Tl2CABFAACfqZ9AADkRFFfAqAEBwKgBBgA10a4AiwAA9AGBgAABAAIAAAAAD3Ryb3V0ZXIyLWFzc2UtYQd0cm91dGVyBXRlYW1zCW1pY3Jvc29mdANjb20AABwAAcAMAAUAAQAADYsAHg90cm91dGVyMi1hc3NlLWEIY2xvdWRhcHADbmV0AMBJABwAAQAAAAUAECoBARHxAHAAAAAAAG\/dVKE="}
00704{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1781,"source":"teams.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1587041685091,"flow_last_seen":1587041685104,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":131,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":53678,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"trouter2-asse-a.trouter.teams.microsoft.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":28,"rsp_type":28,"rsp_addr":"42.1.1.17"}}
00556{"flow_id":40,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1782,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":105349,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"KDc3AG3IEBMx8Tl2CABFAACTMl9AADkRi6PAqAEBwKgBBgA1\/s4AfwAAB0qBgAABAAIAAAAAD3Ryb3V0ZXIyLWFzc2UtYQd0cm91dGVyBXRlYW1zCW1pY3Jvc29mdANjb20AAAEAAcAMAAUAAQAADNUAHg90cm91dGVyMi1hc3NlLWEIY2xvdWRhcHADbmV0AMBJAAEAAQAAAAgABDRyDy0="}
00705{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1782,"source":"teams.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1587041685092,"flow_last_seen":1587041685105,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":119,"flow_tot_l4_payload_len":180,"flow_avg_l4_payload_len":90,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65230,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"trouter2-asse-a.trouter.teams.microsoft.com","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.15.45"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1783,"source":"teams.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1587041685106,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.15.45","src_port":60551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1783,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":106192,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGNWvAqAEGNHIPLeyHAbsC\/Q6WAAAAALAC\/\/9IhwAAAgQFtAEDAwUBAQgKMIS4zgAAAAAEAgAA"}
00627{"flow_id":41,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1792,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":127636,"pkt_caplen":216,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":216,"pkt_l4_len":182,"pkt":"KDc3AG3IEBMx8Tl2CABFAADKzTRAADkR8JbAqAEBwKgBBgA1xd0AtgAAqleBgAABAAMAAAAAA2FwaQtmbGlnaHRwcm94eQV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAHADAAFAAEAAA4OACoDYXBpC2ZsaWdodHByb3h5BXRlYW1zDnRyYWZmaWNtYW5hZ2VyA25ldADAQQAFAAEAAAEsACcbYy1mbGlnaHRwcm94eS1ldW5vLTAxLXRlYW1zCGNsb3VkYXBwwGbAdwABAAEAAAAGAAQ0ck2I"}
00699{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1792,"source":"teams.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1587041685093,"flow_last_seen":1587041685127,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":50653,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"api.flightproxy.teams.microsoft.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.77.136"}}
00619{"flow_id":38,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1797,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":136892,"pkt_caplen":209,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":209,"pkt_l4_len":175,"pkt":"KDc3AG3IEBMx8Tl2CABFAADDZa9AADkRWCPAqAEBwKgBBgA17z0ArwAAVKqBgAABAAMAAAAABGV1YXoCdHIFdGVhbXMJbWljcm9zb2Z0A2NvbQAAAQABwAwABQABAAALoAAiBGV1YXoCdHIFdGVhbXMOdHJhZmZpY21hbmFnZXIDbmV0AMA5AAUAAQAAAAAAMBJiLXRyLXRlYW1zLWV1bm8tMDULbm9ydGhldXJvcGUIY2xvdWRhcHAFYXp1cmXAJMBnAAEAAQAAAAoABDRy+ns="}
00692{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1797,"source":"teams.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1587041685090,"flow_last_seen":1587041685136,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":212,"flow_avg_l4_payload_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":61245,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"euaz.tr.teams.microsoft.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.250.123"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1798,"source":"teams.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1587041685171,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":58457,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1798,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":171649,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABADGUAAP8RK\/DAqAEGwKgBAeRZADUALJr8l0UBAAABAAAAAAAAB291dGxvb2sGb2ZmaWNlA2NvbQAAAQAB"}
00666{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1798,"source":"teams.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1587041685171,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":58457,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"outlook.office.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00655{"flow_id":43,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1799,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":185131,"pkt_caplen":236,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":236,"pkt_l4_len":202,"pkt":"KDc3AG3IEBMx8Tl2CABFAADeqaxAADkRFAvAqAEBwKgBBgA15FkAygAAl0WBgAABAAYAAAAAB291dGxvb2sGb2ZmaWNlA2NvbQAAAQABwAwABQABAAAANQAMCXN1YnN0cmF0ZcAUwDAABQABAAAAxQAUCXN1YnN0cmF0ZQdtcy1hY2RjwBTASAAFAAEAAAAmAAgFYWZkLWvAFMBoAAUAAQAAACYAKBJvdXRsb29rLW9mZmljZS1jb20Gay0wMDAyCGstbXNlZGdlA25ldADAfAAFAAEAAACgAALAj8CPAAEAAQAAAJ8ABA1rEgs="}
00694{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1799,"source":"teams.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1587041685171,"flow_last_seen":1587041685185,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":194,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":58457,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"outlook.office.com","num_queries":1,"num_answers":6,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"13.107.18.11"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1805,"source":"teams.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1587041685232,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60552,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1805,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":232231,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyIAbtyjZOTAAAAALAC\/\/8ViAAAAgQFtAEDAwUBAQgKMIS5SgAAAAAEAgAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1806,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1587041685240,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1806,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":240465,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGghTAqAEGNHHChOyKAbtGGzTNAAAAALAC\/\/8rVAAAAgQFtAEDAwUBAQgKMIS5UgAAAAAEAgAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1807,"source":"teams.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1587041685243,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51309,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00460{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1807,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":243104,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"EBMx8Tl2KDc3AG3ICABFAABPU3QAAP8R5NHAqAEGwKgBAchtADUAO5eNyGMBAAABAAAAAAAAFHNreXBlZGF0YXByZGNvbG5ldTA0CGNsb3VkYXBwA25ldAAAHAAB"}
00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1807,"source":"teams.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1587041685243,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51309,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"skypedataprdcolneu04.cloudapp.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1808,"source":"teams.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1587041685248,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60555,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00444{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1808,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":248604,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyLAbsws\/klAAAAALAC\/\/\/xvAAAAgQFtAEDAwUBAQgKMIS5WgAAAAAEAgAA"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1809,"source":"teams.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1587041685251,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.7","src_port":60556,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1809,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":251950,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4XAqAEGKH4JB+yMAbvF6IfFAAAAALAC\/\/8d8gAAAgQFtAEDAwUBAQgKMIS5XQAAAAAEAgAA"}
00426{"flow_id":45,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1810,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":253368,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0w5JAAHUGiY00ccKEwKgBBgG77IqoHlkCRhs0zoAS\/\/9MIAAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":45,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1811,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":253460,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyKAbtGGzTOqB5ZA1AQIABs3wAA"}
00660{"flow_id":45,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1812,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":253933,"pkt_caplen":240,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":240,"pkt_l4_len":206,"pkt":"EBMx8Tl2KDc3AG3ICABFAADiAABAAEAGgXLAqAEGNHHChOyKAbtGGzTOqB5ZA1AYIAAZhwAAFgMBALUBAACxAwNemFWVZrT7WTFXDzKTJwgyjyi4pczPS4OaStHQgrmy6wAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAXAAAAB8AHQAAGmNvbmZpZy50ZWFtcy5taWNyb3NvZnQuY29tAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"}
00785{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1812,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":4,"flow_first_seen":1587041685240,"flow_last_seen":1587041685253,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":186,"flow_tot_l4_payload_len":186,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"config.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00569{"flow_id":46,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1813,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":256108,"pkt_caplen":169,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":169,"pkt_l4_len":135,"pkt":"KDc3AG3IEBMx8Tl2CABFAACb\/nFAADkRv4jAqAEBwKgBBgA1yG0AhwAAyGOBgAABAAAAAQAAFHNreXBlZGF0YXByZGNvbG5ldTA0CGNsb3VkYXBwA25ldAAAHAABwCEABgABAAAADgBABHByZDEOYXp1cmVkbnMtY2xvdWTAKgZtc25oc3QJbWljcm9zb2Z0A2NvbQB9o\/w8AAADhAAAASwACTqAAAAAPA=="}
00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1813,"source":"teams.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1587041685243,"flow_last_seen":1587041685256,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51309,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"skypedataprdcolneu04.cloudapp.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00426{"flow_id":42,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1814,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":261856,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0jN1AAG0Ge5k0cg8twKgBBgG77IfA1AaRAv0Ol4AS\/\/+iigAAAgQFoAEDAwgBAQQC"}
00409{"flow_id":42,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1815,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":261955,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGNYPAqAEGNHIPLeyHAbsC\/Q6XwNQGklAQIADDSQAA"}
00685{"flow_id":42,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1816,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":262299,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"EBMx8Tl2KDc3AG3ICABFAADzAABAAEAGNLjAqAEGNHIPLeyHAbsC\/Q6XwNQGklAYIAAraAAAFgMBAMYBAADCAwNemFWVnmpu5iBYzDA0OwyTFl3gYWrTqQBuMzMR9X7FRwAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAbQAAADAALgAAK3Ryb3V0ZXIyLWFzc2UtYS50cm91dGVyLnRlYW1zLm1pY3Jvc29mdC5jb20ACgAIAAYAFwAYABkACwACAQAADQASABAEAQIBBQEGAQQDAgMFAwYDAAUABQEAAAAAABIAAAAXAAA="}
00800{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1816,"source":"teams.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":4,"flow_first_seen":1587041685106,"flow_last_seen":1587041685262,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":203,"flow_tot_l4_payload_len":203,"flow_avg_l4_payload_len":50,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.15.45","src_port":60551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"trouter2-asse-a.trouter.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00416{"flow_id":45,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1817,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":265739,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAow5NAAHYGiJg0ccKEwKgBBgG77IqoHlkDRhs1iFAQBAGIJAAAAAAAAAAA"}
02373{"flow_id":45,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1818,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":267727,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUw5RAAHYGgus0ccKEwKgBBgG77IqoHlkDRhs1iFAQBAEKpQAAFgMDFysCAABZAwNemFWVon9sUY4smg\/Tw8+Zv8VcFlbcOdwExviP9\/E9yiDtJgAAkTnSxwdrr6KK4vMnxfSrgFx0pEdWZA9lBe7G6sAwAAARAAUAAAAXAAD\/AQABAAAAAAALAA4qAA4nAAhpMIIIZTCCBk2gAwIBAgITewAM1sff2xxDrSCFcgAAAAzWxzANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwHhcNMTkxMjExMDIwNDIwWhcNMjExMjExMDIwNDIwWjAlMSMwIQYDVQQDExpjb25maWcudGVhbXMubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKuoME\/5gx1HQd9sdy+s4YHawKf9J7S8dT4WfnUAqnYkdTyrmLaQGvnOVwm+Alg2MKjbLj7YlmrDEl+LlLhqsCOxTh+sGycfVj0hKsId4tssxk5dtSL14K6G+H0YBnvNUQu7vvVvTNCI4YPZj0lV\/ZKyol\/te+IRYafpXBi14wsmzo2lqeisNF9ulHu6A\/2xL\/FDFcQYFu8GUtZc\/1EHZiuH\/he6vLnSRl83OVtV\/yk0CSgW886Nb3\/WEJvOECPWn3DgxpU6jkEm4EvSs3adX1+bc\/i5J6\/gLUtUs6cAnmJtNvXs2pq\/f\/tijDc4rGLidlBdTF1jYL0uU8bsIVDJNSECAwEAAaOCBCUwggQhMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdgD2XJQv0XcwIhRUGAgwlFaO400TGTO\/3wwvIAvMTvFk4wAAAW7yvGHMAAAEAwBHMEUCIGa+\/kHz87e\/oQ8aC69gj8\/aoYo\/tE6p\/Si82L3s3PkGAiEAhkZwyGwr5TrczZ4j5sAn1Yok0bmQ50Q1otYS4UIF5GkAdgDuwJXujXJkD5Ljw7kbxxKjaWoJe0tqGhQ45keyy+3F+QAAAW7yvGL7AAAEAwBHMEUCID+jfXayujZyLzrbTnDycGFeCHnUL4IvMp4VSwcYAXjjAiEA+Wo2YMDO1x5lLdfKexvP6AnwkgDNgKyPCWglZwJVdW4AdQBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAW7yvGL5AAAEAwBGMEQCIHZ5MUybiLcqRiY\/i+zyj6mrjZJKktvjmJq7sVfmPkqyAiBXLnK3UpG6nhefXHnnWSJys9aLqQm8v0FaMVa+Jt2CdTAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYEFLtL8OEZ7zs1ivteHY43T3pv1cy9MAsGA1UdDwQEAwIEsDBDBgNVHREEPDA6ghwqLmNvbmZpZy50ZWFtcy5taWNyb3NvZnQuY29tghpjb25maWcudGVhbXMubWljcm9zb2Z0LmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWlj"}
02364{"flow_id":45,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1819,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269229,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUw5VAAHYGguo0ccKEwKgBBgG77IqoHl6vRhs1iFAQBAEktwAAcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAbVNFS732wYQvpkp3TDu3jW5fDqMTSkI2h2vMgS6KsQ1QnCBa0j+Kz1QXRYKkRourVWeuaDA+ZX8fhYHy+mFVKIf93Uy3iALbB6EzeCzhBLgr0WXY+KnfFMc4DaThv6rNLAatFngta1jAOodkGyqq1eAE86s+M7+i462khCw5GrSfOsuQdoz+fi1d4Iqxt5D+efo7tL9jCs2k7qBfDzR5Jpqt4QO5jQgZY7tC+Qfc5IQs+OKqyuud7i5nhK9uBhU+9r1PgtOxtRYeRQSKjULmcKavWh36Lmq7BnvKlaWyxjMqLVFElt8\/Abr+9TPfLe3vBDrqBYzIhtFQ8w7UW2UefD5fgcAqtVRPFSLUHVqHAx2CiXnXIgB9uZIdlLUh5\/Me4AhuKHzx47glbPuFhf6zgzevdov27btHB45dG8flVKgj+dU5xDnbX+j4qyt+zoTjxwEUdfXCSNSY0rJsRk8\/zeFyE\/ESrRTEMlGN\/gzW616B42ihaLRYkPoDYvQYdmGgL3fIKU14Avf3mgnLPXIfAoF50JTW4rVtcYkTAJQYAi2Os00jlfHVd4+0DvnzANuY1WMbFSpokuD6AjYKqWuAdqZgmyAsXMDlXps7UtNi3\/9FrFJ6zXAQ7kaQCkkKzcTkyRYy4ioUXc1zYrS7rhFMfDnOlHnUFy1dCoDYRCmagG8ABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB"}
00408{"flow_id":45,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1820,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269295,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyKAbtGGzWIqB5kW1AQH9Jg+wAA"}
02377{"flow_id":45,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1821,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269358,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUw5ZAAHYGguk0ccKEwKgBBgG77IqoHmRbRhs1iFAQBAHmxQAA3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQU9kInIFSIlBnF7lkM4zZm22FFWzAYDzIwMjAwNDE0MTUyMTM0WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewAM1sff2xxDrSCFcgAAAAzWx4AAGA8yMDIwMDQxNDE1MjEzNFqgERgPMjAyMDA0MTgxNTIxMzRaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTUxNTIxMzRaMA0GCSqGSIb3DQEBCwUAA4IBAQATQ507yw6vXQ9SkxqSiuwqFDYhdDtHOzhNJIAnZNZDAFLLMkqLDJTOkR+sHiFJ7D6F12QBUqhl4i1wzjfWyPV3TRuKFFFq9flj0EIUdbxZ7fz7zJgFjyiAq6ohGhYj0fjHIz\/5GQh\/GI4n+nXQZ783K8MX2Pnml6ZVwtW\/ivBH+iKmzDmrC7N8pkWgU6C375no88yQw3n3yL1MxtfoGI0l\/KPHymVdhjKnF88PzP8iq+XcIqeK89iztt4N5EtKtebhWziLDkZLK9JIZHspyNbgI\/75V+wYqhlkOLEnix9QeL\/tnsSSIH7E9sQzRE2B8Md71jWvzxQjxu9r7QDWg5nroIIFIzCCBR8wggUbMIIDA6ADAgECAhNhABK1vVbJe1vazzKFAAAAErW9MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk"}
00409{"flow_id":45,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1822,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269429,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyKAbtGGzWIqB5qB1AQIABbIQAA"}
02371{"flow_id":45,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1823,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269473,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUw5dAAHYGgug0ccKEwKgBBgG77IqoHmoHRhs1iFAQBAGsQwAAbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDAzMTUxNTQxMjNaFw0yMTAzMTUxNTQxMjNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm9PunaNFnz92aO8d4uH\/JCreP9UtdnH6Bv3+BjNMnU24H982v4wslFnOHRkeShM6dTut2u5yX3USK4TkHudmdpKCKlumoSspYbuV23UEmjEltXDdzSNYmzvQDOeZo9DyTtm0W9OcExDRacHKdHUSDCgp3idEbMLCXgoMPdcvciqUfRxxhpKEhzK6GRoNAmVI08HM6jLw+02rMYbuyQPnLJfaPIm6evkoCU6o9RORAng09ayQuSk72b1zEpJKOvFaK23Mnnwwb4jg93GQDHKSDRfL0BdvvWgSpMuv5U2HffFgVxCm1wKQl69Wj36qXQLZ2+wxv0swlG5nuGABQ6me1wIDAQABo4HWMIHTMB0GA1UdDgQWBBT2QicgVIiUGcXuWQzjNmbbYUVbMDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZjmdhpwvUwne4YtRiQs3dOLK5ba63GxG4DhqLLccO6A\/Gu5C1WAliMVEL8laAmZT5rjg7rZU63ADlU6i5dqMR9d65Gu\/P9sbyDYjevTB8j4VU8zV1e45gmS1fnTxH\/L14iqqM3+BWmprexDyUCWsXRJxp70y2N2YVZOquaqZFIwT4zprb8MBujdP7iFkk8soOpf\/l5U+mse\/W63G1wria\/aCHeEKWVe5F2v21NaIvfUgT9wStvUyhVk\/6WDBFypCre8c05o6zB2kA3b8eGeE56uGm26VL14MWExRNwnneVTysASyklJztTJjKIJiCZ7UsldbRUSdIVZyB+rsUuFxEs2yfP+8euVoeKkH9FEh8fTVfqGv3pafupuN0u\/\/dLN4soa06DNvTDUQWkRRbO6el56U4uvdsc3yBYOUpCEfZdmlCUuiesiTGTZKjg6Pel9E6aM1lPKUoFEgORCSp0t9xzpsHahiQos2LCym9Pi5bAvWTLeT65NzwDYJWd9xkcPSHaqNaXxrfEmnDhHqFEHA0H5fZSslXa7f\/DeJ3nBxZ+H4M2s+WWZ1FXymQaVNiFwcz61dh2ni95gdfAdhA51nQgJKXcgCvW0sx8AMX+76lmXRTxCdRB3NUS9Zk+plCHydbLwht6fHuAcJFjDcQTuMBm+4m9NXfOoK2aCNAEf7l1IMAAFpAwAYYQRsf0uDmNKLJMeXHDZT0rfSfJS0YLu\/bNhtzdpDmZmv8ma9KGaKhbTpzUwtn+ftaZbx8rgClygx+yMxR7e4zKtAmcY+KBoVy9Pm22bWMCV0xzBqYQjq2W\/LcgoXQQ+8DfcEAQEAFs5VYCTZMkBsKc6j\/UO8aegTX42l6mEtjxcpF4fJCxlS6IcQIfcCZeQV2fZLTvVQ\/Ez0b7C9+zA0gHWVT\/TMxd2avgCyCGEEjtePKrowtFv0Ee6PrRZfjOrT3MTDYsLN\/dZDWa76luBUbueF0lYElHQaCMEtS0ExGpJcr\/mMQXKl8uBv"}
00587{"flow_id":45,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1824,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269476,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"KDc3AG3IEBMx8Tl2CABFAACow5hAAHYGiBM0ccKEwKgBBgG77IqoHm+zRhs1iFAYBAG7UwAA0mcjUfghRDb\/G5+kNE504qga61CM4XWHMBZPM70HVY6bl5nTW4wMgEeYhASKAuc9\/c\/3xIbCGqTe4byauDnwt4gDPGW+QsBCOLLeXL0uNApF+1lxuJWGCd0dT62LqmKvy+IaoLTNxa2wjndjRezbtFElebsXF2K1eQmjcw4AAAA="}
01147{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1824,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":12,"flow_first_seen":1587041685240,"flow_last_seen":1587041685269,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6122,"flow_avg_l4_payload_len":510,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"config.teams.microsoft.com","server_names":"*.config.teams.microsoft.com,config.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"7d8fd34fdb13a7fff30d5a52846b6c4c","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=config.teams.microsoft.com","fingerprint":"B9:54:54:12:C9:E9:43:65:10:70:04:7B:AD:B6:0C:46:06:38:A5:FA"}}
00409{"flow_id":45,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1825,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":269514,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyKAbtGGzWIqB5wM1AQH85VJwAA"}
00436{"flow_id":44,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1828,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":278616,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8aa1AAGwGYc00ck0hwKgBBgG77IgacWa+co2TlKASIABIJQAAAgQFoAEDAwgEAggKYR7cGTCEuUo="}
00424{"flow_id":44,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1829,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":278702,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyIAbtyjZOUGnFmv4AQEAmGrAAAAQEICjCEuXNhHtwZ"}
00705{"flow_id":44,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1830,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":278900,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIeyIAbtyjZOUGnFmv4AYEAk6ggAAAQEICjCEuXNhHtwZFgMBAMkBAADFAwO15W+8jaHI2sAcvPxYu3fOurYjru\/fmNz9T6MzJf3JQCDMFgAAPSmx1EB8rJYwgB6DDk65Ho1qqYZPmBoFpBpgkAAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1830,"source":"teams.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":4,"flow_first_seen":1587041685232,"flow_last_seen":1587041685278,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60552,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00436{"flow_id":48,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1833,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":280598,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8VD9AAGwGx0kofgkHwKgBBgG77IwJMzAcxeiHxqASIADLBQAAAgQFoAEDAwgEAggKUkq4VzCEuV0="}
00424{"flow_id":48,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1834,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":280662,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5HAqAEGKH4JB+yMAbvF6IfGCTMwHYAQEAkJnwAAAQEICjCEuXRSSrhX"}
00758{"flow_id":48,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1835,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":281210,"pkt_caplen":312,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":312,"pkt_l4_len":278,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEqAABAAEAGRpvAqAEGKH4JB+yMAbvF6IfGCTMwHYAYEAl4\/QAAAQEICjCEuXVSSrhXFgMBAPEBAADtAwMO1aNpNC\/DfNA+zTgvlq4OTJH4Eaani+1AUzQaqTtdmgAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACc\/wEAAQAAAAAeABwAABlsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tABcAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAADN0AAAAEgAAABAAMAAuAmgyBWgyLTE2BWgyLTE1BWgyLTE0CHNwZHkvMy4xBnNwZHkvMwhodHRwLzEuMQALAAIBAAAKAAoACAAdABcAGAAZ"}
00795{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1835,"source":"teams.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":4,"flow_first_seen":1587041685251,"flow_last_seen":1587041685281,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":246,"flow_tot_l4_payload_len":246,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.7","src_port":60556,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"login.microsoftonline.com","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
00560{"flow_id":45,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1836,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":291122,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"EBMx8Tl2KDc3AG3ICABFAACTAABAAEAGgcHAqAEGNHHChOyKAbtGGzWIqB5wM1AYIAA3KwAAFgMDAGYQAABiYQTSPsjxWGWz4pCe4\/e9vVSjl\/Z8Q0uN7k1kWUEcGAc3\/Gbp5QJzgkXHFiB4HT74NNZrxT8zrukht5BQ2pVsvaE9T\/TxBN83rZAPJ4GFxp7hMLAUr2QcDHEgUN74E6qDjiI="}
00436{"flow_id":47,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1841,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":294102,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8VA1AAGwGd200ck0hwKgBBgG77IvHJo2qMLP5JqASIAAqDQAAAgQFoAEDAwgEAggKYR8CxDCEuVo="}
00425{"flow_id":47,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1842,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":294163,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyLAbsws\/kmxyaNq4AQEAlolwAAAQEICjCEuYBhHwLE"}
00685{"flow_id":47,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1843,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":294436,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"EBMx8Tl2KDc3AG3ICABFAADyAABAAEAG9sTAqAEGNHJNIeyLAbsws\/kmxyaNq4AYEAkImQAAAQEICjCEuYFhHwLEFgMBALkBAAC1AwNemFWVha04P4CUw6CKshmFd7ZG0fMDUFnrEIuMFFDaDAAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAYAAAACMAIQAAHm1vYmlsZS5waXBlLmFyaWEubWljcm9zb2Z0LmNvbQAKAAgABgAXABgAGQALAAIBAAANABIAEAQBAgEFAQYBBAMCAwUDBgMABQAFAQAAAAAAEgAAABcAAA=="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1843,"source":"teams.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":4,"flow_first_seen":1587041685248,"flow_last_seen":1587041685294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":190,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60555,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00417{"flow_id":45,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1844,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":302502,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAow5lAAHYGiJI0ccKEwKgBBgG77IqoHnAzRhs181AQBAFwiQAAAAAAAAAA"}
02359{"flow_id":48,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1846,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312634,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVEFAAGwGwa8ofgkHwKgBBgG77IwJMzW9xeiIvIAQBAWJ5wAAAQEIClJKuHcwhLl1i+Wbrav3bQpcZNAwCwYDVR0PBAQDAgSwMIIBJgYDVR0RBIIBHTCCARmCGWxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb22CG2xvZ2luLm1pY3Jvc29mdG9ubGluZS1wLmNvbYIbbG9naW5leC5taWNyb3NvZnRvbmxpbmUuY29tghpsb2dpbjIubWljcm9zb2Z0b25saW5lLmNvbYIkc3RhbXAyLmxvZ2luLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgh1sb2dpbi5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIfbG9naW5leC5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIebG9naW4yLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgiBzdGFtcDIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEARVCFDXaNOijZYnNGoRWvtuOpazT+6a5NhffPDEd8mw13I5P2ZjdjuwO0BCuAa0rcrb9Xsv2qMoirtQ46ssv7U4RUbJ2q644olWDdoDLw3u2IwAi4+it8uqFANVWf479pYNzQSRACICWvLYyZOXoCzSVgryqqt6S9JYKLV\/5cOCwnLGXIMXunQZDJ9OLbjk3hV+y1gACDA7qTWXqQxmgI9aFpumAbRwTxqZV913sHD\/Cf4ut1VrXdDHEcgGroOgboavAnBPF1buLwyr8dsFVfenl1cv4K6OyxBhOa\/qPQC3E1A4UNtSz4dz0swsNbngQZDrl3H9MqpMRswrpJ9jUAZ4uzcbjmByMFT7UrO5NyfE2e754OXgg0kzSG7F0aYPVW64WQaAN5alS554Apkxzpnhy4dbLpcc+qDxw4uZRbEMvvqiGy3Tzvw2N2ZlLhpfCA79zVH3D9QcugIgQY75KsamAAzOcbXq0zT0xKgmRKBpdzG5DeC2KsBbrTTak1bUSSPLjvYpHhgabRiV7OEik97n1Dth5jNj0APlNTe65xy1gwKh4ItrHo4sQMKfxY9NyTKSBVKN3poUeJpe9p2ArtCr\/ZmVWqTui7XFpZPfiQUHWHxyvx0VTPR40NEp\/NGn3Uw7Bd\/MS5F6AKZAjGFEeyvsfA2p3QKRyzfNkfQWM3fP8ABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UE"}
00440{"flow_id":48,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1847,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312734,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR4XAqAEGKH4JB+yMAbvF6Ii8CTMwHbAQEAlO8wAAAQEICjCEuZJSSrhXAQEFCgkzNb0JMztd"}
02374{"flow_id":48,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1848,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312858,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVEBAAGwGwbAofgkHwKgBBgG77IwJMzAdxeiIvIAQBAU4LQAAAQEIClJKuHcwhLl1FgMDETsCAABVAwNemFWVv+Y6Y91elVdimLTxSMDEgN+ZC7m319R4\/GiuNyD5GQAAggqJCs0Z1TO0tYJC\/t6PSBilZOLYH0pNL\/WTl8AwAAANABcAAP8BAAEAAAAAAAsAD40AD4oACcwwggnIMIIHsKADAgECAhN7AAL0+uu8c4DySSOTAAAAAvT6MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xODA5MjQyMTQ5MzBaFw0yMDA5MjQyMTQ5MzBaMCsxKTAnBgNVBAMTIHN0YW1wMi5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg9uMC7tn8RKm9hx1Q+vclCmv2FS5644lZCwDqwzCYb8L0QUXObmurDTp9z7imH\/68rvf0\/+KpPvZzn8n+A1ECu6H51tc4jh4cund1rKWCEvaClslKP1O5XZfDppym7WFQSIHQp9LXW26FaTqarCYkxKrkm\/lTdJtaXF5\/C7ZRJIFVaL9dmL\/uMiooAbDLhN56zmBjGeB2V01oJAQhD\/q\/lznyyirBK2V2vQ7WyyX4O7R5ox9CbJ7fjHmVfu5B\/IGhKzckLb+kPv4Ou1DFiJ+VjXUg8+HNiqYybm516lzAMR9GTpDm\/EaK\/DoNiRmeP+V6xIxpVOXNmdtJ2yXkhn+AQIDAQABo4IFgjCCBX4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB1AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABZg2YTSEAAAQDAEYwRAIgNf1dCr\/A\/68iTF44ctzG4dfYj5k8kwrcMxb+OAftshACIEOFf1L8DyVWvGmp2q28iEZd5RDO6L\/3eE60TQKPTKibAHcAVhQGmi\/XwuzT9eG9RLI+x0Z2ubyZEVzA75SYVdaJ0N0AAAFmDZhK0AAABAMASDBGAiEA6k0qgGOQ2\/4vWshsmYpY7DSpdiwLlTeFqoSnh81\/2Y4CIQDv1+L779lV6U+goVXZN5Lr8mJnM2dtvY1ZqBBLJZkaOwB1AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABZg2YSsoAAAQDAEYwRAIgWKBW8MG0XWRpOFEy6yhRlkRMXWMvZwn2MMfc6oSrj0gCIBftriorxFHUNkLYAHoFWkhm8hNqcHO+KKiAs49boZzUAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFmDZhLTgAABAMARzBFAiAA3dU0fJfG9tq5Rc4+sUUH+XraMuPYSatYD6LC\/2\/zTAIhAJWqprUivm3Ca3RKEfcrJtar2nlcdcqed0u5OIHS\/4PYMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUiTQV2m224F\/j"}
00425{"flow_id":48,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1849,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312905,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5HAqAEGKH4JB+yMAbvF6Ii8CTM7XYAQD6\/9hAAAAQEICjCEuZJSSrh3"}
02380{"flow_id":48,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1850,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312975,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVEJAAGwGwa4ofgkHwKgBBgG77IwJMztdxeiIvIAQBAX6sQAAAQEIClJKuHcwhLl1CxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gMAAFJAwAXQQRd7MSvhilh4+CUoUFa+y2vKnBmF\/\/7ZloBHndYZujdVHOrzAlcOkeC1HZ23W2nTeinfY6qCDPHfyUYhwOO\/Y2KBAEBAGy2\/wBljiVTv40+D7J+ShUKlkoKdiNZKI4znViS9GIjmeK4oJgRfXgxLuJVWXwpZHeYDG40TDwSRQy71NbS\/+hs4+f2Bqgw3P+lgCT4PsErx\/jYTSfIZdXQJE9gN8CQnQZKgp0v62o5xCPmRA3pfQb68jnzeX0FQkR4KtI3ASjHz9QKOxQiAdWX7Vdl1WCFbesaoC4ul7I5Jn0wWm6nlYhrigeK"}
00556{"flow_id":48,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1851,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":312977,"pkt_caplen":162,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":162,"pkt_l4_len":128,"pkt":"KDc3AG3IEBMx8Tl2CABFAACUVENAAGwGxu0ofgkHwKgBBgG77IwJM0D9xeiIvIAYBAUO+wAAAQEIClJKuHcwhLl1ylIYhh1swUUdzt0KIS+x1yDp112dFthuI7SvetM6QxZom320GzRkGy4oMbK3AzzTWBg7wjuVvNRmSVVhN2H19kOsZdTAWmUhAssMNxz3OXOwpycUFK29pbHFQLwOAAAA"}
00425{"flow_id":48,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1852,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":313016,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5HAqAEGKH4JB+yMAbvF6Ii8CTNBXYAQD9D3YwAAAQEICjCEuZJSSrh3"}
00598{"flow_id":48,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1857,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":323146,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAGRxPAqAEGKH4JB+yMAbvF6Ii8CTNBXYAYEABr2AAAAQEICjCEuZtSSrh3FgMDAEYQAABCQQTwKy++HLBtGg3Uqg7Hj4cA5s160E2DLTa+rmI87ZN0CX5oGqVGwimriQ9\/3X3sl3qMqHyHVJ4c\/QEsIoSoJS59FAMDAAEBFgMDACgAAAAAAAAAAGcf0ldkqcTx3Mlc72Vgh1raGQFeDzkjoXhtD8jNFPtP"}
02367{"flow_id":44,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1861,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":327366,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUaa5AAGwGXDQ0ck0hwKgBBgG77IgacWa\/co2UYoAQBAV+ZwAAAQEICmEe3EYwhLlzFgMDEGYCAABRAwNemFWVd4ONVISrGBzenOh1wz59KlhffXpAp\/SRVzeitiAuDwAAZ8HaIUQ\/TUKOJyzDpeZ2C6OXN9Z66nmD08\/sf8AwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02360{"flow_id":44,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1862,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":327512,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUaa9AAGwGXDM0ck0hwKgBBgG77IgacWxfco2UYoAQBAXqeQAAAQEICmEe3EYwhLlzLnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00425{"flow_id":44,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1863,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":327559,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyIAbtyjZRiGnFx\/4AQD696oAAAAQEICjCEuZ5hHtxG"}
02217{"flow_id":44,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1864,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":327736,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfabBAAGwGXKc0ck0hwKgBBgG77IgacXH\/co2UYoAYBAXZxAAAAQEICmEe3EYwhLlzBM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdIOCr76LZu+DzyppiQ4LXLjCknXmVh5L\/rzTB1MVm\/KYrBAEBAAxBncNrD\/LiaoNf070Ud5s0K3Qj6M8xR9RIm7PcqW5BGU2RT5bJ1J1\/vPw\/kEHw5B\/Uel\/7Vump0vJ2PLzOrErRyyCy28H\/CjX4MS5ml+FO20xzXCyrWMM7RTfG5O8pUzdUipdnv5tp8CEA9qx6ymaIH4LQzcd25exQ1jXi1wp2wpq1d3aNjekPj4eK0nEZdfqEb7DCsRd5VORtQjWIRft09NKay8Oga5U9FYZDF3Q3Jgh7ntp9aEW45cCnmqMHChTsgN77+cu6BRJVKaTHLAYBcjy+pnzEKqtwv\/FE2G8wlFpV2sdcybgRd9GbYcZ+DBsXlYzmLLHTjMll+hgnm6kOAAAA"}
01311{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1864,"source":"teams.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":8,"flow_first_seen":1587041685232,"flow_last_seen":1587041685327,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4409,"flow_avg_l4_payload_len":551,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60552,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00424{"flow_id":44,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1866,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":327777,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyIAbtyjZRiGnF3KoAQD9Z1TgAAAQEICjCEuZ5hHtxG"}
00554{"flow_id":44,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1867,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":329295,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIeyIAbtyjZRiGnF3KoAYEABTMQAAAQEICjCEuZ9hHtxGFgMDACUQAAAhIDvgCHP2mI9cHzHqLz85L4rinpyirwQM0G15qiz8GUl0FAMDAAEBFgMDACgAAAAAAAAAANX1ITsccwssQQ7QgJqtBU2+fCpbWHhbhVG\/24Xb2iQ\/"}
02367{"flow_id":47,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1868,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350456,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVA5AAGwGcdQ0ck0hwKgBBgG77IvHJo2rMLP55IAQBAVq\/gAAAQEICmEfAvowhLmBFgMDF7oCAABVAwNemFWVkv8HhgEBqRl7J096sK\/AcfyJkv6Je+CA9SLGGCApBQAAsHV\/DAKaYivrrDw\/3qGp42fGJ7afmMuMlyPWksAwAAANAAUAAAAXAAD\/AQABAAsADt0ADtoACRwwggkYMIIHAKADAgECAhMWAAq9oyiKJqzr8XheAAAACr2jMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDAeFw0xOTEwMTAyMTU1MzhaFw0yMTEwMTAyMTU1MzhaMCYxJDAiBgNVBAMMGyouZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKvCd9UicgkwpI8bSwvCRO2lOesvtPd+z3GH6xRllv8Ei9b8VelLW2PuVMgau2FL6GVCPmGFiOhTMrB6Z5IhkEeYdzS19ordJYDNCTCV4CGHzvr3YSWpcXIsFnyRznGOPnlEMKU5qRnjk8yv7HdVvlTmG5IFjydJQBIE3EVy\/zWWQLcnHvkr+Pm+Ix8GPacEMThyVrZ57NGyt4w\/0XALYy3lIrBrwRrbdUiLTzkL4A+otgHb4wpI6lV59J8U\/8irhpL7YotYvOZ643jEuaSoC\/jdiOIKCF3kQGitPPXXdCq5zTupCxIYUh4B8CR5z8H6nlx9UNqdWcNq9d5jrCXcj+0CAwEAAaOCBNcwggTTMIIBfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdgD2XJQv0XcwIhRUGAgwlFaO400TGTO\/3wwvIAvMTvFk4wAAAW23tMw9AAAEAwBHMEUCIF1LvMGCv0Kl+bp5C3GlL+E\/KEFrucmW+jN0WG1BTye7AiEAlb84qvncp6SV0hcgJPmaG243TJvGYrss3NJol6FvYZkAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAW23tM08AAAEAwBHMEUCIDiK+zbmA9fB\/F+jlf2HQYINB6AsuO6IJw9RLZW6d2VYAiEAgFQKKr4w6oc+CLe9pgqJVTk\/xWbnsVo3VT1pL7gD2NQAdwBElGUusO7Or8RAB9io\/ijA2uaCvtjLMbU\/0zOWtbaBqAAAAW23tMxBAAAEAwBIMEYCIQDC8ilwFdB7z4rC1+bZS4g04LUlLUYH350FnOYfD3Y\/DwIhAKOhDWx9PqjkWoW1QpLAVveNHTmUFKE125bJ\/m64vRMUMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUGvpD1lPIMLQZUxjL0t3R6SFpb+0wCwYDVR0PBAQDAgSwMIHyBgNVHREEgeowgeeCGyouZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIZZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIZKi5waXBlLmFyaWEubWljcm9zb2Z0LmNvbYIO"}
02366{"flow_id":47,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1869,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350487,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVA9AAGwGcdM0ck0hwKgBBgG77IvHJpNLMLP55IAQBAXV9QAAAQEICmEfAvowhLmBcGlwZS5za3lwZS5jb22CECoucGlwZS5za3lwZS5jb22CIioubW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CIG1vYmlsZS5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghUqLmV2ZW50cy5kYXRhLm1zbi5jb22CE2V2ZW50cy5kYXRhLm1zbi5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBR6e4zBz+egyhzUa\/r74TPDDxqinTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFMQpslR3dx+wTZu8axQ1nNJVCkHxX72SY+3xpu9NsmDXzW9ex97AzDMmxVtMb5S\/RM82m\/VJB9vbs6aS3L4Ej22rJMqFcPtmlFAzllPQTT11+eX2mndkdSOirQvj31e2C7Zm4nL0hs+AKs2MPWa3qlMpm7cBR8fphI9au21dxJ1Af7ZFRiS1OK7RLGzTsjWNK09TD0Xtqmes\/DkyP1G8HsNkvgs0KujUhIpxZ6ENuHd9y\/fkNlUeyCcYGSWdCSyUW9hJJsgUxtWyT2xYgA3VdbfWEmNqbO6FXpL9vXf1wyDgwJ0BUdSB6pTF7Qu+01qEbIdV+Kwt4krS5vu2A1zXGf+DI\/SLqA5lmr25CQg9Heab6zyCwGbbl2obr0M0LQGNp9L7tfgIR8TG5PXti9oiWG5Pvj\/xgkrB9BNzMBbhgcdmg\/JHA\/xmrDkoCdoV9T3phm8e\/2PRRkLnVYTeoJIy74omcWUBgyN4XOGjZEqOhxVzHMFTut\/kS3eRZkHF8UOMEIDmvIDxvWflrHn2snVI4z3RZqb8ZQvC\/\/4cuVY9vaGe7JGkjaUgsgUjZAbJAM0rfXpedGVa4TOSeItwRtYyVRrtqKo5csZW34aGulXTm8aYBl42EawSgmDCThkiFtRwbFaTzh4jtx00U1knN57J6OyoU7euTQdm3Rh2iFxVtfHAAW4MIIFtDCCBJygAwIBAgIQC2qzsD6xqfbEYJJqqM3+szANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTE2MDUyMDEyNTIzOFoXDTI0MDUyMDEyNTIzOFowgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq+XrXaNrOZ71NIgSux1SJl19CQvGeY6rtw7fGbLd7g\/27vRW5Ebikg\/iZwvjHHGk1EFztMuZFo6\/d32wrx5s7XEuwwh3Sl6Sruxa0EiB0MXpoPV6jx6NXtOtksDaxpE1"}
00425{"flow_id":47,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1870,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350571,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyLAbsws\/nkxyaY64AQD69cigAAAQEICjCEubNhHwL6"}
02371{"flow_id":47,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1871,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350732,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVBBAAGwGcdI0ck0hwKgBBgG77IvHJpjrMLP55IAQBAWSYgAAAQEICmEfAvowhLmBMSC5OQTNECo8lx0AnpkYGAnPS5fkyfwA8AxanTboskDBSqyEKKo9Rhgrp4qs9K9LqH5JQsdiIMDmpztd65Afu4rYnJDjOrFswpTOPjJry3GzQS65xeFd2FkngvvhSA1+6ATx+QEnQfqUWn3FMLu2utcRm4j6AcxuS5K5+Hg8y5xomhZmiNCTsCqDLpcRHX6BIGHksLmbnG5TlZUixtm9dRC62XWMPD8d0Jb4M0V7ex9UM+VIl6cFJKLb0dyVriAqfZaJSHuSetAksd5IEfdnPLTf+Fhg9U97NGjm\/awmCLbzLEPbT8QW0JsMcYexB2uG3Y+gsftm2tjL6fLwZeWO2BzqL7otZPFe0BtQsgyFSs87yC4qanWMwK5c2enAfH182pzjvUqwYAeCK31dyBCvLmKM3Jr94dm5WUiXQhrDUIELH4Mia+SbvCkigv2AUVx1Xw41wt1\/L3pnnz2OW4y7r530zAz7qB+dIcHz51IaXc4UV21QuEnusQsn0uJpJxJuxsAmPuekKxuLUzgG+hqHOuBLf5kWTlk9WWnxcadlZRsCAwEAAaOCAUIwggE+MB0GA1UdDgQWBBR6e4zBz+egyhzUa\/r74TPDDxqinTAfBgNVHSMEGDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9PbW5pcm9vdDIwMjUuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAR\/nIGOiEKN27I9SkiAmKeRQ7t+gaf77+eJDUX\/jmIsrsB4Xjf0YuX\/bd38YpyT0k66LMp13SH5LnzF2CHiJJVgr3ZfRNIfwaQOolm552W95XNYA\/X4cr2du76mzVIoZh90pMqT4EWx6iWu9El86ZvUNoAmyqo9DUA4\/0sO+3lFZt\/Fg\/Hjsk2IJTwHQG5ElBQmYHgKEIsjnj\/7cae1eTK6aCqs0hPpF\/kixj\/EwItkBE2GGYoOiKa3pXxWe6fbSoXdZNQwwUS1d5ktLa829d2Wf6l1uVW4f5GXDuK+OwO++8SkJHOIBKBujxS43\/jQPQMQSBmhxjaMmng9tyPKPK9FgAHKwEABycwggcjCgEAoIIHHDCCBxgGCSsGAQUFBzABAQSCBwkwggcFMIHHohYEFJ\/ldPQSLwcZJHaSD6SOKmapFFoKGA8yMDIwMDQxMjIwMTgxM1owgZswgZgwTDAJBgUrDgMCGgUABBQirwAcgHViBybgyJMa7KdCHDISOgQUenuMwc\/noMoc1Gv6++Ezww8aop0CExYACr2jKIomrOvxeF4AAAAKvaOAABgPMjAyMDA0MTIyMDE4MTNaoBEYDzIwMjAwNDE2MjAxODEzWqEiMCAwHgYJKwYBBQUHMAEGBBEYDzIwMTkwNDEzMjAxODEzWjANBgkqhkiG9w0BAQsFAAOCAQEAECbjKyDb9piP6hJkL6wfG9E8D09C4s5EJtshDBi95KyeBNmrhANouwaebIfXIBuDmHtHIJMqNzg+MDdajIvhQs4J6\/eyP1lV09t\/FIIkE4pCBQTXyxMmal3Q47TQ0Kl7OnD32GWGN\/AXz50m2PxpLaVqTyzn9+k+CNLi5FLecb3y1PhPb38PVLwdKd9NCsFonNvmPocHr7gn"}
00425{"flow_id":47,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1872,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350807,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyLAbsws\/nkxyaei4AQEABWmQAAAQEICjCEubNhHwL6"}
02369{"flow_id":47,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1873,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350844,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVBFAAGwGcdE0ck0hwKgBBgG77IvHJp6LMLP55IAQBAUzCQAAAQEICmEfAvowhLmBSqXCnzW92VpGfmYH1m1omtpnznil4dlESqAdtp3w6FXuEWbbWJo8SXlGFwdbk4I1pl1VcrvqNPn0Bj0YLUNyg6z\/RLXSi7gZzsEq6arWNJbWEMn937JTQo+WYGloIYmbu2BlzuQhg6CCBSMwggUfMIIFGzCCAwOgAwIBAgITeAASsndh+c7ajH79vAAAABKydzANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwHhcNMjAwMzE1MTUzNTM5WhcNMjEwMzE1MTUzNTM5WjArMSkwJwYDVQQDDCBNaWNyb3NvZnRfSVRfVExTX0NBXzRfS2V5QmluZGluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMATIBf7lKqwaKqhQFEwttQXUw5ByzEryQ9IoNXEbLDHrZNeqiyiT\/DxYjDnV6K2XbHuEairT6Hd\/3mI+WXHLvIQyAfuqZ501GK4bFEr58Brkwf1pW2WiZoXKoECvKx17jX8de4vhRbga3CICRPkTGATbAdgRXtPlfTdiwBZYzckpDAyMH6tdmR+35STkxYv9wm2jn7IwvRDAmvbAv0CTrpsqy4QycZ3xTOgA4CnlGTQObFHO01OOX+Vnae0VewDIkAvHerQQOt4vDSrZJ+0M6J5QeY2w69sA+NixYq0NdrKFdHSCqTABtqZJSuYVd\/pATtcNC4dNHIbt3+ytRJw2UMCAwEAAaOB1jCB0zAdBgNVHQ4EFgQUn+V09BIvBxkkdpIPpI4qZqkUWgowDgYDVR0PAQH\/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GCSsGAQUFBzABBQQCBQAwHwYDVR0jBBgwFoAUenuMwc\/noMoc1Gv6++Ezww8aop0wPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYHMm0eByOkWAgFkAgEHMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAFB\/+eVKiCzYpoy5Agpf51mXq7983iy06QEBMgD7xZ+An6o3IXbTIKWWdGFupril3klOtFgYlmEYDtqBrObKKb3Aa9XQdwfEss3eg1kE\/mAXmMsLQirGAkS9OLLLX\/XBhF22v5Klwo2LZkJpzfHu+gG+x\/dgf9\/WMCnbNDzuoqFHLU+ZxSQl2wlHY6eRg2B1Hqg8oKw+Q+976pleMF18RWOr125gzUgUWrQxhdSUULLxiGfERxqzHiYKcDoHXg73x7BpJlmEZo\/o\/L\/rstGG5Z\/fqpem29cjxsUlkSV3bkDlpH4I4e9hauVaaZ+J7cj1gR4MZNWh0eYfF6wt4EtBCbGm5mCcnV5ljBJLaDhs8345KieyA+UcvOYElxSnPEmXeaC1yPI37Y6AXjoDhXUQ25wJUZ0tiOxuj+STpTtXQqKoREwaMhR5RUy32181R\/rFhdSxU4qwh81wAxsOII7aF\/qr7WcrEInDqnSqwHUA2XMmLTRcfXu2+x128AGRHbqNBHFalzVyTiXoSs1igTXzp1SeVx2UqNogdTiNDgJLp9LUe5kVAPpV0+l8AVK\/wHHMLjo8cPjAyFQcXaDH0qn38BOtuisno7F5dVLUFr4hDMZfoylWwaIfbZXO6ZHu0S9+3DLQxful835f3IcGsmZW8Ubizp3rBQ4cz1xP0POIW8uADAABSQMAF0EEVUOl7pe4bv3w"}
00863{"flow_id":47,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1874,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350857,"pkt_caplen":385,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":385,"pkt_l4_len":351,"pkt":"KDc3AG3IEBMx8Tl2CABFAAFzVBJAAGwGdjE0ck0hwKgBBgG77IvHJqQrMLP55IAYBAUAZwAAAQEICmEfAvowhLmB1mwwl2HxCaeNZf17r\/V0yqBBRUoHnSvpJmfw6E5\/tgsHr+tD173BXAbUQ1q55sAirgtlRvVLMwQBAQB6UEtdRqN6XcCq+KRys\/Id+5V1qj9US4tzhJ0XgkMi0hY5EuDvbgQWD3\/fDG94JYyTghb4WT9Y+fDAtWTmXywcT2ZdIZxDZvSgmUvPjmr++A7GMVbTktM\/DKSuOgFp6shWbA5xJZUblQb7pxTkebO9BeatiO6RekvrEoiUUN+Xacl1ILS15afpfKMbxVZC7Ti0ZCITP6EGK7vKsDW4ihkofOECzrtFqRexltpRNoX+4QBQ65s87v77RRyCfwvscg5jnYI0zipu3ESDDT\/Q50JMmLnztzHXDSJj1xNv\/diMlo4Y3lpOj6meifNpVlumTA4JHWjK+W9UZsTw9LOeNTF1DgAAAA=="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1874,"source":"teams.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":11,"flow_first_seen":1587041685248,"flow_last_seen":1587041685350,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":6269,"flow_avg_l4_payload_len":569,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60555,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00426{"flow_id":47,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1875,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":350884,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyLAbsws\/nkxyalaoAQD8lP8QAAAQEICjCEubNhHwL6"}
00495{"flow_id":48,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1876,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":351722,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnVERAAGwGxxkofgkHwKgBBgG77IwJM0FdxeiJOoAYBAREIgAAAQEIClJKuJ4whLmbFAMDAAEBFgMDACgAAAAAAAAAAIBKHfNSFxBlmWv7H0u34ZHIWc0Rm83nyQsUXsoW1cEf"}
00426{"flow_id":48,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1877,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":351776,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR5HAqAEGKH4JB+yMAbvF6Ik6CTNBkIAQD\/72OwAAAQEICjCEubRSSrie"}
02363{"flow_id":48,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1878,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":352778,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGQf3AqAEGKH4JB+yMAbvF6Ik6CTNBkIAQEABq+QAAAQEICjCEubRSSrieFwMDBsAAAAAAAAAAAZN+26IKokM\/ZJdqew2hyoVZsYfwirlKPCuD+rB9vU36bay4A1aRuUa47So2DTw3mKKAAiCas06RU3RR8C9HV6Z3G5shmetImIwR+iC\/Q\/93kNmIa6dp0d8XBDsbQgY\/n3IfyicZy2Gsa6borBu84VworLrUTByg1c4zc0w2AIDXE4Ge9CKyi73QyCqr1WKf8qEhM4eKqonhDGX3WvOtK\/16UQJmoHXA4+NjaOu+6vEkftmUKf3w\/pXP0cg7Xi2Yr78W6quARHrOk7v5h5JnIC4Xd8f12f5t8dxxa7MrgaZc1w06ZP+O9J8va3gaemP8wDVgpuEMfeWo1uQ2EXidZGfUWa9yMA9m+TTDTlkzd1iZn\/Nd15FbyY1kAIdHfBaoEFvSIETFKB\/dO4WJubLpR5UwO2jRcmLHiOorUkYZqEC5eDOjqkFQ2HnDTsAOoBBYQqalZ1321SVZtVdbxPW0t0ew1tEKC12JOLpx3d+4aeTaLCcfdA7AoRUUBrwzLVNSw5igewuDRF0GKGdvRoaE0c+VD+sMCJEmmWQZFGMtgqNNWDuu1PgEukvCJDUfDxZ04oqRPtELlTFA+iJMRWW2BCJRAqN33wpLI9qm53Uyg4ZoqGlBW8lRrAWBvSGsj9INEFJe4t1SMknz3q+wJgCC5+nwr1WHMvuGBVUE8uNyIEihhlI4YYwf3o8brRpRSQNynZzvIPxUIcARhPxTY8U2g2nfAI+fPeRRnRcB\/JMbytApHr8RPcoQ2VjJEQ5P+ZnPB4qzF3tU8PJXKk\/Iz93vjGEEYv75KE4ta0KGyROUiJJTrhW5xgN7z\/eZTnQK9FiFR0Atsk\/5engV5VkbmCHfIEAQST5ANhzxnExz\/XgfGra31U1Agz8PXWDCjb+O2AYTbI8cGwTbd9T\/xyCrasD9mJsbJucAZHGKf\/a5BHKNrMCFFCKhaIpwDo+1RW1w0NJjyJHct7NQA2f+rd8TCA6M2pIHObcDe2vqlqyhTGPqOcGaFxyQoSMxiLZkBB\/ehYzov4hiC9432RW5wH7AA0dav8N\/oDVsYev8RrGepQBAnLtlyvd5lnLso0kbYBXlteD3s4skj7L5NdPE9X+d8u01QQXH5lD9SttP3ur2qZyaPuz7kpDt\/v559XF4HO4JYTPAIXYak+7giuBKbT8ttl1gLyjNTIn6Wb2hWVy6gD6AA13w9Bt17dPPjeWfO+a\/UtMWYR8jZixqzautoXV4BVjKLkcHeO1CWs9hTdYMuBtr5nlfBYyPtai4kwEX4sJICqG1hpox71umTInnnp9J8GWlnqi4lgcjwBsWA9+Mjtk7S8Scfqkuh\/EQ8oLT8FsmvIGiaAoY6BVVpnXLF2AabHaNa8wXCjSDA6eaDtdYF+QsoQuTNmhp\/3y6xHjUJehx511zgqDBpRQSOJVl5OjlTcRtI1NwasT2FzE7vJKWzBJOuj1hs0vJ5ptt8GA+tlwxcDlkNjchMnRRwrk\/VHlOzPsG2HNqqbkO2JdHao4tqQT3t0Gkt9IT19Nm6jDsYmNs0i92xoBf\/hsehulRy34vLcg2hnxXrElot\/fhUCcnrs7cz77h3YRd9PkBUXkBsR7OPHV8Jlh8DW6g9dP0xk6pNwFryNxGFcM0pFBQ\/vyQh0P8bXq8nL4tJxqFQyivuXoid7Jr0jLNMfYZKSqXKARnUfUFQpzWuamwdW13s3CLTE90ng26\/yTHxtLFti2GyuxFSSSjCcUaMRkHRsyjtwYhX9nQ7MMrP+Kwl2PuLRf+gnPXr8uUoLiVmw9cHavRxVY\/rFhm+5Avrile50yIrqN90GdsBI2GGlBq1qZCUF0d1+wCKQH5lwJsaKGM31hcF7AqjSv2AOn929yv7LeVra2p\/MVq4KOqG3QgISQF"}
00532{"flow_id":47,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1883,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":365562,"pkt_caplen":141,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":141,"pkt_l4_len":107,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB\/AABAAEAG9zfAqAEGNHJNIeyLAbsws\/nkxyalaoAYEACJxAAAAQEICjCEucBhHwL6FgMDAEYQAABCQQR2LdhnTLVLdjhoemvgAvid\/c5uLTUOsUTPRq73jWUkJpwr5TLWPvB+S\/rTQoynFejo7iEIeKUXIr7Dmo+ugaFU"}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1897,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":406369,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1897,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00425{"flow_id":44,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1901,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":417112,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0abFAAGwGYdE0ck0hwKgBBgG77IgacXcqco2Uv4AQBAWAZAAAAQEICmEe3KMwhLmf"}
02366{"flow_id":42,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1902,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":419490,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUjN5AAG0Gdfg0cg8twKgBBgG77IfA1AaSAv0PYlAQCARVFQAAFgMDF0UCAABVAwNemFWVsa3S0qCCJCKRvR5FvfRm4ku4Wp9dZjR4sGYcKSB2HAAAgvc9nFx0wNSQ+kfvV9B0Mq9ipN+Lt19U\/tPHHsAwAAANAAUAAAAXAAD\/AQABAAsADkgADkUACIcwggiDMIIGa6ADAgECAhMgAA1\/5iyI2CMUD4FHAAAADX\/mMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMjAeFw0xOTExMjkxNzU3NThaFw0yMTExMjkxNzU3NThaMCgxJjAkBgNVBAMMHSoudHJvdXRlci50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyKcimDO37qOiITdGLLSgRk4SNqeQiChf5fToMO+7e1Qw4j4NVAURrkRlqOSwosi6x2ool0Qjlt5bANU2A7E0ubHR6fs+J4y2vgrsv41S7Ao\/UxdKklkG0wgp+paNcl2enqs+JFcPVtFPe+T+pnY6IZUpOziGi8NLx\/K2NG5xSvrdawVpY5vXRxXKsvLFIAdaJQozyWf9lCNbt+4C0IVl2Ep7N5bp06LVMZktn1YAjolqeEl3RQ6hM3GKceom5l4hpyP43E\/dTe3eLNBfmO8cDd9p8HlGVSrgjhKz1wuJWFoWgHTgDnVBSZVB7t78lIFlze4qLsPX90PfKUlmjF\/zIQIDAQABo4IEQDCCBDwwggGABgorBgEEAdZ5AgQCBIIBcASCAWwBagB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbrhZJv4AAAQDAEcwRQIhALfHXTClbVL1ZG3BQH+fsd9EVlnIhlrRTh9b\/BWQkqOPAiArDlgg99bYekywwY8T40DyNspZOTZKKrpABVWSIcE7CwB3AFzcQ5L+5qtFRLFemtRW5hA3+9X6R9yhc5SyXub2xw7KAAABbrhZJyYAAAQDAEgwRgIhAJuNw4ivK3DXIXmUE+m57QEHF+rXHdB72ZviRwQ9s+0GAiEA9kNgaFnkw8l1xiyZdSGjaIfmqNZ4qpxCiXwbbmlDWu4AdwBElGUusO7Or8RAB9io\/ijA2uaCvtjLMbU\/0zOWtbaBqAAAAW64WScNAAAEAwBIMEYCIQDmc93n7UJEyvvIddsbJMxC7aPmS7n2Z\/C8vjlA2j\/H8AIhAP0Hy\/4XLfkD3pYHuzfG85l40mxoPZVRGXbh3zqAj+miMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAyLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUdTnCFCgplfnCaQOBNT9YTfK9XfMwCwYDVR0PBAQDAgSwMFsGA1UdEQRUMFKCHSoudHJvdXRlci50ZWFtcy5taWNyb3NvZnQuY29tgg1nby50cm91dGVyLmlvghEqLmRyaXAudHJvdXRlci5pb4IPKi5kYy50cm91dGVyLmlvMIGsBgNVHR8EgaQwgaEw"}
02362{"flow_id":42,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1903,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":419728,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUjN9AAG0Gdfc0cg8twKgBBgG77IfA1Aw+Av0PYlAQCASwbwAAgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAyLmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAyLmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUkZ47RGw9V5xCdyo010\/RzEqXLNowHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQBVY727HtdDTWTVU3AbtZ3tnfdD+ZIlKkcEvZhdGtfLR93kO2x7R0zQ0gqTA4aKylbIsNQcc94W1dk55E3115Ppa6TByUSyEBMXJpQIozocfAobGecmcxvfsDbO3XlvEk3eGXCNw1GEP+rtYMU\/+G1gqniGLhyjzsQhOICG4HcvANg6cJySwm\/SpQOH5H5DpyW4ysI7O05cptAk2rTAECIrDpTpy71oDwjEsWh37mPcHPwqAlJXrBDfF2Q7AyWmFm9QtmVUjJVaSctLDzU7VRUkK0aCtXPjvcWrNR6x4uytuNZ4gOZpOrX1VtGx1rAv96q4SlFQBqy6dFVxh0bQLZQpABKb76cwUG\/pWvDwYapu2OitdqL57QTlrGdYa8gq7xRwy4BU2eaYR9SKjM1frVxvs5WmDo4EazQeDEV6fP909krjox7GYVlqQy3SY9nhd8uKRKiMrkg1OfFkJGSK0\/pkD8Pkb8lOaiQvEH9UotHMfjDU7K5\/h5EZSCzJCECqM\/4bVsM8Yk0bqsKjHgiO87h8gMUBfXt2sbeoARoOxGRoIatLpqqBn2fcpLxHrpFlVa+NDdwfaczPnNdQDU959HgnZeOmBRL9lYJRLEoukvVJGyjGLKR8KcZ7QGVBfKeDslSsW+TEb7QkPKwuy1yk88fuHFa53lEyjPd7CdVCLrtRWwAFuDCCBbQwggScoAMCAQICEA8sEMlbBsCTf7jUSfg+hWkwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUxNTdaFw0yNDA1MjAxMjUxNTdaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ6qFcEboWNf5lEYxRa7EdwLTZuRCrpASSvc1gYLxXdZLDRCRQtOqMkW8CjzH5aVvx7Tn8yHgZYhpOezMGatfG4AEq+9LD1FrqA\/dex1IAX8QWKBfMwO2SHucwBzgxW6CS+xYP2qYG0LPxomWTQotEJEFFs8NJ01JlUjUNJs+qQrveQ79VjLCxsjxn3Tfcw90P0BA8ieveUII0SMWANQ1BPueLYtpOq9MnChUGJMlsGduRw9YdpGLd6L1vObxesu7Y06lBHC24ClAgfNf\/eeYXSy7GxXen\/aNj5FPMbjnN1Pm1Hnb7+km7bxowRGXhch\/PwmkIc5bCjB9Pjjzhb\/2zKnC2qz8NVdbDldW5eF"}
00409{"flow_id":42,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1904,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":419787,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGNYPAqAEGNHIPLeyHAbsC\/Q9iwNQR6lAQH9K3VAAA"}
02378{"flow_id":42,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1905,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":419979,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUjOBAAG0GdfY0cg8twKgBBgG77IfA1BHqAv0PYlAQCARavgAAvb4ttu\/J4m5cyGxB7e5zfPPKeCjSMKgnF2hoW7UuLY59zSiOr9Xdl0csSLwiQ44KGdPcxd\/T8qHvdrEkYpGYe8Z7OLUBEPAQrOKOTQUsfFMRLIMszUrJFhhFqrCI7fu\/gNbJAw2b+pNqPFQhzW0yxSku3e9sDCOBK6c1bASInMWhtns7jAQbqk4cSIifhvc36D\/ZcYpv\/a7yQMW4d57owNVSX5DmEySKIxAGAsUd0IxKBnWqSZgZXvewH6hAZ8KCbLtsGr\/Ifb\/qaAy+IenUc0VMWNQx8qXBZVxqB7v0REIBS6tiDd9PwIUCzfdD4\/U09kUBAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUkZ47RGw9V5xCdyo010\/RzEqXLNowHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAbH\/qam\/Pa1vBNKz\/3A7gfYsTF+AvTlkOxAO59AUpZUeuGZroVPZk1di9BuBxIhl7zprdeYvfcCdIaNv3bzMZtWXrn5AHzLhHOX0PURORDYDUdlArhQdgbW1ZmilAFsbHDeBqV0uACb\/vx0tFV7OUrtfSdAwPAYPpaPHpApeHathtZtVrArxQSKCyI3eJ3gi5RqMU9owON5Y9iaUP0jJC5C8vQ14\/yR3bKiQ0eaIHIo+FSF\/Ffm1Q9DQsO5EGulJavWaNIwxKtWreM0nh+JldjzDNy8CFwQNsaObHWtXJ1FiaNz6uLjIHC3tLfnwrrd\/DTJE5fBdGq35bKWqlFVVKLxYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQQinL5+VZH8gss29IEWEhOCyTc8xgPMjAyMDA0MTYwMzIwMTFaMIGbMIGYMEwwCQYFKw4DAhoFAAQUiBpKdP7\/RlLzVLtRD9Ok7u\/gocgEFJGeO0RsPVecQncqNNdP0cxKlyzaAhMgAA1\/5iyI2CMUD4FHAAAADX\/mgAAYDzIwMjAwNDE2MDMyMDExWqARGA8yMDIwMDQyMDAzMjAxMVqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNzAzMjAxMVowDQYJKoZIhvcNAQELBQADggEBAGZPFXF8IQ\/SRPWKKp7KC61LgS5KVOYLdHbtwaIIPmon22Cgf69m1EQdYfxb8g3nPOs7g4KhHJVe6V5GT3W0BAVAYXkyAXRX1rdeYl4k6Lptuq\/GUH+wmnbP0AS+ch3w1t0wpFWEOyy+p40zuygvgvLcuKSJKpYUeyhVy\/n0CJcyHNKBggYoiCfUbMri7qauxfRdr3OKr2JgRDUjWdLDd0Q\/iihfLlpECiCLFc4UNOzidoZTOK7jrlfhkeZvdZwoLBRgeNmLbd8MgH1MPHqqqlg+PIesJ5gVFAZleGMM\/D5nvoG4lWz+hC\/uqeYFFPT4r9QMIVMdDsvUc7ccwbCMWSigggUjMIIFHzCCBRswggMDoAMCAQICExwAFdEU7EXkJ4HoLdUAAAAV0RQwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQI"}
00409{"flow_id":42,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1906,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":420065,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGNYPAqAEGNHIPLeyHAbsC\/Q9iwNQXllAQIACxegAA"}
02369{"flow_id":42,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1907,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":420101,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUjOFAAG0GdfU0cg8twKgBBgG77IfA1BeWAv0PYlAQCATN7gAAEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSAyMB4XDTIwMDQwMjE3MDM1MVoXDTIxMDQwMjE3MDM1MVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV8yX0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDxsiBlqpOW25S5JSJRGJ1elO4z8Cxx8jNsk9kLYVQKs+e98oaED8XegtCmY2gfy5SvlD2b43t9l71c8xjHJCDkMkZMu9JTyFDBKGze6W\/pLHEFCO6kHAhZKXuFehTyqO1Si8kROv9Qfwcu6ZFKCosAsHZ8MyCYYG1PPEngklFLDOyceTJEc8vjwGq4SxDde9z\/TqVuryShRAwtvRu1OQIfFCJn5YrZEl10823PNr9KRyR9XSB3vWefjsaTm80al5kWLASp9YF+YJdK5zrvYTgTOU\/5y4S10IaaefssKozfAjHMgxAw5pvouW4dzl\/qCudhVPWmxVHmHX4g39wOLeobAgMBAAGjgdYwgdMwHQYDVR0OBBYEFBCKcvn5VkfyCyzb0gRYSE4LJNzzMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFJGeO0RsPVecQncqNNdP0cxKlyzaMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQCUrZ1UklznMIstdAw2M6U2kCFNmXzLi1q6isY0VsZrflxVnjm68aj\/9BhhNAL3xORW3nX5VdPYd\/DrWkCDVHAdHxEEcdfeekSO2ss1HNjwDiEg02OUE4SdwYvw9d6TYuhpbysWpom4PxIdl3QcGot8R5TrzqAANlQ6tAlH\/152BpvUWfM8\/yUm5F\/Nuz+nR6c5u4Jx0jNIc11e7yrKSzVkrzgLbBsjWF8eGVJZNGQyeB8C4Q2gSpObfL2XBJ0Du4mDoAe5JiKIhHwaDG0Ey64kEg9iQgBAL14zEzrqtLhqq9urFLeaU0HO7yZNz1rmJ2UYdL3ZdD0yl3RzAScs7WNaOjbaJjluDUkCVbH8GhRymqIyBIRWJ7sZRsP+k6aHGSKD8TcuLwh3L3EWb24qtbayC\/l2pwgA2pPIvKz8ObpLi\/PtR4LfVN1MMDEhmd\/A0XbTocInVs6H1B+mOIJqIc3Tgn5etZ1H2jnV1ZRD6SyhVfqSmO2E9Uk2jLeb6WqJV8Ii3Q81ZZ\/aGfjm6w7U4decHkKlYzns14MCLBfGm0yxaSFjYyD0IJho2p4Ucid0BvebSCTHzGuJ8\/ofHL6ftnGIFd\/1GjwbG7VVeTWD2feQlQsJnGLuQjv8TQ4xNBaYC5VaRqSXyaKa5Twegd7h7X3PgshSrKG7sVflIdflHtcmNwwAAWkDABhhBOJCmP665u+jsfKoStrafe1IG17spRyNcQ9radLxgk1FfIpXmVcotZ3lmovr4XEOi9FU9Dp3zgoxh37t9whGJkD9oSn7OyvaAqtNPnQqq1T3Ty3OFPdgEVsDyBVD1FPumQQBAQCDUp45bE+gKwMoR4DNbqkKHriRNXKiJfLuCO2cDPuQu+48iwJLODvS5\/Y341RmrixwM0YJlVGjfqmyiQP+QnGThX12oVsW1BYrve57\/KoCwbnaYSn+HeOgJtOe1NJFgZwomlBQOR3bAbvY"}
00622{"flow_id":42,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1908,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":420103,"pkt_caplen":208,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":208,"pkt_l4_len":174,"pkt":"KDc3AG3IEBMx8Tl2CABFAADCjOJAAG0GewY0cg8twKgBBgG77IfA1B1CAv0PYlAYCAT33QAAhP8kGj4A71uZvPuiIFQNgmojQyaAV6pd1jD+lOLbBOEBkTitcW4qGNMWpLn0+DB74MywI1q+MsMrl9My\/pdszw+\/257T4TKQGFMqcjqLSt5G1XTEqzbXOxxwgReoxUjqT630fph3hTnJwYPYvxV91IFSGcWpVdfcj52uSWwebMcG2nFbczAZWuaUPPSbPbbCU33y2ywSDgAAAA=="}
01187{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1908,"source":"teams.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":11,"flow_first_seen":1587041685106,"flow_last_seen":1587041685420,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6165,"flow_avg_l4_payload_len":560,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.15.45","src_port":60551,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"trouter2-asse-a.trouter.teams.microsoft.com","server_names":"*.trouter.teams.microsoft.com,go.trouter.io,*.drip.trouter.io,*.dc.trouter.io","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 2","issuerDN":"CN=*.trouter.teams.microsoft.com","fingerprint":"DD:24:DF:0E:F3:63:CC:10:B5:03:CF:34:EB:A5:14:8B:97:90:9B:D4"}}
00410{"flow_id":42,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1909,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":420144,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGNYPAqAEGNHIPLeyHAbsC\/Q9iwNQd3FAQH82rZwAA"}
00425{"flow_id":47,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1919,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":446016,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0VBNAAGwGd280ck0hwKgBBgG77IvHJqVqMLP6L4AQBAVa+gAAAQEICmEfA10whLnA"}
00497{"flow_id":47,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1920,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":446109,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"EBMx8Tl2KDc3AG3ICABFAABnAABAAEAG90\/AqAEGNHJNIeyLAbsws\/ovxyalaoAYEACJMwAAAQEICjCEugthHwNdFAMDAAEBFgMDACjKOW9G6pYYFQxbBReF7uslk560sh+IyAUFvY0v0wF49L1jZlB3T9Xz"}
00559{"flow_id":42,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1921,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":447913,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"EBMx8Tl2KDc3AG3ICABFAACTAABAAEAGNRjAqAEGNHIPLeyHAbsC\/Q9iwNQd3FAYIACT9wAAFgMDAGYQAABiYQS80kqcx+dHmOVYK7Aj4fzmayr6AuRamhmxIa7bAW3xyLCmAKUzligWw+GpX4RkL84fvV2uF\/yIkEkiz4MehM51+B7Yj7T1\/gX4fcTf5d3U6r4rw7oO0MvcSYRG4w6OjD0="}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":1979,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":611278,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":1979,"source":"teams.pcap","alias":"nDPId-test","type":38}
00497{"flow_id":44,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1982,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":654367,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnabJAAGwGYZ00ck0hwKgBBgG77IgacXcqco2Uv4AYBAVQyQAAAQEICmEe3ZEwhLmfFAMDAAEBFgMDACgAAAAAAAAAAGwcabH\/l\/Aiqt8xUwEcbKVK2GP8JMZve0ScvcZSWcOF"}
00427{"flow_id":44,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1983,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":654436,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyIAbtyjZS\/GnF3XYAQD\/5yEwAAAQEICjCEutZhHt2R"}
00417{"flow_id":42,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1984,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":655741,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAojONAAG0Ge580cg8twKgBBgG77IfA1B3cAv0PzVAQCATCxQAAAAAAAAAA"}
00483{"flow_id":42,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1985,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":655805,"pkt_caplen":105,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":105,"pkt_l4_len":71,"pkt":"EBMx8Tl2KDc3AG3ICABFAABbAABAAEAGNVDAqAEGNHIPLeyHAbsC\/Q\/NwNQd3FAYIADDMQAAFAMDAAEBFgMDACg1g3wT\/ODOeR+aU\/gTizqUW4fCOmeXoMw7EtPrJ+nxsME1J+VVQInR"}
02357{"flow_id":44,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1986,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":659207,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyIAbtyjZS\/GnF3XYAQEABUTAAAAQEICjCEutphHt2RFwMDDn8AAAAAAAAAAWyvKpVaeilV\/5D9VXLPmEWMPulyRMiX2TW05r2RAqSdQjx9+rN8RqXZC8K3ZdIo10c+YSWuucNxRfOXOl2XZv97bN9rrnkLWZz4VUApZidtTeFhjjOwubdlrm9EBwVlnU0IGM7MtNRZL0KP3ojKQFKyryxHvWRniX4oEZLqBihyEejtNfwQ5K7W9VoXZczL0OHNWi\/NRnGmMtQfbkee0RxUScTLiHCXmsgmOegZH64j8YgD74gysNaww4qAeIgh46AMhj\/UI+tZ5Fk7pQv8XxwLSRcnLXMZpBqlOFjbY3oHZ2DY+4SytonO5k7\/v4BwpYJDX9jh8IRjSMdyI11Mma9m\/tM5NmuetauXj4Z5Y+xBcKf0ZTVmN+aPqs8u5Lbr4tfOqliJCj8dI7hKVUD0DRV7oxLE4InF68\/Xbsb\/E6fgRCaXsV92ktIlKe5QwoP3lPmhuFPbb0UXGmVZEBlkHDynOC0aRGwtnO2TMBf24ArqTlBywNirZflpwK\/+quDjwBMjNmSSVHeEH7WtZbu9TZQWUlXHLrPeXXgROEcz5y9sEA8JfizJpOKS23sE6ly01s6lpYSruNMzRH56rIsDVFXHoSBggyXyLYrSl9ADxEOmu\/yOPhSUHukY5T5idzOI+S05116zj3AzUIIyWngkAW50lMZ0pripPzKS6Eg\/UbovYdAJ4Jo0RjQ9GIZCrfr6rNEOOW1lqZwUEPi9m83nZzC6PdepICiXeCJYlaLxy9zDfIQf+NHF7ZnnxAzUCinh50HEFIaCoFRvb8K08aTZbjtaP2NQZaZZAVj1\/QkCjq5HamvDJ0\/tRG4p88ayaFbtCSX08IR6xH8SCrcwZa9WgvIKv8Ivwewr4idFh3JhjMntMqYfxuwN6qxDUUihyhVXY1UUHXZr1D367alMo4Rey\/xCzIWWZUY2tRnfLA+GG4n2FqbDzO16MI3CdfTh3X+eUvt2AsDzUkLRngijMfue6SL4rZe3uTuZcxlUYZoLnVfTyFfzpUie1WV1YcFEkPHalobpo59loQCpLNaCoKxm64Qzmy5hfeFqDxK5re9uWpvNyfoTyYoEOxzU0OfphPlJxvUbZtKj1c8z+7X7SZ1mmc98yNB891zI5C7EZKhhAEaPh+7BF3QzaLbQznJpVBFpTVHz+tMjKYL8+wX58pH4BOCyFPxsLGlsRiJr\/VqGUM8A8mazZ8exuPC1SulZVj8NZZphYxAbWHKY1dMnA2d30MEeD21J3+b2Shzk8iRRR6tpjpUpDM8b1ef3PgPDh6wh4SOnjSQ3bp+T4SourLMrm4TLw2dtehZgWDLfY6kJzDD0Wms1IWyQX+rwRMMQsri8xTIORE2iNUmO0js\/zuwzKyhMXKnb9MX1GrkF0I3+OtSc0H2QLrsgQFGMLoHcucWC30pzVFzCSOnScFd3sUzVdoeT7+GQw8p1XHi6aSNIM8uNhkRDRk\/KptgzgnxA+jsjcu6V1P9hyl3dfJY8tBUmFvhQ6ySqE5I+JRxKGCrE8QgoY7a4jfvBq3S23X\/EfdvGk+et1noYpY+kiJ+du9EmXh6wLsmHsPxNlIU6NvDCq2VllN52QjxaXHWmQQyO5dwhSar9ITnefHMRxKxBsXS62xrlq1LciiCEugy\/gT30KiAvip\/ncQmxXmSaVzBZ85fn8mZHAdwpnhAdaMrxRWT9M+LGOW2wF2zP5MJHDltAdsZJ+Q6snPDyWRxPoKM05V7hYmdToEa0m0tGD6IVGvA9NaNXs+Xa6DHGbI0\/AFfRc7xuDRGfOwY8DF5sbswlv3sQPMeIsrvDKKAEu9lKBhHT93B7Y+rU92HBdO4RkIRs1XtYlAax3ZkHhI7PCJfzHyyAG2sYQn94lA767q4fQCHjQvsn5PH0\/OAf"}
02367{"flow_id":44,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1987,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":659215,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyIAbtyjZpTGnF3XYAQEACcrQAAAQEICjCEutphHt2RfPlUrr7WkJImFDpJlgku\/Mcu3R9jA4oFvqMCL92bqnjr90nBd4aAaKUh4RaXay6msK9eXofvdUiB4V14ac92o9Y67vbpSHeIYMxohjA37zpuqyrKWjbU\/X96dR4e4IL90vpmrULO83u1ZMtOn2NPOjY\/uO57xawZKSEPD\/933o9dX2WFCDZXkz\/zIb4q3lYebUBRAmhD6OypAhhohtkMDQUY0lsUOhBGOC\/OcvdgLfT3mEXm\/8WTtB1XVCX3w4Pd9R4j9zDkkgjvL2pin7RLsXKLXxFkxOZUhoDDyqPzHTlGk0kgFB9BNHluM8U5BaxoO5kz3GO9pmi9RybmfAeCtpP2gKRO2m6kYR8uvLGYaa3amN7kBmq0L1BTjIFxO9mU0nFiDu\/OSKAlOBLDm9NItj6V0xmhxAWebD2mHEMh8P2FRd1uA1SCkQQ3PfMJCodQdSqYTgegwI9licO7JtCiooKYdSQ280itKolnIXnfXid9Zr4U2jG534iSwNH3BgntZh+RfEeMe\/y18GSspB92SHPJAvQOpVSt\/x35GQulblT+82UKy9zyqE9HeZAgyPzpMGZtiHd8DEEdPA9dWQBsUO3ZyHW0fyqxtNxf34KEXGzjCfokibheA44qlGkK2qtd+d+1KQJAtNPRcQXIyK6vTsIX345sxAzLgR6kaMBjhaHx5gBJWuZ8BUIs9Z6VPsfBUyA1BmKyN2syB8NS9reCS82KfGPWWWeC4UNTth6Wi5HydKISBgpwqvgeFQ+NCaOe7JIbJRib0jR6tUJRrr9UKgCjAmOvOe9JDXVkpE+FACnglgIfaXvdvlJKGCd16rr\/dPmJibbrAgb2gMvlL4oH2TDmhoKBHoray+ntXKhyUrTiTU1C\/xpCccQkIp3hM+QfI4LUOoGei6JgGgH7SM9ciBzescfbrjlqp7bgkERvxuQk4F\/P57y7N2O61CcnzbX2J5ZLI2PU6sfj7tGXNqsXRwOojjJa+RMwJDFeIuasPJWdZizauJpuVR96AQguxJHHOER4x0asHMSPNJebVlDZNwv5+gRstPIyKY8+ofvRsIpKwhZAfq3DdP+vBFHML23v2h+aHO52R6ZQe+a4\/5peMOH\/taax49mquG\/2SVLaDiauGaMyyqOomCxuqyews7DaAiUIDG\/NML3jJq8hKb6\/HfbOSUU8lqz6eFGVRxQH0PUZKjNSDSMFabJN\/MPBeY0vY7AqI3kojMNZxK8psNXC\/yK8GZlvQ66j6V+pP8+SV972JDc518LLCrH6skGBj8qW\/yD+72HrE2pXLlUgNG4x7oN9Lpa4C6vEw5eS1WBohjbclX7on4WYSsZgbuMTt1ynzY61VNzsK6Xz7D4lcV2JxgAW62uIvMj+SV6I76Ky4NlNTEozvJLkh6jVmGTEz\/pkJu7WlxLAFKDcoB7c33IpM2w8Sxo1Il1+1E\/MuZc9LbqqjHpNdXFax4NVm\/\/4qzQEy0MEKmbX98VCTI6zUNO7r+aqesU17F6el5Z3U9WmZkF+f1FZ2yby4iRxZTbJd\/ZsSYg9sf7tysYHRzeCw2rCNvoL9MUUQx1lGggaLnIdgY\/t80dQyLCjpUGN5Vu5RKshZUS6iMwkAd5zt\/aB85VHN7ELOSskqEyXSTl\/bB\/gzyQIO07R06AJ0uv5d8k84cZJpWOBhP924m46df7y1\/uKQX9LYOO85cm3ASYDTC54RsobYK37BgG8NcdMp7YlrIufSTD98nL73eGJBOyuoMO+kSFBIcUYzWU42Bc\/RjwqZ5hiIuj1gnT1F9DCqQGNJTEp8H7gBrqeCzERvjM7krXS+7olbsmkaSdxHgeAHky5zhROqDEpChRAKxInVYyCQa4GYGWxefp+6zEU+f0ImbrGeOJ9vRvhaSfo3tTs3jQhpRB1piVT"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2018,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1587041685984,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":49,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2018,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":984732,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGghTAqAEGNHHChOyNAbtKVk3bAAAAALAC\/\/8LQAAAAgQFtAEDAwUBAQgKMIS8GgAAAAAEAgAA"}
00426{"flow_id":49,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2019,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":996890,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0TQBAAHUGACA0ccKEwKgBBgG77I3LqgPISlZN3IAS\/\/9gggAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":49,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2020,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":996986,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyNAbtKVk3cy6oDyVAQIACBQQAA"}
00652{"flow_id":49,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2021,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041685,"pkt_ts_usec":997296,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"EBMx8Tl2KDc3AG3ICABFAADbAABAAEAGgXnAqAEGNHHChOyNAbtKVk3cy6oDyVAYIAAs2QAAFgMBAK4BAACqAwNemFWVDIT9d4HngeJpG5mlHm9Rt958WOVPiGzzmIF3agAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAVQAAABgAFgAAE3RlYW1zLm1pY3Jvc29mdC5jb20ACgAIAAYAFwAYABkACwACAQAADQASABAEAQIBBQEGAQQDAgMFAwYDAAUABQEAAAAAABIAAAAXAAA="}
00778{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2021,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":4,"flow_first_seen":1587041685984,"flow_last_seen":1587041685997,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":179,"flow_tot_l4_payload_len":179,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00415{"flow_id":49,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2022,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":8515,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoTQFAAHYG\/yo0ccKEwKgBBgG77I3LqgPJSlZOj1AQCASYigAAAAAAAAAA"}
02365{"flow_id":49,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2023,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10362,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUTQJAAHYG+X00ccKEwKgBBgG77I3LqgPJSlZOj1AQCASa8QAAFgMDF3cCAABZAwNemFWW8C0W89TTgqUKjOWIsiE2Y+2ePAr7RSpdbuGESyCTMQAA6egPuYFj\/MApkL3g9Rg+u5na9LGY5q\/3ymy\/W8AwAAARAAUAAAAXAAD\/AQABAAAAAAALAA52AA5zAAi1MIIIsTCCBpmgAwIBAgITFgAJ9GLNY5Hp8bHk\/QAAAAn0YjANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwHhcNMTkwOTEyMTgxNjQ1WhcNMjEwOTEyMTgxNjQ1WjAeMRwwGgYDVQQDExN0ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA474YAXkUH0AKd4mxgmpT49oCTCGzc+aeH0sH0HfldaTKsg5ito6++6GsfGEVzFsy6JVreR7nzWCbQ6\/I0WQfa+Gosa1DnUi8qi\/Shk0iTiu3WSCKxK1FENKNROAos9Djiz18pL2rP9VrVDb8tARlA1h0pxojacA1jZGaCBWbsBr8PHWviwnZIma5GiI3qb3MYHBOisScv1DZDLkUHn+JpjLYkw1t6ZLshtX5NzPKBAW79DAjdmuq9tQZ20TMMg5Tthlc6YLpRyq+9xjSsi413rkcJIUC\/Rf2K9WHQsYN6BPKO6orPrxiYEj94kVe73iPD+0QPCIgBl+zhCTXZSIYmwIDAQABo4IEeDCCBHQwggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB1AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABbSa6UVUAAAQDAEYwRAIgd5sSxdrGrfVyYR+FGj+B6FEN78TVW8jEqYGOJibnXdECIGD2W8oq5cUNpu2uCWQE1jXUs2DL4cvl1uUNhV\/wwimkAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFtJrpRVQAABAMARzBFAiEA5d\/lkmCTtCqvHZWUW8CIQAdVecPeZLtbE+QQd\/2gZzMCIDj9Kz8UZie7T5Wq7+KCyQOU0gDnJClZGl6ZUP\/3Rm+0AHYAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFtJrpSpAAABAMARzBFAiEA5y9TlTYWL0sPVyQoAKCdX9HhFRlqmgmhX9Xw2R2yjHwCIH6zjzCgNhLZRlxsZ+uj6zQ+Uw6zIFsO+k1yyvjZxKDCAHYAXNxDkv7mq0VEsV6a1FbmEDf71fpH3KFzlLJe5vbHDsoAAAFtJrpRgQAABAMARzBFAiEAgEgS\/oBjTv6pem6\/3ApSrk83mt2s6Fa13OEmbyNd50oCIFIceGAj02+gPpiEKkrdX9CJ\/jXDb3rJRIIrt66Ofz2\/MCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUJuNbdE1TT2O2ytZtHfPJiEnELtQwCwYDVR0PBAQD"}
02366{"flow_id":49,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2024,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10608,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUTQNAAHYG+Xw0ccKEwKgBBgG77I3Lqgl1SlZOj1AQCATEUAAAAgSwMB4GA1UdEQQXMBWCE3RlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBR6e4zBz+egyhzUa\/r74TPDDxqinTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBACMljl4PXdqfsGnHnHEiog8CyPTCICRJCVUcbZ5afVTsQxiRpg2bVtxl1vFq0UdqTpI+kMX8EVY4C7Gmrb2yOSLzdaz+0htG2dwTgNWS\/bd++B5YbYbyyrmrHhzmoDzfR+qZdKS0uA6mx2CYFo5hKxNjTHfd1Qdrg0w3XsuPrQax3fLN5JjHsFCQxAn9XxV2SfDNzLiNrpkQcWWElrudoda+F67h2kRXXaX8jtecomPcC8rpXShGH3O0tQI7lITD\/ghyFuS4OuN4zs3vGp2xsAH7PEi24hGQro09g1+rY\/VhwEhg\/\/nkTVgD\/ZbaRVPcvbIndMFc2uEbDyTEYG1ghQMlhzJ0z0ON1uZd+845eSsucuZAsM2nVRjaCLJ3VJXLp2bLLhQ8Z0oytSNQnEt4sS2H+qUfAxDvyt1VZ2g\/VYoL+stqV\/K5MJ5dbineogXsC\/RZwOCRTINGE2s6jTHOwhvEvUqlynAJe0lbwafcs+x5wYSwLNkng6KjnHuy4xZGEg4BM1iOtAqOQ\/nKFLpZQzXVqekdB2LMjWFKLQOyf2K70pU0GYuMCFCkhY0u\/OIpyRo\/IVgzwmO7bKF6dKMZ3EoTyTAuTwI1\/3MtVDjnpot8X2B7wWFIT1OXxoGkgYY9qoa2XjXhUFwMTUdeoK1yS4fEUV3Y68bTuXYV11jRsY6uAAW4MIIFtDCCBJygAwIBAgIQC2qzsD6xqfbEYJJqqM3+szANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTE2MDUyMDEyNTIzOFoXDTI0MDUyMDEyNTIzOFowgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq+XrXaNrOZ71NIgSux1SJl19CQvGeY6rtw7fGbLd7g\/27vRW5Ebikg\/iZwvjHHGk1EFztMuZFo6\/d32wrx5s7XEuwwh3Sl6Sruxa0EiB0MXpoPV6jx6NXtOtksDaxpE1MSC5OQTNECo8lx0AnpkYGAnPS5fkyfwA8AxanTboskDBSqyEKKo9Rhgrp4qs9K9LqH5JQsdiIMDmpztd65Afu4rYnJDjOrFswpTOPjJry3GzQS65xeFd2FkngvvhSA1+6ATx+QEnQfqUWn3FMLu2utcRm4j6AcxuS5K5"}
00407{"flow_id":49,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2025,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10664,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyNAbtKVk6Py6oPIVAQH9J1ZAAA"}
02369{"flow_id":49,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2026,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10849,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUTQRAAHYG+Xs0ccKEwKgBBgG77I3Lqg8hSlZOj1AQCAQZzAAA+Hg8y5xomhZmiNCTsCqDLpcRHX6BIGHksLmbnG5TlZUixtm9dRC62XWMPD8d0Jb4M0V7ex9UM+VIl6cFJKLb0dyVriAqfZaJSHuSetAksd5IEfdnPLTf+Fhg9U97NGjm\/awmCLbzLEPbT8QW0JsMcYexB2uG3Y+gsftm2tjL6fLwZeWO2BzqL7otZPFe0BtQsgyFSs87yC4qanWMwK5c2enAfH182pzjvUqwYAeCK31dyBCvLmKM3Jr94dm5WUiXQhrDUIELH4Mia+SbvCkigv2AUVx1Xw41wt1\/L3pnnz2OW4y7r530zAz7qB+dIcHz51IaXc4UV21QuEnusQsn0uJpJxJuxsAmPuekKxuLUzgG+hqHOuBLf5kWTlk9WWnxcadlZRsCAwEAAaOCAUIwggE+MB0GA1UdDgQWBBR6e4zBz+egyhzUa\/r74TPDDxqinTAfBgNVHSMEGDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9PbW5pcm9vdDIwMjUuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQAR\/nIGOiEKN27I9SkiAmKeRQ7t+gaf77+eJDUX\/jmIsrsB4Xjf0YuX\/bd38YpyT0k66LMp13SH5LnzF2CHiJJVgr3ZfRNIfwaQOolm552W95XNYA\/X4cr2du76mzVIoZh90pMqT4EWx6iWu9El86ZvUNoAmyqo9DUA4\/0sO+3lFZt\/Fg\/Hjsk2IJTwHQG5ElBQmYHgKEIsjnj\/7cae1eTK6aCqs0hPpF\/kixj\/EwItkBE2GGYoOiKa3pXxWe6fbSoXdZNQwwUS1d5ktLa829d2Wf6l1uVW4f5GXDuK+OwO++8SkJHOIBKBujxS43\/jQPQMQSBmhxjaMmng9tyPKPK9FgAHKwEABycwggcjCgEAoIIHHDCCBxgGCSsGAQUFBzABAQSCBwkwggcFMIHHohYEFKL+aj+ELBIf2ammTU17zeYojPFMGA8yMDIwMDQxNjA5NTAyMVowgZswgZgwTDAJBgUrDgMCGgUABBQirwAcgHViBybgyJMa7KdCHDISOgQUenuMwc\/noMoc1Gv6++Ezww8aop0CExYACfRizWOR6fGx5P0AAAAJ9GKAABgPMjAyMDA0MTYwOTUwMjFaoBEYDzIwMjAwNDIwMDk1MDIxWqEiMCAwHgYJKwYBBQUHMAEGBBEYDzIwMTkwNDE3MDk1MDIxWjANBgkqhkiG9w0BAQsFAAOCAQEAKtM5zlSyivdA+Gis4rcj8nCb7wkzf2w\/7uZSPASg+fHlxKIP0SawY+ftdNB7TLsLtTlV0GnUH9Y6bgG4E3FPviY9bhy7K5Tr75v1wxQ0rseMm64c2hKU\/IrMDW6eKEP73GVYi3adSSQujDteabmaRSxt4eO5wA7LHPgudO2T98Gs0mzEgCOAndhGbOJ92mIU\/D+dzwFvy9+GYVrp7egaj0qUXygOtzwvgaeQ53RHwEDh7xZPDmXtDVTfE8taITs+YaVIi6BhskxxrHRDCsGbJqc9CvWpbfIPjo3McWTpSBzO6C9AEHpFkyMWsXrEVNg4R7dSz60k0wGKcmVV5lO+0KCCBSMwggUfMIIFGzCCAwOgAwIBAgITeAAUltHcT15d"}
00408{"flow_id":49,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2027,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10918,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyNAbtKVk6Py6oUzVAQIABvigAA"}
02367{"flow_id":49,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2028,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10986,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUTQVAAHYG+Xo0ccKEwKgBBgG77I3LqhTNSlZOj1AQCAQGZgAA7dIaCgAAABSW0TANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwHhcNMjAwNDAyMTcwODI2WhcNMjEwNDAyMTcwODI2WjArMSkwJwYDVQQDDCBNaWNyb3NvZnRfSVRfVExTX0NBXzRfS2V5QmluZGluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2SgxvpjDYjzBSs0WMPjaEnxfx0ph8YUENHkNtBgmTL\/I48ISA513PDZvgRlkEL8juzKHixKietMtbTjX2g0Ru+b0Xx3jTpJvUnThqOsEv072NriYX3tuq2YlbZfSvXX5g4CDBZAx1V8Y9CnBOP5Oj+UOsWBE9phfvyhrfN9XBADPrUuim5l2H3Wsx6VgY2WqiE\/AD766Gm5hxSrOygTdO6oYRNS6py2EIDxPSfo06of+f+bd5U4O1djL9YnvzHRcJG3xZRsDSBXZSutpJVrdUc3OsjyygQKoWHCbplOYXHYtXrL52V4R8lPBoeGGNIyX3nlHFJFj2gzYcVCm7fr90CAwEAAaOB1jCB0zAdBgNVHQ4EFgQUov5qP4QsEh\/ZqaZNTXvN5iiM8UwwDgYDVR0PAQH\/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GCSsGAQUFBzABBQQCBQAwHwYDVR0jBBgwFoAUenuMwc\/noMoc1Gv6++Ezww8aop0wPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYHMm0eByOkWAgFkAgEHMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAKPl9SK0LY+EXU1pDCJZNILX\/tsLthBgVVkdFDbAun0x8Ww8QmlW6qLErphV\/AeU0i+ofY+1NRBI3dS5PHQF9yXT2VY0sqQBSti9zuzRw2uf11GLfIZx5EWNPlMkhPfXzWNxUVi2\/FkJWN3wqvwaShm5c0f5selfWZ8Bqq8SRlmox8B96mIVf3wk3SXeHNpZbjUXl7OcH6T7+r8sLEa8EYOEBcS5JF+k4PEHqk5mNBrpgaczqCJLhxuii3S7bIBIeG6sBZe83weEPDxpxsTpw02D\/5yXHd9C+oxAP4JQbVAgyoHjFdw4c3IsOE7FxTfNUSZNWmQXjOei3vQ32nR0chEHjNlTdJwKuQGoTQF0k45jiFV7z7s0Iv2rHqv+dB3P18SlgUBifwg+S0xQ3fPol\/cooBvyJhDIAIVmL+OOF17ZWOn9PMX6jznZgzxMjIBIIOMqNUaLfXXbbB\/ykAOUOkrVO6XTcdly26wevgCDRUTIPFRDzoN6slnotBP4mwALUEQTE5HTW+ultwf5P6UIHEZ2AtKHtW9Prb2\/IOVj7iZ8WMW3OpZkfhPmb50r4KHj5SL1FEouj0ymUJWTijP7SJELUHZslfqBZzbwVYghPjrsaOPr34Xaw9EPOiMn++5naD9XuozjC863v1M25zIRY0O3DfW4ygEYRsRTfv+z4LPLDAABaQMAGGEE2sl6xnO4uP94rSIxVlg4b\/j99hnR8yaBzHoUH9\/qsNRkW9haIO+cM+lX2sjma0NLyCeRaBVp\/yTEPyTID+7UaplNFWbv\/tcVBB71zV4gY+ppHdd07J8XxSx68sr41pWVBAEBACErGiRr9GjIHoClE\/uVmHDe2IM5WQ+tESjQJIYlxc54JzAdeIHUmFPRqdqVWHNRbyNeVieOWV6u"}
00689{"flow_id":49,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2029,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":10988,"pkt_caplen":258,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":258,"pkt_l4_len":224,"pkt":"KDc3AG3IEBMx8Tl2CABFAAD0TQZAAHYG\/lk0ccKEwKgBBgG77I3Lqhp5SlZOj1AYCAS77AAAvIujPjRzrH4orx5NcFc758218nlovmJ9A8tO8uTQ31JS\/9Z8ard+gW85grhMGd5fC2AryGxpyADt94rcf5ANohO2O9w3chTBZqvmZ4RhOhDKhvjS2iYXJjZeQZW4VIDPOEwLyXk3X6tvRm\/KDMyqBXlWC2ySrpNlGYxWmAcLr+g2XNRhvDDEB8TeShOR8\/Q9S18sFSiDKSlKk9h3K4GyIjAuOKk30BmRTqH\/RcpyOnUhtU+GG6Fn\/M6NQ9dAXiKSzWT0bDE6Wh0OAAAA"}
01097{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2029,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":12,"flow_first_seen":1587041685984,"flow_last_seen":1587041686010,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6191,"flow_avg_l4_payload_len":515,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"teams.microsoft.com","server_names":"teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"7d8fd34fdb13a7fff30d5a52846b6c4c","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=teams.microsoft.com","fingerprint":"68:1E:E8:3C:83:70:6F:E3:86:F4:E8:8C:C4:E6:A0:9A:3E:E0:9C:0E"}}
00408{"flow_id":49,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2030,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":11027,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGgizAqAEGNHHChOyNAbtKVk6Py6obRVAQH8xpRgAA"}
00555{"flow_id":49,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2031,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":32102,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"EBMx8Tl2KDc3AG3ICABFAACTAABAAEAGgcHAqAEGNHHChOyNAbtKVk6Py6obRVAYIACsmwAAFgMDAGYQAABiYQQ29kHwPhvvnpaiCYG3+fxcHuntYbQcDfQWnyrEsXfWZHYY41ZDY2su30b0oAzRR5MiPvwj0FEd0ujfw7k4nnayIJgepfpgOA95AYZxgWsUyhsxGXi+m1LNcagh5bJS0Bk="}
00417{"flow_id":49,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2032,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":42525,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoTQdAAHYG\/yQ0ccKEwKgBBgG77I3LqhtFSlZO+lAQCASAowAAAAAAAAAA"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2043,"source":"teams.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1587041686239,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":50,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2043,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":239545,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyPAbtgh2e9AAAAALAC\/\/9PlwAAAgQFtAEDAwUBAQgKMIS9EAAAAAAEAgAA"}
00436{"flow_id":50,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2044,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":288146,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8YwZAAGwGaHQ0ck0hwKgBBgG77I9T9FE0YIdnvqASIADemAAAAgQFoAEDAwgEAggKYR9buzCEvRA="}
00425{"flow_id":50,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2045,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":288255,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyPAbtgh2e+U\/RRNYAQEAkdGQAAAQEICjCEvUBhH1u7"}
00707{"flow_id":50,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2046,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":288562,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIeyPAbtgh2e+U\/RRNYAYEAniuwAAAQEICjCEvUBhH1u7FgMBAMkBAADFAwPWvyUszXyGVwTdfXyAsIQo65lWnkpPMHo57lR912BOzSAuDwAAZ8HaIUQ\/TUKOJyzDpeZ2C6OXN9Z66nmD08\/sfwAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2046,"source":"teams.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":4,"flow_first_seen":1587041686239,"flow_last_seen":1587041686288,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60559,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02360{"flow_id":50,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2047,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339149,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUYwhAAGwGYto0ck0hwKgBBgG77I9T9FbVYIdojIAQBAWA4QAAAQEICmEfW+0whL1ALnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
02363{"flow_id":50,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2048,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339238,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUYwdAAGwGYts0ck0hwKgBBgG77I9T9FE1YIdojIAQBAWSmQAAAQEICmEfW+0whL1AFgMDEGYCAABRAwNemFWWDCWNYomQcFTZR7F9Q0j+Flr5LhYeyNcj8nMvlyDkPAAAKbM0d7f12FXyaEAA7qD+P9kwtx+HS3tAUpaW78AwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
00441{"flow_id":50,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2049,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339261,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyPAbtgh2iMU\/RRNbAQEAmKzgAAAQEICjCEvXJhH1u7AQEFClP0VtVT9Fx1"}
00425{"flow_id":50,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2050,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339277,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyPAbtgh2iMU\/RcdYAQD68RAQAAAQEICjCEvXJhH1vt"}
02214{"flow_id":50,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2051,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339491,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfYwlAAGwGY040ck0hwKgBBgG77I9T9Fx1YIdojIAYBAWJUAAAAQEICmEfW+0whL1ABM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdIKiXD8e2\/Yok3vNl6lOBKNAOSuXeBOQSBZ7SE4K\/GxA1BAEBAJY+I1Zh+g\/pI23oryWomE7dln5uqCpjJ30J6URBq3C7OhRo8eQsIwlzUoS65zRnpCAYfXiDAeFWicIUhC3h7BTjPQGVICb\/T2lve+\/01A4vAbxxYHExRODPL3IwyPM+SDsNbkt1J1kefv860XH5lGclkvZdZ5oyNd6+Hlbg2f+FoeTgi45A0Am9ADm37C3xUlZwMyM9Vac4UMTShcKWA8Il4Dv0HRE2+yCVidbLOD95mwKbpT6R\/JNGNxhAzexs7pMLFSADPIL7Jhv52m60mJwOg\/acWFlFT4MUvzpgiqTCc1DF952J3IjhdYNmm+2zwoZNVR7SIoNqUyMUrHJvFZQOAAAA"}
00426{"flow_id":50,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2052,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":339530,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyPAbtgh2iMU\/RhoIAQD9YLrwAAAQEICjCEvXJhH1vt"}
00553{"flow_id":50,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2053,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":341216,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIeyPAbtgh2iMU\/RhoIAYEADuPAAAAQEICjCEvXNhH1vtFgMDACUQAAAhILoNE073vLjkv42KST8jBEPCC1BAtVGR8MZdCvebJBtFFAMDAAEBFgMDACgAAAAAAAAAAJckANz4BCs8I78XXVnxpZcg2XCbaodvqaDrdTVFTmJ8"}
00495{"flow_id":50,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2054,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":389269,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnYwpAAGwGaEU0ck0hwKgBBgG77I9T9GGgYIdo6YAYBAVyZwAAAQEICmEfXBswhL1zFAMDAAEBFgMDACgAAAAAAAAAAOkiNhP8B13DC35Fq9aUjKeB4pBEiHe1eg9iEJe55fLr"}
00427{"flow_id":50,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2055,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":389360,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyPAbtgh2jpU\/Rh04AQD\/4KmQAAAQEICjCEvaJhH1wb"}
02360{"flow_id":50,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2056,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":390751,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyPAbtgh2jpU\/Rh04AQEABHWgAAAQEICjCEvaNhH1wbFwMDNdQAAAAAAAAAARS1AoHXGXc7ihRSv8Tj+OXeK+qLZdoX\/mtelTHHto9+Wt9p7rAA5AYVg5NZL5AXwb9HECOHcFlhgViy+5wxuPvZrKY+KKgK1ZenGpXegDUDBWPYD3ZM+o97cm1z53yFtSboc\/ZDjVXzb7SnpUQRXFQRSeB5HZWjF6ygcN6HjR24xah9Uo7w5MdSB1VDlrDEJqCG2AZSRzLxWU7m4CREuN+XUcyMe89kOgMx+ky67xET9JOHDz+9P1ytKQ6R5icdvlhhZBdaSfU+Fq1Z8xnj84KwlE3hiZqYo\/SOPGmZdGHFg0ePUNJdZAOp79mdHaesVjjrZ6vdZObQW44zYCxqC6QID8j4SdN5DRhqIXwPt8gYMIBTOYNoYINw7e530+qglCTVxBjt6oAoyJziRi+DTmQpTU+g++wOm5v4fkaaWY\/ec70fFtGduUoDXLFKJSXohIcQcceM+B\/JttzkltzW3ETtvMEjPhuSIpjI8qQGG+0gm6zn6754copvDuP\/+WlWm96OJrwdYLlv9AJhGhrRPCAE98jiTyVEl3hgyaphDeczFQaqSvmoz193uls7+mNE3ZNTQWn1Ek+C9yoOGffAN71OToXVn2ZXZHauo1ZVy0VKKPMUt1RbpbfNohcE7pO9LoV428NifaBBu0XKE8BTweL95CtF2LMu5g86mSXH9V6+w4gp3TOTnESu87xstVuu1gDmHK+2nHF9cnJosIj1u1T6Sh1A4Pz0Yl38uAlzOBRuUIpxmrQWM0\/GHYAh453mEfkIr+vIGiznXS2+kIsNr6XklYlaMV8D\/CbXOIuKMWBg\/x8NgPqbv03muTcfzO9DIndvosQv+xnZLGqm0VjGJ5CPyPxkFTf5RwAp6B5C5pjdEYqAuVaFP5VP0mU3TSpGUohR9vhOcygzDdbWo0Y3S4jNVUi9ISeunPjXSTC3rI0lx+CorS8SBxn78\/95Hs\/nld\/KhPhNZV3DaIUh45fDARRiHmKX9egCTZnUvkrilaVIjCe6HD8+LEpCkKCFyBmP6IxdZULQvEoUViIF4HqhVuUW0S1Has09dEoxuivUxE5FbOJgITFsjAyWkYRC\/tlCZ4lflDmppL1flv+jo8lS6sU1cPCJtzmZGp2LnX+QNohcfvCNFItMsjHIC2eYhUtqijW0wWeKypsuQxCnLH\/R9daYUuB05\/QoyvLsa9bFHNYb00Dn2E5FR\/8LFQuDsZPin4hHUDE6f68v4q34vYS4J7+CTSK8dtXngQqwfEkEQC9UfPh9iJv\/Y8IrK0lKdUIm5ynzZJlvpFLvnO149TB+MicIJNfz+0et3KGqsy\/N5e7h0rZuzbejXavSb9HLfn70zQgHZSCAf+3veULDRzxMOZaxKx6GXrsCsYdiL37rgFGWQnRxslpLJjljCefbKSu6AM2jCz52LAoeyBqKWNftV0k7vz8KV7AEBp6Al2W42AZcHOW7dn9xJCwWYj3t+rKO3hZSRQpmt5t69wfs6qogk1\/wD1oAWNIASxc+UOv0sIs1LTUA3CtDpn3c3wZ\/\/AEAM1JHpwqfLCBZl4GcG+s65a+FAsVp3IOWwIN6eFgjyXLAfsNmYVsTrmm28JBauIDzeOoGY0S+BnUUbaWMTSuKg3wwxAnHnYKFS2AfNOgBYGfZPR9oyGgnuH5Q2Mry5aU5reBvxWEHLJHx20HFRma936nde5NZjKDzNfnLTddhWmuo3WNQYjtDwrwe90bXUUpbMN8i7ztAjXAnL5a7H3B\/rpBH4XnMfdBCG24d5y32NB+3ZGc4JBih\/qzrnGVfvfivbywm8qdnysbdCdc0yyT+3TxH5SOX5VJvfOJD60PhUjUZ3V\/UCRc+TTdGgV2rO0OdEP9TkINdui2eY2GKv4DdtoZ0wepa9YeB"}
02368{"flow_id":50,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2057,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":390756,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyPAbtgh259U\/Rh04AQEABTVQAAAQEICjCEvaNhH1wbIrw5FRKsH6HIfUDB\/UW0W24JYRUtY5aU1BLH2m0HpRX0djJRDALdnRoFB8Zid7lY+CCAOVlGt7ZdcKye\/zDKb3XVuFsYrz1K2\/2cqJ8e5QC0L0ZKjl19dFWUi4oWz579Pvkqn4+wwiyQcC159kbX0JYg492cAOAux\/LMymWHW+6kwgsttCBpY1fr9YfE4xZ+DBZ4AeWRMA1dLrVEIUWUrnO6OddQUzeWCTCevxedzWew\/JamWqEoxfeMVyFK8Ta1+Qz\/FH\/o16Pb1t7JOIjRHYcOkWVu1gYMQtirNlysqP50DJZWltn7\/gzZ8J81BmUUrG1LDv+xiY2\/urYXIGO8F+imslJomLrCqYsPPlTkLhvElR\/IBFCT\/h45SkKj2AuXtOhfC50CEyvn2V4STKXq8SNlajhpqNqaU8cHLzXTaP4Yen9\/rV7RyRNDDHib0yzOynDXf6zWVjvaNQ2uJbpitmsOEGwhLGeQmbm83IxTs8YLJuUkgsUzauTKe8r92pJ+LIMj9fTQd75GwD7w12bvbrMM6vr0ej8BQhfnI8CeqJGS4EQxOTy0SxV2t\/18DnhW5rS33GuMrMBTYXDNVMloJ3He\/byO36yNrYbOzO9sMixesCi2z2eboTUhA+5mtBNY+FfxopxUQ7sr461JI+VUTwX+Ue6iWVWtL\/yXUd6tcwnlBtTjviLMQR7ZiNzI8lQ9ObGHE30pX34pV1PKMGmNAbHokF908ZFPx3JTebul6wVDoOMJtnWj+zaEKFs4L5oOfhwUSA5nX4HDCWJjy2GddhhWpnNFslv7od66tx9frksr8RdEmKnN3y4u8e\/0zQt4XuP4t\/+HUEGEyf3++HEVCP5fGkrl8CRZThenVChScmCmQn+XJCvE7M2Lz4QGhZ03IfNlFr\/2e+wJJQwJpomZPNCFVsVfvBAlYI1sPYgRzbdnFDf9FRw2OL75MjqyC7qZl8rTl2KCYjajA6rVGz4lGxuUr0SFULMz3V\/1L3kOBqbLVdF\/uTfyF8LwgSc8tTy4dCY3uXl9P2EqA6WM\/E+hY+FfGQudXd1HwDTRa36TqRbFEkULimHjalLhw218\/gYUSvF2OwCkgQXMLX6iAvubK5zw4ZtjhkDnSK23+rZwdAOy\/u6lXVGFHHFJNT\/9YfoXu1bhnkMUgeeE\/VDtE8GZjpTshsNp9SC4fuQsaSJfP\/6B6cL6iotWypa6vNiL5z0RcxK+L8uU9hS0o00q7nXgtbRA\/0oxhVxi5nxlvA8N3A3bEXaEpYAVfI+82KYgm7I9cysmOoaUxzct+bte1A9qoS3ajnLCUyBqWRu2oxELWS2nmdAVLcRyb7yjr6w1egMPh504z5es4ulMHXe5xC82xVDjukV5xkAFqY5ompuqNT\/M0M+aTSEGeRxntEJdhePyZfy+RnmxZDwyQh66vEty+IrjSOsQm52Sb\/fnrY6g3HLOSq19eoCSjs2jMI6xn1Um98kIIFnx\/RiJS3x8+pls9F5x665UifjrdfTTb7Bk0xWKvHErxYzuQYOuqoUDCV11ljiamNRn7aTkHupB8oAAjkx9G7tzKBx7xCvmxRH47tWx80VL2+FETKjdlPchOCrWrotI9dEh9A\/Zr+7zOzgjid1g03lxHUeob3c7dmllDs1W9BD99eEodUvNX5ffOnR+TOqIkRR+x75KPjWjMb0NQ0usP3Y1vb8OrCm0afBebZHLSJ\/3XBxDZ3RgsEmTyXbTzQ8lc7cVQk4nItJVPWGq7HQ9V1gHQiVa9lsb4PX+eAyNJBi3J+RbVId2FHBXwlt5cbgD+Pp1pAoFwVzAWuhPLl97WyycrSbhtbvCs7AYAdFnYQGScbLg244EWlpfMu0zI3O4dJhhLO8FjkaNU9bNw5iZLP8v7AXBWGz3ysKvueXWuK96"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2076,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":611252,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2076,"source":"teams.pcap","alias":"nDPId-test","type":38}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2077,"source":"teams.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1587041686659,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.112","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00458{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2077,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":659283,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"\/\/\/\/\/\/\/\/jP5XIzfkCABFAABE9p0AAEAR\/0vAqAFwwKgB\/+EV4RUAME6OU3BvdFVkcDBE2bWZ25IvowABAADKIN8ICP0NzlEBuCwq6R7jWIhweQ=="}
00522{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2077,"source":"teams.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1587041686659,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.112","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","ndpi": {"proto":"Spotify","breed":"Acceptable","category":"Music"}}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2104,"source":"teams.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1587041686889,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.67","src_port":60560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00444{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2104,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":889381,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGR0nAqAEGKH4JQ+yQAbuMpd1iAAAAALAC\/\/\/7KQAAAgQFtAEDAwUBAQgKMIS\/iwAAAAAEAgAA"}
00438{"flow_id":52,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2108,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":918390,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8PdhAAGwG3XQofglDwKgBBgG77JCDb8\/fjKXdY6ASIAC\/qwAAAgQFoAEDAwgEAggKUkSG7zCEv4s="}
00425{"flow_id":52,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2109,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":918473,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR1XAqAEGKH4JQ+yQAbuMpd1jg2\/P4IAQEAn+PwAAAQEICjCEv6dSRIbv"}
00759{"flow_id":52,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2110,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":919156,"pkt_caplen":312,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":312,"pkt_l4_len":278,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEqAABAAEAGRl\/AqAEGKH4JQ+yQAbuMpd1jg2\/P4IAYEAngnQAAAQEICjCEv6dSRIbvFgMBAPEBAADtAwMbmcXPy8rEyjOH5t3NVXkoUGCRZxMGyIKbY0co\/wunRQAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACc\/wEAAQAAAAAeABwAABlsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tABcAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAADN0AAAAEgAAABAAMAAuAmgyBWgyLTE2BWgyLTE1BWgyLTE0CHNwZHkvMy4xBnNwZHkvMwhodHRwLzEuMQALAAIBAAAKAAoACAAdABcAGAAZ"}
00796{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2110,"source":"teams.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":4,"flow_first_seen":1587041686889,"flow_last_seen":1587041686919,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":246,"flow_tot_l4_payload_len":246,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.67","src_port":60560,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"login.microsoftonline.com","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
02372{"flow_id":52,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2131,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":950659,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPdlAAGwG19sofglDwKgBBgG77JCDb8\/gjKXeWYAQBAUYLAAAAQEIClJEhw4whL+nFgMDETsCAABVAwNemFWW7R35oy+pDouxbKQc3ZxSE0RLhoRWbTV6NPlktSB6OAAARuc6MTC1YmpF4SmrzBdvOs6F07smAuHCwru2ycAwAAANABcAAP8BAAEAAAAAAAsAD40AD4oACcwwggnIMIIHsKADAgECAhN7AAL0+uu8c4DySSOTAAAAAvT6MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0xODA5MjQyMTQ5MzBaFw0yMDA5MjQyMTQ5MzBaMCsxKTAnBgNVBAMTIHN0YW1wMi5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg9uMC7tn8RKm9hx1Q+vclCmv2FS5644lZCwDqwzCYb8L0QUXObmurDTp9z7imH\/68rvf0\/+KpPvZzn8n+A1ECu6H51tc4jh4cund1rKWCEvaClslKP1O5XZfDppym7WFQSIHQp9LXW26FaTqarCYkxKrkm\/lTdJtaXF5\/C7ZRJIFVaL9dmL\/uMiooAbDLhN56zmBjGeB2V01oJAQhD\/q\/lznyyirBK2V2vQ7WyyX4O7R5ox9CbJ7fjHmVfu5B\/IGhKzckLb+kPv4Ou1DFiJ+VjXUg8+HNiqYybm516lzAMR9GTpDm\/EaK\/DoNiRmeP+V6xIxpVOXNmdtJ2yXkhn+AQIDAQABo4IFgjCCBX4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB1AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABZg2YTSEAAAQDAEYwRAIgNf1dCr\/A\/68iTF44ctzG4dfYj5k8kwrcMxb+OAftshACIEOFf1L8DyVWvGmp2q28iEZd5RDO6L\/3eE60TQKPTKibAHcAVhQGmi\/XwuzT9eG9RLI+x0Z2ubyZEVzA75SYVdaJ0N0AAAFmDZhK0AAABAMASDBGAiEA6k0qgGOQ2\/4vWshsmYpY7DSpdiwLlTeFqoSnh81\/2Y4CIQDv1+L779lV6U+goVXZN5Lr8mJnM2dtvY1ZqBBLJZkaOwB1AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABZg2YSsoAAAQDAEYwRAIgWKBW8MG0XWRpOFEy6yhRlkRMXWMvZwn2MMfc6oSrj0gCIBftriorxFHUNkLYAHoFWkhm8hNqcHO+KKiAs49boZzUAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFmDZhLTgAABAMARzBFAiAA3dU0fJfG9tq5Rc4+sUUH+XraMuPYSatYD6LC\/2\/zTAIhAJWqprUivm3Ca3RKEfcrJtar2nlcdcqed0u5OIHS\/4PYMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjAxLmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUiTQV2m224F\/j"}
02359{"flow_id":52,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2132,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":950878,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPdpAAGwG19oofglDwKgBBgG77JCDb9WAjKXeWYAQBAV+igAAAQEIClJEhw4whL+ni+Wbrav3bQpcZNAwCwYDVR0PBAQDAgSwMIIBJgYDVR0RBIIBHTCCARmCGWxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb22CG2xvZ2luLm1pY3Jvc29mdG9ubGluZS1wLmNvbYIbbG9naW5leC5taWNyb3NvZnRvbmxpbmUuY29tghpsb2dpbjIubWljcm9zb2Z0b25saW5lLmNvbYIkc3RhbXAyLmxvZ2luLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgh1sb2dpbi5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIfbG9naW5leC5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIebG9naW4yLm1pY3Jvc29mdG9ubGluZS1pbnQuY29tgiBzdGFtcDIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwMS5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEARVCFDXaNOijZYnNGoRWvtuOpazT+6a5NhffPDEd8mw13I5P2ZjdjuwO0BCuAa0rcrb9Xsv2qMoirtQ46ssv7U4RUbJ2q644olWDdoDLw3u2IwAi4+it8uqFANVWf479pYNzQSRACICWvLYyZOXoCzSVgryqqt6S9JYKLV\/5cOCwnLGXIMXunQZDJ9OLbjk3hV+y1gACDA7qTWXqQxmgI9aFpumAbRwTxqZV913sHD\/Cf4ut1VrXdDHEcgGroOgboavAnBPF1buLwyr8dsFVfenl1cv4K6OyxBhOa\/qPQC3E1A4UNtSz4dz0swsNbngQZDrl3H9MqpMRswrpJ9jUAZ4uzcbjmByMFT7UrO5NyfE2e754OXgg0kzSG7F0aYPVW64WQaAN5alS554Apkxzpnhy4dbLpcc+qDxw4uZRbEMvvqiGy3Tzvw2N2ZlLhpfCA79zVH3D9QcugIgQY75KsamAAzOcbXq0zT0xKgmRKBpdzG5DeC2KsBbrTTak1bUSSPLjvYpHhgabRiV7OEik97n1Dth5jNj0APlNTe65xy1gwKh4ItrHo4sQMKfxY9NyTKSBVKN3poUeJpe9p2ArtCr\/ZmVWqTui7XFpZPfiQUHWHxyvx0VTPR40NEp\/NGn3Uw7Bd\/MS5F6AKZAjGFEeyvsfA2p3QKRyzfNkfQWM3fP8ABbgwggW0MIIEnKADAgECAhAIuHpQG76c2i0WTT45Ub9VMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MTI4WhcNMjQwNTIwMTI1MTI4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UE"}
00425{"flow_id":52,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2133,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":950934,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR1XAqAEGKH4JQ+yQAbuMpd5Zg2\/bIIAQD9PyAwAAAQEICjCEv8RSRIcO"}
02378{"flow_id":52,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2134,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":950998,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPdtAAGwG19kofglDwKgBBgG77JCDb9sgjKXeWYAQBAXbdAAAAQEIClJEhw4whL+nCxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCO8\/GEdXe8vsmk9RalUytQYJnc2H3ZJLXhckk3SP7ahpOjfR2aSxBNd3l+Zal8bjbiR9Q2SdDMJAInFOKucc3ZV3Q8EFYZkkqHYvnjkI1e3tFBGxqmH0CiLB6OVdcm2GhCq+wN3t1eYZWzrGyBzqjgra9fyqbkUWguJ\/1UKnGkzLt+kvH2U1EFMdAZgrDKY9DySgALzfRpS\/RallY5JsmdSwpjNDKApQTl6ii3wQDAbRrwKNRKj4CscxnY9RYvra4Il2IGLP7npfCtQVN\/jSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gMAAFJAwAXQQT5Q3NX5+d\/vhmyEzQZS24FRi7c0NlInzlo9prwvSS72XN3ITGDUUkf08M476kbOOUoMMHqYQc6oj0O6bfXFDmSBAEBAFm3RbnkZSe\/HZkUuzk5CD54825akP22vFckBYApYbEnfNvrl90DcYqxlxOAbK4etyjcIHygT3cT2gKpEWe+eUPlMnpe1sulvXKKf88tgLx26PfwFVhF9xiqEb+vkJFQXYsYuZNO3++Ldm7pqxHnd\/CvToZvWRE21DTuItVwd6VmJkluYxROw5v2mbQk0b8ZSRsEG\/BaMPLjjujzzMq4YUvwks7E"}
00562{"flow_id":52,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2135,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":950999,"pkt_caplen":162,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":162,"pkt_l4_len":128,"pkt":"KDc3AG3IEBMx8Tl2CABFAACUPdxAAGwG3RgofglDwKgBBgG77JCDb+DAjKXeWYAYBAVCNgAAAQEIClJEhw4whL+nQ32fUU3wgpyNXOS+YAQTaKFItA\/wMBEfcoJdzfo7Vhy7bDY7\/0CPvRpu\/u8Nd\/XiPGZZp2CcfD1ltBTqX9aHWUFSItU3j5\/wjZXSsX\/40JJB41OxGJ\/QivD2yTgOAAAA"}
01379{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2135,"source":"teams.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":9,"flow_first_seen":1587041686889,"flow_last_seen":1587041686950,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4662,"flow_avg_l4_payload_len":518,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.67","src_port":60560,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Microsoft365","breed":"Acceptable","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"login.microsoftonline.com","server_names":"login.microsoftonline.com,login.microsoftonline-p.com,loginex.microsoftonline.com,login2.microsoftonline.com,stamp2.login.microsoftonline-int.com,login.microsoftonline-int.com,loginex.microsoftonline-int.com,login2.microsoftonline-int.com,stamp2.login.microsoftonline.com","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"678aeaf909676262acfb913ccb78a126","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=stamp2.login.microsoftonline.com","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","fingerprint":"7E:0F:A2:51:8F:FB:49:30:C3:34:07:5E:F8:7C:FD:34:20:A2:96:63"}}
00426{"flow_id":52,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2136,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":951040,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR1XAqAEGKH4JQ+yQAbuMpd5Zg2\/hIIAQD9DsBgAAAQEICjCEv8RSRIcO"}
00598{"flow_id":52,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2143,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":961193,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAGRtfAqAEGKH4JQ+yQAbuMpd5Zg2\/hIIAYEACglQAAAQEICjCEv85SRIcOFgMDAEYQAABCQQRF1\/1oMSdAxU1Mhx45DP5rD7GL3YTR99AHtI6CS5oE4zxa53P4viOFVIG1jEeguhsWdkQLAbDAklx91P7lzGi2FAMDAAEBFgMDACgAAAAAAAAAAIsLD7O97vjhH8lCxLcrSKE9fDLXgiaI+ndnxfU8CGCX"}
00496{"flow_id":52,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2149,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":989758,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnPd1AAGwG3UQofglDwKgBBgG77JCDb+EgjKXe14AYBAS3VwAAAQEIClJEhzYwhL\/OFAMDAAEBFgMDACgAAAAAAAAAADZpCQltcb4W89AtkdO9slaMxcqcxRBEn0SsLOBRfFJa"}
00427{"flow_id":52,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2150,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":989876,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGR1XAqAEGKH4JQ+yQAbuMpd7Xg2\/hU4AQD\/7q2gAAAQEICjCEv+lSRIc2"}
02365{"flow_id":52,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2151,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":990857,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAGQcHAqAEGKH4JQ+yQAbuMpd7Xg2\/hU4AQEABNrgAAAQEICjCEv+pSRIc2FwMDBr4AAAAAAAAAAePA94OGpVBLytLIfaroE7oqp+HOXd8UByPugH8HzrPxHY6FbCeiWSuRr5zpNXdpR1RsQklvrI6HCoVzS6XUdIKYRsmPO4RJ2a4E1u6OwWTePx2dxO60BO+qIdaZ5ecNtxrmRIIUi1e1Trl8m8kAsb\/VbNaIPR7hOzHhbl+PypQ9GCfmgVj\/fxHQISVjgqCa8FkXQxPA90ZNPOiF1hfXyWHxiXMbo8ZrFOhBnsxxfZiFCWF3E9YOUGLW7iCkTl90elvDyrmexD0ZfbytvWp\/gUgVwh8RkSDmPblo4ZSkiRU0VDGLSrHQoNt3wqABFEYBRDzXsVAh8MThL3+IqsQpVjPw5oYPDjeo3+xpjYpGgcLm3eekFOemHb2sMXGYiNLYvAsORs6lEkfgVcxWkpTJvE34NcuHORFRSZ0IUgZ1dscJvS6bIFBGdnvA2W0maKiA3H0YD6UA2uogVS7MwY2oXUofDoDwZO5uDMX57KUQ+cr866deE0u7ipaVduqIEp8GnNYxCcDgGsju0RCibBjASiYBbu3mpXeh5epFHGuxHRYKMxCC27X8RVdeTH8JDHuO2nvY17ZrNIqLlQdT2gzfNow05J1usWPgsfn2UaL2pca01ZMYcnprMp1yyKvuL1wI7WWxrRpfHP9Xl+Ip7y8q6BeuZ\/e2nl8oybNEkOCvP+P+wqvczxBIfxipTRAVDBO5j\/hCWBDgAjVVWvSUU\/4bKyeqBxBuUckSS2l126lImxlqhDN752EBOoS7IUXDNgqOiqc1AqegdcJaM23lOplPvxancBb6PP\/dZMlZFmJKfQrGzvkPMrkAn3wpAvrsMxiIEJWeZilB9lD2I47th3wCcHXBOWURaTK1OMDYQ0NYB\/5VJ282WNWThXOOC2PpdV9spt9akXKXGPhDjkTA1pT6I\/fAaF0K6AoYo+PgVgPNWN0ZtPMu87dzvl4a9rLl2xDOsuWPbAoT+EYjTlKzuigNrU\/1rOK19D\/8DowgTfc6FK9Nxz2mA2w2vI6DHiWE8WSwfEcZyCbJ2zLwT8NoYVftk0XavGvmEoyb44Bbz90\/eeSN5Vr58wutjx9faAc5iMMVwIK2Js\/oydOBXaeTfsURd2dRcROAB0czOCJETnJDO1n17bYR2LlKYI4EzlerwQ4PD21NZAlCwT3YxCrUaSYCoPRDlUVgo9Dh2X79F2BTGQi5BF4f7B+wG7boz\/kBE5bSdJXAn0pSSkOl8ybYDTK84m1wcEHwGDnUlCrVopvZJJU0WPReT7JdPTJNuztetf\/0S+yp9NNADe\/uAgy2y80hYfysGsjGFU+WvzInfYbhbU5hz\/pTqH\/JK7p4pWtRnQdscy1FrkdkENLAQXzRE8jPzA\/1R\/bD7l5+4X3bozs9z8sggarZr422ILU2L0V4o44eyZLWaSc\/pUcwD5vjKaxKUYH4hjeOc9rYdiKfoxiA6CYssx1aMm\/86YVLhrpq6YcFbxm5TbZ9681fAZw0xMCmntVIOe7mL4IaXCZvomgA0dovYjVmlm6RFkvU02tjQXxpi6Af1ekZWphYc5vKYGlJU4X8kCv5HtHoHZ8XUQ1E7e\/9w9yYB+\/Y5uW\/r\/tnpLB93a58YEWJSvj9u\/g2QOcybfAefqfllvkVj3IckRbnmgMIrOv5sAjYloF7AnSDCqHf9qPRn6NWaeGBqp192nwhaWUHpMLpOrsPM3qHyRJZmgP+WpRmRKw8Nnytuo9E7mmI+nGT3qHxuAkXPIdv6ilCZwdtuyZ6NWDgiWLKaj94jQ2nxJUDH4EQaFPgdwD\/PBDv0+l7Qw6Id\/+oPXfM2Zmi7tSgctaTANJmVk5dlzzfxFGg5DiIyULK+Y1UrBMY521S4mY19PeomcDR4x2n8AGxYBc049BUeffY"}
00840{"flow_id":52,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2152,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041686,"pkt_ts_usec":990861,"pkt_caplen":369,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":369,"pkt_l4_len":335,"pkt":"EBMx8Tl2KDc3AG3ICABFAAFjAABAAEAGRibAqAEGKH4JQ+yQAbuMpeRrg2\/hU4AYEACL+AAAAQEICjCEv+pSRIc2T3+mjlZiqvbSIDS3yLvmShrsZpTdEV0CSknJx5v5+YLFlaaPK8+ftc599Xj2DRHchYBtpvqLLN+5pP+TvtxqTjsw5hzPtq5q1uzS+S9M0Km3DX5xYcUsZT9velQx0jRi4+X2MlHPL7YU7A6KRKGx1OVWljS\/7qWTSdb0mQKgyQ7pWtIixslp31xh7yft5bDMRxJliVXwceBH\/1w+ox97x8oBqUiBfNWVaj3d2hGQG6TiV688PRENTqErJXTDMUieGv0vJkh\/T1OzjQPCg7TZe4oVOcBmRO1r2t25kvfR6cqsYFMYuDBXWEvlJB4cg\/smK4evTuN\/c4rerSDOolH0ulyxPnAKXgqzvFsJl5luX\/1O15UOeC9pxDfoRB3THa6onajGaeaSN\/0s6q9KSVT9"}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2189,"source":"teams.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1587041687245,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60561,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00444{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2189,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":245112,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG93bAqAEGNHJNIeyRAbt4yq\/kAAAAALAC\/\/\/rWgAAAgQFtAEDAwUBAQgKMITA4AAAAAAEAgAA"}
00436{"flow_id":53,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2193,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":293530,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8EaVAAGwGudU0ck0hwKgBBgG77JHMBk4keMqv5aASIADnTgAAAgQFoAEDAwgEAggKYPR58TCEwOA="}
00425{"flow_id":53,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2194,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":293639,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyRAbt4yq\/lzAZOJYAQEAkl0AAAAQEICjCEwQ9g9Hnx"}
00706{"flow_id":53,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2195,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":294098,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIeyRAbt4yq\/lzAZOJYAYEAmZKwAAAQEICjCEwQ9g9HnxFgMBAMkBAADFAwOyv9PSQv\/SmdcPkRjuFnJs95jqk9PvclXpwloDxRoWsCDkPAAAKbM0d7f12FXyaEAA7qD+P9kwtx+HS3tAUpaW7wAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00783{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2195,"source":"teams.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":4,"flow_first_seen":1587041687245,"flow_last_seen":1587041687294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":206,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60561,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2196,"source":"teams.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1587041687370,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":54069,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00448{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2196,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":370480,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"EBMx8Tl2KDc3AG3ICABFAABF06EAAP8RZK7AqAEGwKgBAdM1ADUAMUK+cAQBAAABAAAAAAAAA2FwaQ9taWNyb3NvZnRzdHJlYW0DY29tAAABAAE="}
00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2196,"source":"teams.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1587041687370,"flow_last_seen":0,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":41,"flow_tot_l4_payload_len":41,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":54069,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"api.microsoftstream.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00706{"flow_id":53,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2197,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":382278,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"EBMx8Tl2KDc3AG3ICABFAAECAABAAEAG9rTAqAEGNHJNIeyRAbt4yq\/lzAZOJYAYEAmY0wAAAQEICjCEwWdg9HnxFgMBAMkBAADFAwOyv9PSQv\/SmdcPkRjuFnJs95jqk9PvclXpwloDxRoWsCDkPAAAKbM0d7f12FXyaEAA7qD+P9kwtx+HS3tAUpaW7wAewC\/AK8AwwCzMqcyowAnAE8AKwBQAnACdAC8ANQAKAQAAXv8BAAEAAAAAIwAhAAAebW9iaWxlLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEACwACAQAACgAIAAYAHQAXABg="}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2198,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":412781,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2198,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00780{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2199,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":427043,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzETBAAEARZ+HAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAJGRMVEAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00440{"flow_id":53,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2200,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":430016,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"KDc3AG3IEBMx8Tl2CABFAABAEaZAAGwGudA0ck0hwKgBBgG77JHMBk4leMqws7AQBAWoNwAAAQEICmD0enowhMEPAQEFCnjKr+V4yrCz"}
00692{"flow_id":54,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2201,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":435320,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"KDc3AG3IEBMx8Tl2CABFAAD6rblAADkRD+LAqAEBwKgBBgA10zUA5gAAcASBgAABAAYAAAAAA2FwaQ9taWNyb3NvZnRzdHJlYW0DY29tAAABAAHADAAFAAEAAAe+AB8DYXBpBnN0cmVhbQ50cmFmZmljbWFuYWdlcgNuZXQAwDUABQABAAAAPAAJBmV1d2UtMcAMwGAABQABAAAEVQANCmV1d2UtMS1hcGnAQMB1AAUAAQAAACkACwhldXdlLTEtMcAMwI4ABQABAAAAwQApHWFtcy1ldXdlLTEtaG9zLWFwaWdhdGV3YXktMS0xCGNsb3VkYXBwwE\/ApQABAAEAAAANAARoKLuX"}
00682{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2201,"source":"teams.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1587041687370,"flow_last_seen":1587041687435,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":222,"flow_tot_l4_payload_len":263,"flow_avg_l4_payload_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":54069,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"api.microsoftstream.com","num_queries":1,"num_answers":6,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"104.40.187.151"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2202,"source":"teams.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1587041687436,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"104.40.187.151","src_port":60562,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":55,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2202,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":436782,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGVUrAqAEGaCi7l+ySAbtvi5oIAAAAALAC\/\/9njAAAAgQFtAEDAwUBAQgKMITBnAAAAAAEAgAA"}
00436{"flow_id":55,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2203,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":466298,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8OsBAAGwG7o1oKLuXwKgBBgG77JKBluUGb4uaCaASIADVGwAAAgQFoAEDAwgEAggKAbkbHzCEwZw="}
00424{"flow_id":55,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2204,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":466398,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGVVbAqAEGaCi7l+ySAbtvi5oJgZblB4AQEAkTrwAAAQEICjCEwbkBuRsf"}
00716{"flow_id":55,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2205,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":466635,"pkt_caplen":280,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":280,"pkt_l4_len":246,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEKAABAAEAGVIDAqAEGaCi7l+ySAbtvi5oJgZblB4AYEAl2MwAAAQEICjCEwbkBuRsfFgMBANEBAADNAwNcYEYY9r+P9DTmk4+ghvjGxbgXLamZQ7BCvuLi0gzQzQAAHMrKzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACI2toAAP8BAAEAAAAAHAAaAAAXYXBpLm1pY3Jvc29mdHN0cmVhbS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAgqKgAdABcAGAAbAAMCAAIaGgABAA=="}
00732{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2205,"source":"teams.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":4,"flow_first_seen":1587041687436,"flow_last_seen":1587041687466,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"104.40.187.151","src_port":60562,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.microsoftstream.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02365{"flow_id":55,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2206,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512045,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUOsFAAGwG6PRoKLuXwKgBBgG77JKBluUHb4ua34AQBAUPSwAAAQEICgG5Gz4whMG5FgMDF2ACAABeAwNemFWXWoznNEDG0nqSFdxS15urfQPAW1Ki15lKX+AAtiAKRAAA667wWoqa+vDiRfvp7swmXkbxWCktv+PyIN9JCMAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsADpsADpgACNowggjWMIIGvqADAgECAhMtAAcUzkF9hlrqvm6yAAAABxTOMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA3MTYwMDAyMzBaFw0yMTA3MTYwMDAyMzBaMCQxIjAgBgNVBAMMGSouYXBpLm1pY3Jvc29mdHN0cmVhbS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYCLN53Kexlrvsr+3rXZR74UHw5zlzegNiM6ErPRT\/txn4iFY2zFTqC+sWY7W7Oz4G1tsBCxRCqDiWTxn5SoBhxDmnlpMqOtTTpv5IM4kd\/8Guw\/818ANBFltXQet6T9XZsisGK5x9lUCYcHW8ynBG3v5uNf0Z6m2VB67+wzZ2C3iG0UAM447HUmbA40yblclmVBneenfOna+w64hv1nSyt5YNMGiattt3RBLqQ25FUDZwDSm6\/Xrxs5bFSfj0HMxAb5EpzZ2SxfSP+UgsmRV0Oq\/HfZsAL9LwqbT3aESBPoyba7n926l2qjVJiyrcjkPpm+NqXC8ligQT0pRVDCcpAgMBAAGjggSXMIIEkzCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHUA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFr+B+sPAAABAMARjBEAiBx6hq9wYK8lGTp3u5E7AFX+BkbRLRZ5Lup8OuEt\/B0tQIgGypwFVlROzmTzUQqtoWQp2MHW1EriZKLwX2GVgWat5wAdgBElGUusO7Or8RAB9io\/ijA2uaCvtjLMbU\/0zOWtbaBqAAAAWv4H61YAAAEAwBHMEUCIBBA4jXntmRWzvCXbsrMW4W1hyQue\/vS7Ncn0z5ewGEwAiEAln3ydSWKxMs1mek8BuU+Pp\/Ar72loNB67Ntve4Q85KAAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWv4H62XAAAEAwBHMEUCIQDLjQfYXTzdnrjIDBYNPqxZrBUDuC2VVPJNvuwXJuHkoAIgHkqG2mwJ4b5UFgxZl8\/iCIL8mYENQc4ZRdEfVujQdbMAdgBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWv4H6xWAAAEAwBHMEUCIDM4gWIHlpsWZA++c4q0XblHDWvH710R4c4I0Xek5jDJAiEAoovM291ZXguFtfeLFlqPtsBXmuKsHbLob14668lLPKIwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBRaFtJxTHeO"}
02376{"flow_id":55,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2207,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512265,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUOsNAAGwG6PJoKLuXwKgBBgG77JKBlvBHb4ua34AQBAUKLwAAAQEICgG5Gz4whMG5u7ULEJXx3wLpj46dVpk82I\/TWPtckn49e\/hQSVr3EHt3+OZKkEpVUt6UrXQJoGRXLM0HkJ8WrZXD0Qa68e9sBbUErKncGzGbDi0ZlQRP3mbLrTVyrxmCCLIUOhZfsDyb240MsALWJh\/oFXHE7\/ljOUOM6cKSLqHCoDAlDpYnX56jK4LWEL08GR6mh\/5VITpcQfwBmMwvkv9mOLS4ZpwPEmhLSqyGu16Y\/56mnFNsMxGk0K5SR9eLj\/GWrLkpmo8s8a1kGMMmuwBk3lBwwLvsxmuu06DvwPFcDfLMelnaGDMvWRCtZxQsXyJDSkTh6N3g51UWTgnvA0wMSFBa8APfju9jyltnh0NALAa2Hw8+U8BmP9cUFeYIYphIfoPlp7VdUS1ULWH9NF3Ut4DN0n3OsSQ785dsbBPeihfJivVIlUL3EpDjEBf2oQDFNiplkZ4F7EIuWriZG\/\/UTrX6ZlXZg46\/CCmN+gsCAwEAAaOCAUIwggE+MB0GA1UdDgQWBBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAfBgNVHSMEGDAWgBTlnVkwgkdYzKz6CFQ2hns6tQRN8DASBgNVHRMBAf8ECDAGAQH\/AgEAMA4GA1UdDwEB\/wQEAwIBhjAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMJMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9PbW5pcm9vdDIwMjUuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA0GCSqGSIb3DQEBCwUAA4IBAQA+8s8wpXq\/HmrfOVgYKDzDne7ngcVL\/Gf2vx9ON9re8K\/uivkDe2BndMc72v8rSuv9VHUTi+XCgRK6UhIguimKOs1DJMzVFwX+nBY\/c+BtQcB2PfKrSMVZYmS6RE8KGII\/Qeo\/GDpY56AwV3X10WoxFLaUmWXatugB3uSr+7Xz5RkKGF+kAlfetlwmb3P+Lgn1CEPED8ckf50oZ2Wh3FvwOv34cIXnpU8k3kI\/HUQ7XYUGhR0eHNTZTlHk\/R4RFsyeANmXGpfjZceGNRtTdr4y0SxBSUujPpMMW3dXBzA8NYuM0WmiJ\/pV6KudEB7RF9+6bInTyVvXC5SIqdi0ldeOFgAHKwEABycwggcjCgEAoIIHHDCCBxgGCSsGAQUFBzABAQSCBwkwggcFMIHHohYEFCh3Ac5lnou4VSj4K88j38W8dhpMGA8yMDIwMDQxNjA0MDkxOVowgZswgZgwTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ABxTOQX2GWuq+brIAAAAHFM6AABgPMjAyMDA0MTYwNDA5MTlaoBEYDzIwMjAwNDIwMDQwOTE5WqEiMCAwHgYJKwYBBQUHMAEGBBEYDzIwMTkwNDE3MDQwOTE5WjANBgkqhkiG9w0BAQsFAAOCAQEAkY+0NVCyWnq+KPa32fe1YIM8e2fy76JPV\/ftYnZoOTbZstat2664voPYQbNKH6uJ8oX7n5yD5itDCtjsRJZVFK1Tb\/ZzdchtTxgjdIssRQ8+F8RPAqnyvhpLwX2IZf376QSSrDcWEM7QfOHS\/Bg+4SrfZ5g2BwhM0x7K5tLR\/L+MvGMS+aqcMsJfTLF5lTcwxYQawJGRvV4Ae8vgN9zTXYLyO7NpTrQ5LrcuO1YGXNbLEEgmzqBua6maBgC6c4sAiSdRxcyD5zIll8Yeiu3WP8s8"}
00440{"flow_id":55,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2208,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512328,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGVUrAqAEGaCi7l+ySAbtvi5rfgZbqp7AQEADtgQAAAQEICjCEweYBuRs+AQEFCoGW8EeBlvXn"}
02368{"flow_id":55,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2209,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512382,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUOsJAAGwG6PNoKLuXwKgBBgG77JKBluqnb4ua34AQBAVvBQAAAQEICgG5Gz4whMG5pNggrllHpezpWPESxzALBgNVHQ8EBAMCBLAwPQYDVR0RBDYwNIIZKi5hcGkubWljcm9zb2Z0c3RyZWFtLmNvbYIXYXBpLm1pY3Jvc29mdHN0cmVhbS5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAEZHQbMTjwghzE+Plr6jTEoDl96w0a2HMmA0Eb76OSoGOslmGXMgamf69p4Av0JAaa+poo3j93rj\/2KhvPWujYWhHtFLpgy2CZVhHOgw6BXORC2BcEQTT4uejXSP2WaGqIoQqKCuFc557K4vuN5E2yk7B82fenJztZ3gdhuaapmHXzDBsOyxeQX+ydwICSo4hPpwiSSChSPjBFsiyAjPljTXo6AiOC8DbwknALnAm\/hDG1A6\/2a8FZ5SJNlltPwRo6l0pMncsnWGpDaEvN9Rrs7SzT3AbM7Stn1vXlA5sYhH4W4pkXAR11YhRkHTdlbZ4GSYrncR2sY9JnzmO26HA7+CKXZ6eq\/YVQpo0H7T\/SisqeLnQmZvxkBNfw6Y+ULr2CnBq074N9gl7T4\/6nfoAmFP2trGjb1PzxnzgD6G\/EHrBFfVN8caAgECh9miWAOaYO3iKZcn5Kp1FnekgAtZoCqljAja2XYkilKyrOpIErRQCWUQUuFgtAeBhTeKMKhDTI6xhaL6tFBb1usqKmzl\/DdqPsl27qx9hfDHRdLKnisIG\/prYnbNoMTN+6LUoiokPjkEsMNB1tXvSKYnXf\/BTfdgKlPtduEgHkfMlJf+kh4vnE+0tWIQ0+pQVXF0L7J4i8J6sYP9bZasYJB1uEiXpPG\/dDALBYkOnSCTaJjyfGbrAAW4MIIFtDCCBJygAwIBAgIQCIjNUl8ZJERNFKWCkd65UjANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTE2MDUyMDEyNTMwM1oXDTI0MDUyMDEyNTMwM1owgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmt+BXDuPrul5lrmaeaeB8jnaVShGIwLFgmYHthXe\/Zw6GpuRCdJmjwuJF\/hxhyF\/ONM\/miUAtzXQq\/gIejbzUFvfKykn3qTdJJL69MZwjTYqmvCA3jX6HkKdCYGq1QcKFqXFWkJtQr4eQoK0VzCZW0Ur1I\/TCgbGc5Ok4YPvxb8FJ6d4zbML4J4iFvOY3KYU6MyU1yP50FCZ"}
00424{"flow_id":55,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2210,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512417,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGVVbAqAEGaCi7l+ySAbtvi5rfgZb154AQD6YCEAAAAQEICjCEweYBuRs+"}
00425{"flow_id":55,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2211,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512471,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGVVbAqAEGaCi7l+ySAbtvi5rfgZb154AQEAABtgAAAQEICjCEweYBuRs+"}
02371{"flow_id":55,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2212,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512514,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUOsRAAGwG6PFoKLuXwKgBBgG77JKBlvXnb4ua34AQBAU5\/wAAAQEICgG5Gz4whMG5WdzQ8y52SxWU16Scf68ezC2H47\/13fg4IWc2UhttkSRUxLoHxmdC0p1xLrPlL6CCBSMwggUfMIIFGzCCAwOgAwIBAgITbgAV008GZpZYESSv0QAAABXTTzANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDUwHhcNMjAwNDAyMTY1ODA5WhcNMjEwNDAyMTY1ODA5WjArMSkwJwYDVQQDDCBNaWNyb3NvZnRfSVRfVExTX0NBXzVfS2V5QmluZGluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALe9sUVmBr885ww0\/DV2C\/a6ffmGt29Gej9sEt2pEOfDXRgjTaoeW5GFpefTLAQ1B7\/RH\/sNgms3VJNzcp4aOBPL6XRAoeu6V9Butg2QTohZpbgTSm7gucMtKhabg2Yn7gmi\/ySIqB\/qmccNZ\/U\/iJT2G4VCLfSxFmyHM9zSr1QIy9trgmyHuH4EHokUGOgkDDjoiib21RtI4vq7XPOvjMYYZeFk\/6ANKxBf65AcjJNlTkoT5uzmHZDweCWnUrGMRJUHSUKmbWew8dUKCO6abmL6cIs7PW5Of6qT22Tl9n3xDZm2D1\/CBCKByJr8PneTgro4XB\/DQ\/Mtg9wBLd2DsksCAwEAAaOB1jCB0zAdBgNVHQ4EFgQUKHcBzmWei7hVKPgrzyPfxbx2GkwwDgYDVR0PAQH\/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GCSsGAQUFBzABBQQCBQAwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYHMm0eByOkWAgFkAgEHMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYBBQUHAwkwDQYJKoZIhvcNAQELBQADggIBAGXlpqd1D30S2SMlJCDj96swA77yR3rGOtw3Nsp0mZ1cMsII3HhX\/pPskAF1OKrbQ8HFW5fEQMWd00cTiv7cfbmJmmr7RJt7MIfYeQewwr5iF36rCSZUaSvzhRn3H+PQTQWVyZMufX\/GHyePYbIiYlnIXJRAs9qdOCHo5WNq48wjJ4AjE9m6QM2AbCV6JgGyrFUZdOy2E+Ai4XSCB63frMk3rnco5DHyW9+MvqscXgwr3Xfnyyh3K8VGqN2V7He8M95pNRFkFWk6PjHd\/xAlLxDuVo14yHusnCqJrJacHvhBbejI4IreUzsWdx99xwDSOL0+dz0TaMimYZBOEvYhQmc3wk1np7CZGaZ5SzAAROGqjUAF+mVP82qWwBkvSz02oir\/UctYDCmq7K023ZxecIp8AJlYcKmvPbTys23wZOFdOMgT3Qydg4xUy2p00NxCxqoSqqpnL67Lh4ITtnfWpNRz9dxMcQtPouPhq4aiFMMlsXY54lCZcpXjfooiGihIOo761RxVq0dz1LQ26PExGnBMhfenPMV3Iz1Z1Fa4VSPvtnb6sjaTGfAAiQA8PSRBPIE6KKcxh5ao5t+mnZW72mQNdBsbPgf50Me2uzXlte8dUVYjtkRiTpOJR0mJMyS8wF8RXfieonIMdicxQYlZO46G9autHs5BDA32kXZz1xUPDAABKAMAHSCv4CpW7MKHBztnc1DHuE6q+5m5gj0tAf+46mBrPHT5eAQBAQBwB3wR9zKXPvbqkYiHP2wosj\/4dIVnn1CfC8NwfCJV"}
00740{"flow_id":55,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2213,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512517,"pkt_caplen":295,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":295,"pkt_l4_len":261,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEZOsVAAGwG7atoKLuXwKgBBgG77JKBlvuHb4ua34AYBAXWPgAAAQEICgG5Gz4whMG5EeY1MNfghvcwHwzk1R9gewO0913oGcQ7ndx4RSQ7pUPIhIxzukfB9cZ76w8elbcGVySLAVNwTs8FUVys1GNkCLUtjS7uWpnXQMNYqZXRNazc5X04H26RqJTAQRwGFwxlF88nbdaqFQ8LLE8aOjqT5pRtAVhdUU8ONZUonu1CEEHx4YShCJT\/pFwD0Q+t\/S1GvRluHzQI1PU4FYNin1je+XUNxHL4PzzF5ebWvUzrwnUMy424PiSaXPLa0lhdF3V\/0wHJZjlegYA\/bL0onOLa+i82kChtk8ACDf3J3zons95NDgAAAA=="}
00425{"flow_id":55,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2214,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":512557,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGVVbAqAEGaCi7l+ySAbtvi5rfgZb8bIAQD8v7ZQAAAQEICjCEweYBuRs+"}
00552{"flow_id":55,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2215,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":513172,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAGVPnAqAEGaCi7l+ySAbtvi5rfgZb8bIAYEACnHwAAAQEICjCEwecBuRs+FgMDACUQAAAhIK8OxPDglBgHZglnqb7gvF58UKqTrjsDINopusiBzJIdFAMDAAEBFgMDACgAAAAAAAAAALlrraheuC8w74kfls05Db0QKifAhpbCHmrMWQWiTgCR"}
00556{"flow_id":55,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2216,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":536422,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAGVPnAqAEGaCi7l+ySAbtvi5s8gZb8bIAYEAADzQAAAQEICjCEwf4BuRs+FwMDAFgAAAAAAAAAARCMW2bwqXT7UTixKtqy+\/3offTIszbzNljWCXcfUDgxESE9Vl6yU8vG0W18lpajbvjn9lQhKY13DnqQb7ITJlbF\/vin\/\/OgkcJKMuyvbRYK"}
02364{"flow_id":53,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2223,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":543759,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEadAAGwGtDs0ck0hwKgBBgG77JHMBk4leMqws4AQBAXOpAAAAQEICmD0eukwhMEPFgMDEGYCAABRAwNemFWXIK0oyHH82ZnKM8fXtkVsDQe+2lPBST+P2Dy7ayC3CQAA8W2to0xoN6PEqbPNkxOmc6lmO\/jNnIu1n5VpGcAwAAAJABcAAP8BAAEACwAO3QAO2gAJHDCCCRgwggcAoAMCAQICExYACr2jKIomrOvxeF4AAAAKvaMwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTE5MTAxMDIxNTUzOFoXDTIxMTAxMDIxNTUzOFowJjEkMCIGA1UEAwwbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8J31SJyCTCkjxtLC8JE7aU56y+0937PcYfrFGWW\/wSL1vxV6UtbY+5UyBq7YUvoZUI+YYWI6FMysHpnkiGQR5h3NLX2it0lgM0JMJXgIYfO+vdhJalxciwWfJHOcY4+eUQwpTmpGeOTzK\/sd1W+VOYbkgWPJ0lAEgTcRXL\/NZZAtyce+Sv4+b4jHwY9pwQxOHJWtnns0bK3jD\/RcAtjLeUisGvBGtt1SItPOQvgD6i2AdvjCkjqVXn0nxT\/yKuGkvtii1i85nrjeMS5pKgL+N2I4goIXeRAaK089dd0KrnNO6kLEhhSHgHwJHnPwfqeXH1Q2p1Zw2r13mOsJdyP7QIDAQABo4IE1zCCBNMwggF\/BgorBgEEAdZ5AgQCBIIBbwSCAWsBaQB2APZclC\/RdzAiFFQYCDCUVo7jTRMZM7\/fDC8gC8xO8WTjAAABbbe0zD0AAAQDAEcwRQIgXUu8wYK\/QqX5unkLcaUv4T8oQWu5yZb6M3RYbUFPJ7sCIQCVvziq+dynpJXSFyAk+ZobbjdMm8Ziuyzc0miXoW9hmQB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABbbe0zTwAAAQDAEcwRQIgOIr7NuYD18H8X6OV\/YdBgg0HoCy47ognD1Etlbp3ZVgCIQCAVAoqvjDqhz4It72mColVOT\/FZuexWjdVPWkvuAPY1AB3AESUZS6w7s6vxEAH2Kj+KMDa5oK+2MsxtT\/TM5a1toGoAAABbbe0zEEAAAQDAEgwRgIhAMLyKXAV0HvPisLX5tlLiDTgtSUtRgffnQWc5h8Pdj8PAiEAo6ENbH0+qORahbVCksBW940dOZQUoTXblsn+bri9ExQwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQa+kPWU8gwtBlTGMvS3dHpIWlv7TALBgNVHQ8EBAMCBLAwgfIGA1UdEQSB6jCB54IbKi5ldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghlldmVudHMuZGF0YS5taWNyb3NvZnQuY29tghkqLnBpcGUuYXJpYS5taWNyb3NvZnQuY29tgg5waXBl"}
02360{"flow_id":53,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2224,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":544008,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUEahAAGwGtDo0ck0hwKgBBgG77JHMBlPFeMqws4AQBAWI0gAAAQEICmD0eukwhMEPLnNreXBlLmNvbYIQKi5waXBlLnNreXBlLmNvbYIiKi5tb2JpbGUuZXZlbnRzLmRhdGEubWljcm9zb2Z0LmNvbYIgbW9iaWxlLmV2ZW50cy5kYXRhLm1pY3Jvc29mdC5jb22CFSouZXZlbnRzLmRhdGEubXNuLmNvbYITZXZlbnRzLmRhdGEubXNuLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAUxCmyVHd3H7BNm7xrFDWc0lUKQfFfvZJj7fGm702yYNfNb17H3sDMMybFW0xvlL9Ezzab9UkH29uzppLcvgSPbaskyoVw+2aUUDOWU9BNPXX55faad2R1I6KtC+PfV7YLtmbicvSGz4AqzYw9ZreqUymbtwFHx+mEj1q7bV3EnUB\/tkVGJLU4rtEsbNOyNY0rT1MPRe2qZ6z8OTI\/Ubwew2S+CzQq6NSEinFnoQ24d33L9+Q2VR7IJxgZJZ0JLJRb2EkmyBTG1bJPbFiADdV1t9YSY2ps7oVekv29d\/XDIODAnQFR1IHqlMXtC77TWoRsh1X4rC3iStLm+7YDXNcZ\/4Mj9IuoDmWavbkJCD0d5pvrPILAZtuXahuvQzQtAY2n0vu1+AhHxMbk9e2L2iJYbk++P\/GCSsH0E3MwFuGBx2aD8kcD\/GasOSgJ2hX1PemGbx7\/Y9FGQudVhN6gkjLviiZxZQGDI3hc4aNkSo6HFXMcwVO63+RLd5FmQcXxQ4wQgOa8gPG9Z+WsefaydUjjPdFmpvxlC8L\/\/hy5Vj29oZ7skaSNpSCyBSNkBskAzSt9el50ZVrhM5J4i3BG1jJVGu2oqjlyxlbfhoa6VdObxpgGXjYRrBKCYMJOGSIW1HBsVpPOHiO3HTRTWSc3nsno7KhTt65NB2bdGHaIXFW18cABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5"}
00424{"flow_id":53,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2225,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":544052,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyRAbt4yrCzzAZZZYAQD9MYCgAAAQEICjCEwgVg9Hrp"}
02215{"flow_id":53,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2226,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":544137,"pkt_caplen":1389,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1389,"pkt_l4_len":1355,"pkt":"KDc3AG3IEBMx8Tl2CABFAAVfEalAAGwGtK40ck0hwKgBBgG77JHMBllleMqws4AYBAX8SgAAAQEICmD0eukwhMEPBM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2IgwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0MAAEoAwAdID2wq4f0lQfGVzJpXBccxBDfZYX0KpmIHjjd+E2DHQNZBAEBAHxjoU6KZqBWhq0to7klz28RtGCRfewEkiZZBupxVk2we2bTgitxHqh38ATXbY6PCdco8CFnNkHHFgZdf1YWP3eqxrQBJtIN8v1Uuab4peByIwFZ\/dYYbC3uCEfCFW5OLi269pqNDsX\/TobMaAKTY\/TJsSzK3l0fJxe6R6bSuN2iphhnLK9BLKRuwGE5arn5UNXv1Nfr82AeT6RqxXxcL6t7ffpnSbteYKR2CfLp2AXxoW85XqE3nt\/Aw+tG+pzzCq\/O7jSXvqYa2iiqDjVJoI+YgJlx\/o1Ox4KQIi0HyWy+8bc+ldGKSyt09\/kuFgloinUAIqrEuWDAdTSrmLCvlcoOAAAA"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2226,"source":"teams.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":10,"flow_first_seen":1587041687245,"flow_last_seen":1587041687544,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4615,"flow_avg_l4_payload_len":461,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60561,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Microsoft","breed":"Safe","category":"Cloud"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mobile.pipe.aria.microsoft.com","server_names":"*.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com","ja3":"a1674500365bdd882188db63730e69a2","ja3s":"ae4edc6faf64d08308082ad26be60767","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4","issuerDN":"CN=*.events.data.microsoft.com","fingerprint":"33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB"}}
00425{"flow_id":53,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2227,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":544169,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyRAbt4yrCzzAZekIAQD6kTCQAAAQEICjCEwgVg9Hrp"}
00552{"flow_id":53,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2228,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":545241,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG9yXAqAEGNHJNIeyRAbt4yrCzzAZekIAYEACxYwAAAQEICjCEwgZg9HrpFgMDACUQAAAhIEEei9EC+K5+wTIH7nn4OrBCpvwIyhcSNoau7TZIohg7FAMDAAEBFgMDACgAAAAAAAAAAJhotVo7bnsIfNVJhUttAitclNGZcxD+p1Dd2JviYPnO"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2238,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":611308,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2238,"source":"teams.pcap","alias":"nDPId-test","type":38}
00497{"flow_id":53,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2239,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":618688,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"KDc3AG3IEBMx8Tl2CABFAABnEapAAGwGuaU0ck0hwKgBBgG77JHMBl6QeMqxEIAYBAVw6QAAAQEICmD0ezUwhMIGFAMDAAEBFgMDACgAAAAAAAAAAKmibfDE971fe1e\/39N5Ncwu98x5\/x81YgWFBEvwX87I"}
00426{"flow_id":53,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2240,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":618759,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG94LAqAEGNHJNIeyRAbt4yrEQzAZew4AQD\/4RkgAAAQEICjCEwktg9Hs1"}
02363{"flow_id":53,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2241,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":619835,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"EBMx8Tl2KDc3AG3ICABFAAXIAABAAEAG8e7AqAEGNHJNIeyRAbt4yrEQzAZew4AQEACbkwAAAQEICjCEwkxg9Hs1FwMDQBgAAAAAAAAAAU7pYxlahMDWRzm9MFDgTtWid9FhYd7u+WsyEYSwBibY07OoGT1CwznR0tLGYhMqBxbDN9vic3fzw\/IYGGnoKKzzTy47wPGZjbmjTn8dMJVD5tOwEHjdetaUGeeDKOJuXarE\/8LhuvnzubzxwigYsvE0AWh7exGKJ9OIBLGFKErhPtaEtPyniW\/yvGC6j4V5\/CFBqXZ5WL1haaEk\/ZjAzh57u+1VBM\/wRYp+hdNLwXvCCWDyIPDaa0FFUvOl6qrDnM4S5MIC8xvbk8GWMVUjNvCpN2SAbjujkywLs+w2uYREU3ifWthY8y3aiqGhkbqqD3FFSDjkrOYg6XAZesZXevuHC6VVrOXWKgb4Re9RxLJFHoYlQpm\/JVkNwnBNB75t3Mv0nmSTH7fNNXXS2lAgrDQYYJz95oLeu90PmgrNDR4v7SsPKyi\/9RPaXtjlIiTbBWjPLtC07VGNizU0VL4HIzZmf3gUaXqn5ShkFdtkejUlml428oIUjL4zZQJuXxOJhDmjt8bPCyjiw0K5jFYV6XKaWcgGKqaFtGaRH4bsKdpJQW1O2xVYhWr4KJqMjjiJNKaXX9JN7kg7ioy2wXnTWVoYgbARgNXAa3lw9MN4xEM\/eU6cqvvf7kokL46vpVf093TNPtegMKvXERjVVEXBKLBRc3hADgInKSHS1LyMQF4vpg9OhOl\/\/z5kWRsovrahDJM5W76w9fTCBF\/tDo1uuWKJTZhKoXy4cff6zXh1SHCXseb1rIRfJ9hciowdJTpFFEP7BBwBb+C\/By0g3wrmr8VU+nTBmC5zw1agZ1foy5CKPOzNFSbIyAcRDK6R8w4zov8n3nf6g2XGARkpti6CijLJ9M18jwwu4I0D8IjjsNpSWcyLiW1AsqT3rs6gUTdgPb7X3PZ6bhC\/C8XLVGEmlc5KzFj08cxJdQO+gNAcD4CcsX3s5Kc71xM8hqLvkHfO4bZSAYYgT3u532iSaqScjpJbhES5B7L6TQyBgmjF\/UlqNn9Un86Zd9jsOwcMEXQP0nSkyL96CImG6rRqEQ6caWrp6WoNSHGGCIs6AVgd3toq8BbDydkyiThSrDa+EikhyK5LJlI+fdBBjZB7KmciUPVZ3pP3pBismpajZUCwX5pKswfiRHqMvs41I7VvHeuJIT2vz4FGAp7bTeRKru6nrBZ6bVFRkd9+U3ZLeacxYOSFo4+lHHxKSVLFwR8hTzrY5lxWTjBCfFWPKTJT2wrvtXZqpoNOY6fLOWGqZmstL8GbkXTJDyUUaRI5+Qj0r1CgotaTR2eR0AqkW8hUzmBzq2DebzbvMViLJZRRhKNJsld5j\/2MS8xDF1TOVtNO38KkaOLsl4pYgJx1UqF\/UZjBZkr2ZGQydCWR4XS27nfcpSakppKps\/534lNKE8Cf\/gggdu5z9zzeGGuhfcDuiJcMOyzfozd\/t1naCilqNSWR2Ri4RCIK89DYlJkWngqZZqAxpQWonPAw5HLhu3i0LtfxkHAmyu00XaJ6dkCGuN2kg7T\/6+BVOreag\/L8Q3YkGqOB3DmkCrHmMUxe1YlBrH0zJqbI3+8\/InBymHqx0rNT2q67xptFmc3j3Yys50HFz\/Gp3UON1gmlNQQtXvJeVjQ1ghHQxV7kuEBmO0pHxHzu3g2SAfCfavImjSSE\/20GqcSlmZk0eDJ61opqbP2px85hNdktAnnOQTuFIRMLGCfxNziUFF2gqj48mGjuQMuUracRHxHK5rFzbQ8aRK\/bybB1szkbR9APadQ7hrcGKmJGELnNhsrukgUDtsE9mrUXF\/x5CwvhquoBT5OaUOPq6LjE\/+TkVSkBcwVYhyK+HfgTcTskywHwCgPHYu8ASXMIBgGouqXa7eg9Olih1NMPKL9q2hUOoQAbsxIw"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2259,"source":"teams.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1587041687731,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62735,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00456{"flow_id":56,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2259,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":731296,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"EBMx8Tl2KDc3AG3ICABFAABM83AAAP8RRNjAqAEGwKgBAfUPADUAOAAFY+UBAAABAAAAAAAABmV1bm8tMQNhcGkPbWljcm9zb2Z0c3RyZWFtA2NvbQAAAQAB"}
00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2259,"source":"teams.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1587041687731,"flow_last_seen":0,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":48,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62735,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"euno-1.api.microsoftstream.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00639{"flow_id":56,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2260,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":745080,"pkt_caplen":225,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":225,"pkt_l4_len":191,"pkt":"KDc3AG3IEBMx8Tl2CABFAADTPBBAADkRgbLAqAEBwKgBBgA19Q8AvwAAY+WBgAABAAQAAAAABmV1bm8tMQNhcGkPbWljcm9zb2Z0c3RyZWFtA2NvbQAAAQABwAwABQABAAAGxQAfCmV1bm8tMS1hcGkOdHJhZmZpY21hbmFnZXIDbmV0AMA8AAUAAQAAABUACwhldW5vLTEtMcATwGcABQABAAAAOgApHWFtcy1ldW5vLTEtaG9zLWFwaWdhdGV3YXktMS0xCGNsb3VkYXBwwFbAfgABAAEAAAAVAAQ0qbp3"}
00689{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2260,"source":"teams.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":1587041687731,"flow_last_seen":1587041687745,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":183,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62735,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"euno-1.api.microsoftstream.com","num_queries":1,"num_answers":4,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.169.186.119"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2261,"source":"teams.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1587041687745,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.169.186.119","src_port":60563,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":57,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2261,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":745932,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGienAqAEGNKm6d+yTAbth0wzHAAAAALAC\/\/81+QAAAgQFtAEDAwUBAQgKMITCxwAAAAAEAgAA"}
00436{"flow_id":57,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2265,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":789261,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8GLFAAGwGRTw0qbp3wKgBBgG77JMQ1B2QYdMMyKASIACACgAAAgQFoAEDAwgEAggKASJ3bTCEwsc="}
00424{"flow_id":57,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2266,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":789367,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGifXAqAEGNKm6d+yTAbth0wzIENQdkYAQEAm+kQAAAQEICjCEwvABIndt"}
00724{"flow_id":57,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2267,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":789561,"pkt_caplen":287,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":287,"pkt_l4_len":253,"pkt":"EBMx8Tl2KDc3AG3ICABFAAERAABAAEAGiRjAqAEGNKm6d+yTAbth0wzIENQdkYAYEAmMqgAAAQEICjCEwvABIndtFgMBANgBAADUAwN1hCAWlzZVXD7TCb6igB3LJP9WVkluJUaJIbsmWjvyJAAAHCoqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACP6uoAAP8BAAEAAAAAIwAhAAAeZXVuby0xLmFwaS5taWNyb3NvZnRzdHJlYW0uY29tABcAAAAjAAAADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAAEgAAABAADgAMAmgyCGh0dHAvMS4xAAsAAgEAAAoACgAI2toAHQAXABgAGwADAgACOjoAAQA="}
00739{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2267,"source":"teams.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":4,"flow_first_seen":1587041687745,"flow_last_seen":1587041687789,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":221,"flow_tot_l4_payload_len":221,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.169.186.119","src_port":60563,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"euno-1.api.microsoftstream.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02375{"flow_id":57,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2268,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835274,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGLJAAGwGP6M0qbp3wKgBBgG77JMQ1B2RYdMNpYAQBAV+GwAAAQEICgEid5owhMLwFgMDF2ICAABeAwNemFWXh6zC4\/H\/NtqCN0bOMCauIHEB+mzTfOs8euglHiDdOQAAbpqWXnIoaFoz5CwjBIm\/uwJeUgS1lb4+XjBSWMAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsADp0ADpoACNwwggjYMIIGwKADAgECAhMWAAXWDX37jaDzNM+RAAAABdYNMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDAeFw0xOTA3MTYwMDAyMzVaFw0yMTA3MTYwMDAyMzVaMCQxIjAgBgNVBAMMGSouYXBpLm1pY3Jvc29mdHN0cmVhbS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3WyrqhMwneHn3ldwh\/L7UvhOaeyJEw9wAAoXcE2xoCmqN4VQ5dbEJYH2mvnyhH\/q6XQPMuv5SvOYFeFvBsXU42c+cX\/k7ETSWOHymPaiIe9DTakXAw15b1zeAID1a\/qtYq5SKoRqlJOmhP2W2Kj0sGRH9wfU0k6ZKAWCfTCOD3TUKn+kY2\/mFqcxx163RyO5fuue9HjLSPUcK\/XG71pH60ASR2HaDJ53frCURseRASs3N8sp\/lXPNSJpmTy7XzZlvWnjNXBXoGazR\/Ok20dcDNsKQLrS\/5IQoN1eesCyt1n77jwW\/wlDvDN1w4lyx8ZJ\/cWIxkLDRUfkhCN5r674PAgMBAAGjggSZMIIElTCCAfcGCisGAQQB1nkCBAIEggHnBIIB4wHhAHUA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFr+B+\/gwAABAMARjBEAiBFAIuj2Tc26ezbEtOORf3erX84s94DFwS362RUQnwe7QIgOIGvV6+3NbZm4ZuetunBQ10P6vIaYP3f6rBpFmv0R+kAdwBElGUusO7Or8RAB9io\/ijA2uaCvtjLMbU\/0zOWtbaBqAAAAWv4H7+HAAAEAwBIMEYCIQDNJZUV9kVpum734SuFZbu\/+8d+lBfpKXnRWlVnv4VBQAIhAOB8l0UtbGxz+O5oUYg0D5KcrYbc2wZN7ZDiNmBXUAj6AHYAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFr+B\/ArgAABAMARzBFAiEAuBvGi+GOETS1WKJJY5hLjgoB7c051zHr2NZg0TjxMOsCIDxZ4sYqPPwpfAkKARkELM5\/901w8Rli7y0l6JyGidHOAHcAXNxDkv7mq0VEsV6a1FbmEDf71fpH3KFzlLJe5vbHDsoAAAFr+B+\/jQAABAMASDBGAiEA+MKOXA0Ondu3DQFnrt75yf8KubCg3tehYpwWY4vXmlsCIQD\/nRJiTBIbc8ubEEHt73izO3Lpmnq\/6a3pOruDbMUQaDAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2E0t9CgueTegIBZAIBHTCBhQYIKwYBBQUHAQEEeTB3MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcnQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLm1zb2NzcC5jb20wHQYDVR0OBBYEFBqManmr"}
02374{"flow_id":57,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2269,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835383,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGLRAAGwGP6E0qbp3wKgBBgG77JMQ1CjRYdMNpYAQBAWsgQAAAQEICgEid5owhMLwwOanO13rkB+7itickOM6sWzClM4+MmvLcbNBLrnF4V3YWSeC++FIDX7oBPH5ASdB+pRafcUwu7a61xGbiPoBzG5Lkrn4eDzLnGiaFmaI0JOwKoMulxEdfoEgYeSwuZucblOVlSLG2b11ELrZdYw8Px3QlvgzRXt7H1Qz5UiXpwUkotvR3JWuICp9lolIe5J60CSx3kgR92c8tN\/4WGD1T3s0aOb9rCYItvMsQ9tPxBbQmwxxh7EHa4bdj6Cx+2ba2Mvp8vBl5Y7YHOovui1k8V7QG1CyDIVKzzvILipqdYzArlzZ6cB8fXzanOO9SrBgB4IrfV3IEK8uYozcmv3h2blZSJdCGsNQgQsfgyJr5Ju8KSKC\/YBRXHVfDjXC3X8vemefPY5bjLuvnfTMDPuoH50hwfPnUhpdzhRXbVC4Se6xCyfS4mknEm7GwCY+56QrG4tTOAb6Goc64Et\/mRZOWT1ZafFxp2VlGwIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFHp7jMHP56DKHNRr+vvhM8MPGqKdMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBABH+cgY6IQo3bsj1KSICYp5FDu36Bp\/vv54kNRf+OYiyuwHheN\/Ri5f9t3fxinJPSTrosynXdIfkufMXYIeIklWCvdl9E0h\/BpA6iWbnnZb3lc1gD9fhyvZ27vqbNUihmH3SkypPgRbHqJa70SXzpm9Q2gCbKqj0NQDj\/Sw77eUVm38WD8eOyTYglPAdAbkSUFCZgeAoQiyOeP\/txp7V5MrpoKqzSE+kX+SLGP8TAi2QETYYZig6IprelfFZ7p9tKhd1k1DDBRLV3mS0trzb13ZZ\/qXW5Vbh\/kZcO4r47A777xKQkc4gEoG6PFLjf+NA9AxBIGaHGNoyaeD23I8o8r0WAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQUov5qP4QsEh\/ZqaZNTXvN5iiM8UwYDzIwMjAwNDE2MDU0NDMyWjCBmzCBmDBMMAkGBSsOAwIaBQAEFCKvAByAdWIHJuDIkxrsp0IcMhI6BBR6e4zBz+egyhzUa\/r74TPDDxqinQITFgAF1g19+42g8zTPkQAAAAXWDYAAGA8yMDIwMDQxNjA1NDQzMlqgERgPMjAyMDA0MjAwNTQ0MzJaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTcwNTQ0MzJaMA0GCSqGSIb3DQEBCwUAA4IBAQBBH0DLZunGVBeAKCXAyKBsflNVIX8JjxQ1XCt6s9miilzUAXjwI99uBl7swMjB1ALnJKy+2rca\/25L8XzDVvPYcM+x\/Gedy9NxkxBmZ\/X7R44fQVEKYzoqijEj7X\/K4uXE99MLXzwEuNywXIHp4EMlFpfj\/8ZV\/KoPDGbuRXrPsh4c\/\/I02wwbomuM4waDq9SVNwHXVGBP0UfSXCtnQm9AfmbgNEYHvJK\/rst2j6FvdyCK4YJ\/qrygiWeKoGapDxeDt6OxnHzQJvI05so4hdZw"}
00440{"flow_id":57,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2270,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835438,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGienAqAEGNKm6d+yTAbth0w2lENQjMbAQEAAIwgAAAQEICjCEwx0BIneaAQEFChDUKNEQ1C5x"}
02361{"flow_id":57,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2271,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835690,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGLNAAGwGP6I0qbp3wKgBBgG77JMQ1CMxYdMNpYAQBAWHrwAAAQEICgEid5owhMLw\/vSuTLozArA64Wo3KT6EMAsGA1UdDwQEAwIEsDA9BgNVHREENjA0ghkqLmFwaS5taWNyb3NvZnRzdHJlYW0uY29tghdhcGkubWljcm9zb2Z0c3RyZWFtLmNvbTCBrAYDVR0fBIGkMIGhMIGeoIGboIGYhktodHRwOi8vbXNjcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmyGSWh0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBJVCUyMFRMUyUyMENBJTIwNC5jcmwwTQYDVR0gBEYwRDBCBgkrBgEEAYI3KgEwNTAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3BzMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQsFAAOCAgEAOzP6+rTCDCwB94ic7SgiY+0+FGz3jTBK5IAaZbieRK\/bfab7xSaeU3ikMR+1M8GOhr6BN1MJVc1sRgc3LOvGGvY78A6B3zYyTvTKOJn5oBNGhxM+QBSjpfUdx+T5vo\/kgcSLSOdNt4INsgRm+uWnENhEkJOilMkStzztmcmMYgbNuNAhpUfE+8ddhTVq+gx9qgpdD1RNZPZ7V3VKZVf63rgaTg8AjRcBP605wqUN25aQKizDa1uDgtnZTj8fY+vh2qm1DK\/UHFVF6pTvTuPl9l+ANwMgE2lk93nf9T8wif59ZWxMgDqu+5tHi8wZqzZFPXHoXk9Sqhyg1D\/0nb6qrSQPIUEPozufDsffSJjS9LTCo7SRgeFmeQ3ESjAy\/TSoqEAEj1E+ujf2By4DZGTEfUexa0bNq78KDy3N+9JgjYNaigA6gCHAsw7KxwKeIvDlAyypN9cAVBacM1wk5DXSCaxgJfFOA6GRbciFpG2q7HEouWVfec3PgpmuxjTeO5f2groeBBQTGUXfS5mYkYYsDc6WJRL7Tx5gALrnmWhKesvssYt31HrmD\/gBVKr5vkipW6NH\/VTa6O+vZ\/R8I2s0gYXBXB6mHcq9pk8iLFms3FvmvODtZHzNrmeGqhXMapvF1pz8NiObZolG+mLxtYQpb9OpMGqmDXVKB2tuh3cXLF0ABbgwggW0MIIEnKADAgECAhALarOwPrGp9sRgkmqozf6zMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTYwNTIwMTI1MjM4WhcNMjQwNTIwMTI1MjM4WjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgVExTIENBIDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr5etdo2s5nvU0iBK7HVImXX0JC8Z5jqu3Dt8Zst3uD\/bu9FbkRuKSD+JnC+MccaTUQXO0y5kWjr93fbCvHmztcS7DCHdKXpKu7FrQSIHQxemg9XqPHo1e062SwNrGkTUxILk5BM0QKjyXHQCemRgYCc9Ll+TJ\/ADwDFqdNuiyQMFKrIQoqj1GGCuniqz0r0uofklCx2Ig"}
02380{"flow_id":57,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2272,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835705,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGLVAAGwGP6A0qbp3wKgBBgG77JMQ1C5xYdMNpYAQBAVPHgAAAQEICgEid5owhMLwrUrZIB3GygYdM2Rm9BKs4B5b\/dFbdIfQ9GhDxwZ0NfohKTIR684sW7WJOCyGJLC2oIIFIzCCBR8wggUbMIIDA6ADAgECAhN4ABSW0dxPXl3t0hoKAAAAFJbRMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDAeFw0yMDA0MDIxNzA4MjZaFw0yMTA0MDIxNzA4MjZaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfNF9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvZKDG+mMNiPMFKzRYw+NoSfF\/HSmHxhQQ0eQ20GCZMv8jjwhIDnXc8Nm+BGWQQvyO7MoeLEqJ60y1tONfaDRG75vRfHeNOkm9SdOGo6wS\/TvY2uJhfe26rZiVtl9K9dfmDgIMFkDHVXxj0KcE4\/k6P5Q6xYET2mF+\/KGt831cEAM+tS6KbmXYfdazHpWBjZaqIT8APvroabmHFKs7KBN07qhhE1LqnLYQgPE9J+jTqh\/5\/5t3lTg7V2Mv1ie\/MdFwkbfFlGwNIFdlK62klWt1Rzc6yPLKBAqhYcJumU5hcdi1esvnZXhHyU8Gh4YY0jJfeeUcUkWPaDNhxUKbt+v3QIDAQABo4HWMIHTMB0GA1UdDgQWBBSi\/mo\/hCwSH9mppk1Ne83mKIzxTDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBR6e4zBz+egyhzUa\/r74TPDDxqinTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAo+X1IrQtj4RdTWkMIlk0gtf+2wu2EGBVWR0UNsC6fTHxbDxCaVbqosSumFX8B5TSL6h9j7U1EEjd1Lk8dAX3JdPZVjSypAFK2L3O7NHDa5\/XUYt8hnHkRY0+UySE99fNY3FRWLb8WQlY3fCq\/BpKGblzR\/mx6V9ZnwGqrxJGWajHwH3qYhV\/fCTdJd4c2lluNReXs5wfpPv6vywsRrwRg4QFxLkkX6Tg8QeqTmY0GumBpzOoIkuHG6KLdLtsgEh4bqwFl7zfB4Q8PGnGxOnDTYP\/nJcd30L6jEA\/glBtUCDKgeMV3Dhzciw4TsXFN81RJk1aZBeM56Le9DfadHRyEQeM2VN0nAq5AahNAXSTjmOIVXvPuzQi\/aseq\/50Hc\/XxKWBQGJ\/CD5LTFDd8+iX9yigG\/ImEMgAhWYv444XXtlY6f08xfqPOdmDPEyMgEgg4yo1Rot9ddtsH\/KQA5Q6StU7pdNx2XLbrB6+AINFRMg8VEPOg3qyWei0E\/ibAAtQRBMTkdNb66W3B\/k\/pQgcRnYC0oe1b0+tvb8g5WPuJnxYxbc6lmR+E+ZvnSvgoePlIvUUSi6PTKZQlZOKM\/tIkQtQdmyV+oFnNvBViCE+Ouxo4+vfhdrD0Q86Iyf77mdoP1e6jOMLzre\/UzbnMhFjQ7cN9bjKARhGxFN+\/7Pgs8sMAAEoAwAdIABskHbq6GJUYl5ELC0FNOFj+2szxYn6Iujn+2z2fUZCBAEBADyJxG8sUjRvcmxNKTCiN\/EXT3h+SwBeoqLEm+rx"}
00739{"flow_id":57,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2273,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835706,"pkt_caplen":297,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":297,"pkt_l4_len":263,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEbGLZAAGwGRFg0qbp3wKgBBgG77JMQ1DQRYdMNpYAYBAWZXwAAAQEICgEid5owhMLwlUn3uHgdhgU4MHogDrsVrY6D1rZLJHuvf87AS5dveCXuWr7wVSU8d\/VVEagzs9HiJvDqzYhOTLFh47XeH8G2GqoHo2gLYlw7TpXRKe9jUapVLBq6r0AIg6kvr4OnjlVSUL3d1meucwV4gMn1IMvou4XS3791x289aQ5rjH6jk2RWa3pxCGKDlijxsc\/q1WDbgRQYx3jOZa5HBeb\/VGPkU8iXp3F5K2yGp1JlNKWIBkufSBPxEt+i0B6Tc8BJsHOXF4aBYp7IEYbrHmXfRYs77Gd2PybaVEOcKhft5LW9z2TAUJsOAAAA"}
00425{"flow_id":57,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2274,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835756,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGifXAqAEGNKm6d+yTAbth0w2lENQucYAQD6as3QAAAQEICjCEwx0BInea"}
00425{"flow_id":57,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2275,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835757,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGifXAqAEGNKm6d+yTAbth0w2lENQ0+IAQD3GmiwAAAQEICjCEwx0BInea"}
00426{"flow_id":57,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2276,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":835759,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGifXAqAEGNKm6d+yTAbth0w2lENQ0+IAQEACl\/AAAAQEICjCEwx0BInea"}
00554{"flow_id":57,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2277,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":836212,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAGiZjAqAEGNKm6d+yTAbth0w2lENQ0+IAYEAAnVQAAAQEICjCEwx0BIneaFgMDACUQAAAhIMy35KoEGSMcFnBa8jNDHx1RCVuhV\/QU89YQEITmKYxRFAMDAAEBFgMDACgAAAAAAAAAAFUqcKplxXzSNxk2DYQCNpbL\/SsW1VcXCQjZlJHNg+wn"}
00553{"flow_id":57,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2278,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041687,"pkt_ts_usec":844964,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAGiZjAqAEGNKm6d+yTAbth0w4CENQ0+IAYEAAVhgAAAQEICjCEwyUBIneaFwMDAFgAAAAAAAAAASxgyx+Ky9RBAf0mud9B+q5CGZWyPshwEGQXTMTr7pa+hWGxwf18PjoNJzvtqriITj3xB8PcdsVT6zknQV+6Qnfc9EdObGk\/UuzAvm+KPAUt"}
00470{"flow_id":32,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2304,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041688,"pkt_ts_usec":134826,"pkt_caplen":97,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":97,"pkt_l4_len":63,"pkt":"KDc3AG3IEBMx8Tl2CABFAABTwZhAADQGRFanY9ekwKgBBhFS7ILLfL0aJqxLk4AYAfVZTwAAAQEIChN5Lm0whLFTFQMDABrJs0SB+OzC2\/de8I9YL02OJFD2ECcCfrYWyA=="}
00427{"flow_id":32,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2305,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041688,"pkt_ts_usec":134925,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyCEVImrEuTy3y9OYAQD\/\/2kgAAAQEICjCExD8TeS5t"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2311,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041688,"pkt_ts_usec":611359,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2311,"source":"teams.pcap","alias":"nDPId-test","type":38}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2313,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041689,"pkt_ts_usec":410919,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2313,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2314,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041689,"pkt_ts_usec":611350,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2314,"source":"teams.pcap","alias":"nDPId-test","type":38}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2316,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":611386,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2316,"source":"teams.pcap","alias":"nDPId-test","type":38}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2317,"source":"teams.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1587041690880,"flow_last_seen":0,"flow_min_l4_payload_len":54,"flow_max_l4_payload_len":54,"flow_tot_l4_payload_len":54,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63930,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00464{"flow_id":58,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2317,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":880711,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"EBMx8Tl2KDc3AG3ICABFAABSJv0AAP8REUbAqAEGwKgBAfm6ADUAPoc2eGoBAAABAAAAAAAAAmRjE2FwcGxpY2F0aW9uaW5zaWdodHMJbWljcm9zb2Z0A2NvbQAAAQAB"}
00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2317,"source":"teams.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1587041690880,"flow_last_seen":0,"flow_min_l4_payload_len":54,"flow_max_l4_payload_len":54,"flow_tot_l4_payload_len":54,"flow_avg_l4_payload_len":54,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63930,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"dc.applicationinsights.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00743{"flow_id":58,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2318,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":915102,"pkt_caplen":301,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":301,"pkt_l4_len":267,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEfVLxAADkRaLrAqAEBwKgBBgA1+boBCwAAeGqBgAABAAUAAAAAAmRjE2FwcGxpY2F0aW9uaW5zaWdodHMJbWljcm9zb2Z0A2NvbQAAAQABwAwABQABAAAACgAuHWFwcGxpY2F0aW9uaW5zaWdodHNfaW5nZXN0aW9uB21vbml0b3IFYXp1cmXALcBCAAUAAQAAAJEALB1hcHBsaWNhdGlvbmluc2lnaHRzX2luZ2VzdGlvbgtwcml2YXRlbGlua8BgwHwABQABAAAAXwAXAmRjDnRyYWZmaWNtYW5hZ2VyA25ldADAtAAFAAEAAAAeABwQY2ZyLWJyZWV6aWVzdC1pbghjbG91ZGFwcMDGwNcAAQABAAAABwAEKE+KKQ=="}
00695{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2318,"source":"teams.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1587041690880,"flow_last_seen":1587041690915,"flow_min_l4_payload_len":54,"flow_max_l4_payload_len":259,"flow_tot_l4_payload_len":313,"flow_avg_l4_payload_len":156,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63930,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"dc.applicationinsights.microsoft.com","num_queries":1,"num_answers":5,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"40.79.138.41"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2319,"source":"teams.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1587041690916,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60564,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":59,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2319,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":916341,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGxpHAqAEGKE+KKeyUAbup7MP+AAAAALAC\/\/9nAwAAAgQFtAEDAwUBAQgKMITPEwAAAAAEAgAA"}
00437{"flow_id":59,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2320,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":946470,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8GwdAAG4GfY4oT4opwKgBBgG77JSCI5UvqezD\/6ASIAArFwAAAgQFoAEDAwgEAggKUvjCpTCEzxM="}
00425{"flow_id":59,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2321,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":946579,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyUAbup7MP\/giOVMIAQEAlpqQAAAQEICjCEzzFS+MKl"}
00749{"flow_id":59,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2322,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":946965,"pkt_caplen":305,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":305,"pkt_l4_len":271,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEjAABAAEAGxa7AqAEGKE+KKeyUAbup7MP\/giOVMIAYEAnoKAAAAQEICjCEzzFS+MKlFgMBAOoBAADmAwMbIQaP+rFGCYsreMCv9lvxK9Aj9uBCbNOtF1CHIeISyAAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACV\/wEAAQAAAAAXABUAABJnYXRlLmhvY2tleWFwcC5uZXQAFwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAM3QAAAASAAAAEAAwAC4CaDIFaDItMTYFaDItMTUFaDItMTQIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xAAsAAgEAAAoACgAIAB0AFwAYABk="}
00761{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2322,"source":"teams.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":4,"flow_first_seen":1587041690916,"flow_last_seen":1587041690946,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":239,"flow_tot_l4_payload_len":239,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60564,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"gate.hockeyapp.net","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
02351{"flow_id":59,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2323,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980253,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGwlAAG4Gd\/QoT4opwKgBBgG77JSCI5rQqezE7oAQBAU0IQAAAQEIClL4wsUwhM8xdGlvbmluc2lnaHRzLmF6dXJlLmNvbYISZ2F0ZS5ob2NrZXlhcHAubmV0ghVkYy50cmFmZmljbWFuYWdlci5uZXSCH2F1c3NlLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHmJyenMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdY2NhLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWNmci1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1jaW4tYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdY2tvLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWN1cy1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh9jdXMwMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1lYXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdZWF1LWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWVqcC1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1ldXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDItYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDQtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDUtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIeZXVzMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh5uY3VzLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHW5ldS1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh5zYWZuLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHnNjdXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdc2VhLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHXN1ay1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1zd24tYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdd2V1LWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCH3dldTAyLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCH3dldTAzLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHXd1cy1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh53dXMyLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCIHd1czIwMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0MIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAJWTZzx1MK5GdVXHHDNo4UfZmpqNSZyuP+i0NBu9AKrV3sQoq5pmeYJ7vP+oV2p39mLTb2oqM52AGvlnpmoTNJwN7XVFBPYI8jrT6ZwWv1hAZa"}
02370{"flow_id":59,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2324,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980284,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGwhAAG4Gd\/UoT4opwKgBBgG77JSCI5UwqezE7oAQBAXCJwAAAQEIClL4wsUwhM8xFgMDGyQCAABVAwNemFWa20Cj7Unjex3iJOTtzxG\/C7sRUaW8D8adjZRDjSBSLgAA9oEaTw33+XDCI2eobHPkHM5cfyRARrnQe4Dl7MAoAAANAAUAAAAXAAD\/AQABAAsAEkcAEkQADIYwggyCMIIKaqADAgECAhNuABQ+IygxVnX+3gt8AAAAFD4jMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDAzMTcyMTQ2MTRaFw0yMjAzMTcyMTQ2MTRaMCcxJTAjBgNVBAMTHGRjLnNlcnZpY2VzLnZpc3VhbHN0dWRpby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTjRhywpCP09kk\/FUbRL0JHcwFbXYrKO+yEnwFM3rPYCWH\/N3ytkgm55W3De9R7TQ4nG6hXjvu49n3GFbb7tzgjX4oUgzhxxZTMBnakqeLogod6D5ZdDfokss9bp+ils6rtyCJ2XgEKGa5\/c8Mrrd6rtcviCMBXmgB2qxkza1z3wKmopsTvC\/wZ3Plw8ddfnLBdhAtnPdFwhZLXumxfbNwCtNzeqzd3gMfj6Vx9tJpzRnOOnFRUc8UHNW\/hDyGqfdV9oadinJHISOkaW14SG+NiKCbs62+K4kOYuse8tDejJHAH5YGV2juPptMgDxbpvzxpK0cFfQD7NTJKkWmOjp7AgMBAAGjgghAMIIIPDCCAYAGCisGAQQB1nkCBAIEggFwBIIBbAFqAHcARqVV63X6kSAwtaKJafTzfREsQXS+\/Um4havy\/HD+bUcAAAFw6n9T+QAABAMASDBGAiEAmX768G6NS+ZYbiNO9DZJmZdvkp6\/SHor7vGRrNqzQZQCIQCzE3PNmahLeoD1Ru15LTmGBf3T\/5eQtpKsbupBPVD5rAB2AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2AAABcOp\/U6gAAAQDAEcwRQIhAMlAkpZnDcncwQhl8yQ9bv\/urmUo\/HvBUXlQ2OoHaY9wAiBX8w8hdwe+ti1JzlOgo+l6ERsL\/85ZiYbyBS4PLBobRAB3AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABcOp\/VMgAAAQDAEgwRgIhAKECRib58RCo5MlQHGb4ATWRjKZrjAjdUPi+tLxPf7uOAiEAilsYu+v0osacw7zHLY7aZ\/y5oCRfVO4yXuUTkPyx1scwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSJNZ2CkQqUlyOTG\/kUtmT72TvlhTALBgNVHQ8EBAMCBLAwggRZBgNVHREEggRQMIIETIIcZGMuc2VydmljZXMudmlzdWFsc3R1ZGlvLmNvbYIkZGMuYXBwbGljYXRpb25pbnNpZ2h0cy5taWNyb3NvZnQuY29tgiBkYy5hcHBsaWNh"}
00440{"flow_id":59,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2325,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980356,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGxpHAqAEGKE+KKeyUAbup7MTugiOVMLAQEAny+QAAAQEICjCEz1JS+MKlAQEFCoIjmtCCI6Bw"}
00424{"flow_id":59,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2326,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980376,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyUAbup7MTugiOgcIAQD69dkwAAAQEICjCEz1JS+MLF"}
02373{"flow_id":59,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2327,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980448,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGwpAAG4Gd\/MoT4opwKgBBgG77JSCI6BwqezE7oAQBAVTtwAAAQEIClL4wsUwhM8xF\/KtH5EMefO8hv0pjo+hGaXILLf3FXEJEUNym4UkrCLWDamR59f1QmpKcgSIkZifPw\/6jT04Lx3G8j0u\/4Zr8jqlRUvE3IGU2i\/9PtddIGVo8QNa6Xkq8YGSG5VNgIqMIWbCkj8KJ+Czz+OcotlKrPgIDMBvcI4lpWpdQBZoNdY\/ftIR1NdqVrXotwyqYoxBWW54gatmCMI5+vrG+wwV9MdXq3rBSGLoxQncTvajDkV9i5fN4tSuYczQhYrBGR08owS10B3943mfIHr5DhObTJG3iM8z8j7RasCVMq\/+VyYlJVIsyOMCOHG8sv9fTaE2ij6GigWf\/juNwMk1x5uPV9+\/O8dKEkydhAbtb9ZVHFRiFtv\/fXg8D\/Yemtk8TlkLO6Zhh+iFVXckQUpYNXe1ooy7P7hUDicTS++Mgu1XjAkhTrNNty8pZaWucLOG4jFDYVxnhRF9NoO8URVfJk3w9jlssLCVT0Qxx7zinN8mIQmEz1QrPdOYm1I\/wWe+HOjmr36nHdTbGfZNfvsP5qR2Y+OL8cjV1OlMkGgqfDsgP5F+alHjTAiU4lKdHxO5qwAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEF"}
00425{"flow_id":59,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2328,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980527,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyUAbup7MTugiOmEIAQEABXogAAAQEICjCEz1JS+MLF"}
02371{"flow_id":59,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2329,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980564,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUGwtAAG4Gd\/IoT4opwKgBBgG77JSCI6YQqezE7oAQBAXiXwAAAQEIClL4wsUwhM8xBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBT9VOfspjpsX70VZxDzhO\/uVmwbaRgPMjAyMDA0MTMyMDQwMTdaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhNuABQ+IygxVnX+3gt8AAAAFD4jgAAYDzIwMjAwNDEzMjA0MDE3WqARGA8yMDIwMDQxNzIwNDAxN1qhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNDIwNDAxN1owDQYJKoZIhvcNAQELBQADggEBALbgm71AWYOZTie0KeKjYwxvVoXz4vDiHOqZHdOoIowBWr\/drgQ3l0ZdIQRjTiy\/BXVIiawP8tk411gNqJEKbcsIwrSIvmaUStGQuDpnMTHfE8Zw8G2Jb79BTaGtCmHNkf81sG6cFp4MTrMWzImUKZcf33w6cI97M5ldv\/VwXh+RrvcgjRUQhCK0DEFYzMbADuRhRZAETz3zWdRiTOoSExrU\/SkfLarmuqe1Rtze5mRTP40QQb51tfRk4neXLXLHLko\/n3SEmQwJp5cZ1IhXOqlPlPFYWpPefkqmOCPIyTCa40sRXghx3Gactxtfjee24xwwtXUYKA\/YqWLg9IgCji6gggUjMIIFHzCCBRswggMDoAMCAQICE24AE\/D2Kp4kxgB1wsEAAAAT8PYwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MB4XDTIwMDMxNTE1MjQzOFoXDTIxMDMxNTE1MjQzOFowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV81X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLL8jj3UBzU\/au5HTPbtPMCk5oVv210n++4hY3ar0HqI9QquzZ4bSqFbTrvtEbBDUYjsuWRRyh7PmGb4\/i5111AQMiqmHCXMlUEoISsFDVWgU7ngCnMhwhp48l8JBmtkGzagdLpyHYHcSiPAlGCLd3jLiBKzM\/ueqOFFcN5TX5VPlL2bsNstKGUgz+WDhIfD0rhDLaagjE5kTA"}
02037{"flow_id":59,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2330,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980695,"pkt_caplen":1259,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1259,"pkt_l4_len":1225,"pkt":"KDc3AG3IEBMx8Tl2CABFAATdGwxAAG4GeOgoT4opwKgBBgG77JSCI6uwqezE7oAYBAViWgAAAQEIClL4wsUwhM8x5Hlzx57WHJdADehPDFVjuBfeAlZZfr5n6B895zjgrfQ5aiOSHga1h087GXde6\/l1KqhKH6h6hhEXE5ueZlHVt8E78+aTJ8R72aoP7RFMtNiGy6NcvSO5txy6nvamfpgaF+6trEkXAgMBAAGjgdYwgdMwHQYDVR0OBBYEFP1U5+ymOmxfvRVnEPOE7+5WbBtpMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFAj+JZ906ocEwry7jqg4XzPG0WxlMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBuHFOoYYKg3cb0bUdjBxt0hVtcSnqF5W8ns\/9POrOjPDOf06GOC96qd9hr7hzAMCTioOAKpJ6fxlxkaOZvZAdvbi7AB\/SSaqRPF+sSsVoEuHOeBJYXeKJ2gjkaigkkIN5VcPFG2IjgkgIkk\/ho4Js9P+Uz3qAYfTPWFBpG+Iqrz0ohHyF5lnGmmGqBfpPCaUGisapj1uGyPYySvMpw6VrkfurOb2qw4NKYKHL+lu2XK0iQumrgg5H3wXsc3A2dOpPUQk4f6u4Cl+3z74P+XmrgzFCXvFQsZd46CNTqGRoEomrdF1xluttGd23tPXgK2Ij+kxVrxEG3nuAMNfvpbW6DLNtmaIB2\/MnW5seyQgrzAqc4X4+ejAnzHVfaGwQw8s2APMSDDKPlXsPqR4WzmEcRLj8qZWAjgb7afrWYUdpLL6GNC8talUqDHqz0IUfEREp2wMTNU05Iw3OOmn+EPWxxb3yKSz98D0BK3d0BfGuuINxw7D8yrEe5C7HzxcJW93BSLniXitCzJ7xP7vgE\/u7evLIsG4aYySMy3gMmFMW0e1fLKFisP7WNWhMY40d9uen4aX8Wo8+uJ5lC2sVG\/Fl3f5qa\/nbuVlQ5c4F9X4YT3X7ghItjAt95eutjN0qOIZLK0vLQBwDDhvcC5C2Ogjgr8KGdKMh8+Xh7DKUI1mYyvgwAAUkDABdBBFaextCTWVGlUc4\/nJZPiNXi7yMQE9JLYURjzEwIBAsbaNJhwuzplixERcrVF\/J3j\/GYHPs8LQQoPspm5I33wdoEAQEACJMWRl4sH0m\/zZfPV9NphA95Sp0WGgGZ5LWTmueROXpEideb4B4xfFAvSys7kqxWUHLylRuNPOzRqUdQOMKSFP0iSX1EiffIGRoCGYGQvWrAH4XF20yJfrTS32bSVnlTGXUuR9goWWYr5xy6yK74POT15P+M5rTiODs2eg+H\/WWqHn+CILUDIUlCgdhZjcZp3p8Tl4QPsjGWmB3MUimd55RQ9K79IegYpW4agAa8s4cn1v56IvOadOGGW9fIrOQKfPecXqBflwGLSxObaKf4eFPPw3SiBGufHNk2Rb75XQowGByWIC0gKFaqViQn71zGPatMOrnKIdxS19bJ35hoqA4AAAA="}
00425{"flow_id":59,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2331,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":980730,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyUAbup7MTugiOwWYAQD9pNfwAAAQEICjCEz1JS+MLF"}
00676{"flow_id":59,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2332,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041690,"pkt_ts_usec":991303,"pkt_caplen":248,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":248,"pkt_l4_len":214,"pkt":"EBMx8Tl2KDc3AG3ICABFAADqAABAAEAGxefAqAEGKE+KKeyUAbup7MTugiOwWYAYEAAW4AAAAQEICjCEz1xS+MLFFgMDAEYQAABCQQSUnYSpybVYpi0p11KRpbmhDxBYhpXs5PROhBf4L2I5udzZUNYx70vQNqldliW9YUOr3Ds7MC+ESYnGUnUCnqeiFAMDAAEBFgMDAGCQ8BEm9rKcsTBnitntEAU7w\/ebg8cwxch5T6MJMx5sWNKe3opj2yGBAl7jJQwnA6\/JZOhoJxAXbcFpzYdB74brSKX5UU\/5TfIPccnelKyI+2smrraCFoe9GA\/I3dLOqBk="}
00573{"flow_id":59,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2333,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":23203,"pkt_caplen":173,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":173,"pkt_l4_len":139,"pkt":"KDc3AG3IEBMx8Tl2CABFAACfGw1AAG4GfSUoT4opwKgBBgG77JSCI7BZqezFpIAYBAR8aAAAAQEIClL4wvIwhM9cFAMDAAEBFgMDAGA8Y2ZIWeRHbyEr11qF9jGK6p2aZClxjDUYQUISatc4CMtjM8T0AW1danbz\/TUonKqcSp07EQXLmUGHz0azZhSQ\/P1XmIHbTE3XM0JPoHoHdkx69JC4UjQ23LrepYpKgj0="}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2343,"source":"teams.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1587041691075,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62863,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00478{"flow_id":60,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2343,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":75869,"pkt_caplen":103,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":103,"pkt_l4_len":69,"pkt":"EBMx8Tl2KDc3AG3ICABFAABZLy0AAP8RCQ\/AqAEGwKgBAfWPADUARdrUdPIBAAABAAAAAAAABGVtZWECbmcDbXNnDHRlYW1zLW1zZ2FwaQ50cmFmZmljbWFuYWdlcgNuZXQAAAEAAQ=="}
00678{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2343,"source":"teams.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1587041691075,"flow_last_seen":0,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":61,"flow_tot_l4_payload_len":61,"flow_avg_l4_payload_len":61,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62863,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"emea.ng.msg.teams-msgapi.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00551{"flow_id":60,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2351,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":148968,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"KDc3AG3IEBMx8Tl2CABFAACQrGdAADkREZ7AqAEBwKgBBgA19Y8AfAAAdPKBgAABAAIAAAAABGVtZWECbmcDbXNnDHRlYW1zLW1zZ2FwaQ50cmFmZmljbWFuYWdlcgNuZXQAAAEAAcAMAAUAAQAAADwAGw9tc2dhcGktcHJvZC1zZnIIY2xvdWRhcHDANMBJAAEAAQAAAAoABDRybAg="}
00705{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2351,"source":"teams.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":1587041691075,"flow_last_seen":1587041691148,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":177,"flow_avg_l4_payload_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62863,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"emea.ng.msg.teams-msgapi.trafficmanager.net","num_queries":1,"num_answers":2,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.108.8"}}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2352,"source":"teams.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1587041691149,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.108.8","src_port":60565,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":61,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2352,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":149774,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG2I\/AqAEGNHJsCOyVAbumbhw9AAAAALAC\/\/8jXgAAAgQFtAEDAwUBAQgKMITP9QAAAAAEAgAA"}
00437{"flow_id":61,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2353,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":168973,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8PCRAAHEGa280cmwIwKgBBgG77JWud4Fgpm4cPqASIABnNAAAAgQFoAEDAwgEAggKUqoqrDCEz\/U="}
00424{"flow_id":61,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2354,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":169076,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG2JvAqAEGNHJsCOyVAbumbhw+rneBYYAQEAml0QAAAQEICjCE0AhSqiqs"}
00724{"flow_id":61,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2355,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":169247,"pkt_caplen":288,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":288,"pkt_l4_len":254,"pkt":"EBMx8Tl2KDc3AG3ICABFAAESAABAAEAG173AqAEGNHJsCOyVAbumbhw+rneBYYAYEAkjHAAAAQEICjCE0AhSqiqsFgMBANkBAADVAwNwlpHiXHB3s5dLKatTLHHCd3zPHP62TkNPLWHwExyS1QAAHAoKzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACQysoAAP8BAAEAAAAAJAAiAAAfZW1lYS5uZy5tc2cudGVhbXMubWljcm9zb2Z0LmNvbQAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAABIAAAAQAA4ADAJoMghodHRwLzEuMQALAAIBAAAKAAoACMrKAB0AFwAYABsAAwIAAhoaAAEA"}
00754{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2355,"source":"teams.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":4,"flow_first_seen":1587041691149,"flow_last_seen":1587041691169,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":222,"flow_tot_l4_payload_len":222,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.108.8","src_port":60565,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"emea.ng.msg.teams.microsoft.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02364{"flow_id":61,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2356,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":190981,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPCZAAHEGZdU0cmwIwKgBBgG77JWud4cBpm4dHIAQBAU1egAAAQEIClKqKsEwhNAIOSG3N+pypQO63Wiq+lXA9TALBgNVHQ8EBAMCBLAwgdYGA1UdEQSBzjCBy4IabXNnYXBpLnRlYW1zLm1pY3Jvc29mdC5jb22CHCoubXNnYXBpLnRlYW1zLm1pY3Jvc29mdC5jb22CIHBnLm1zZy5pbmZyYS50ZWFtcy5taWNyb3NvZnQuY29tgiIqLnBnLm1zZy5pbmZyYS50ZWFtcy5taWNyb3NvZnQuY29tghpuZy5tc2cudGVhbXMubWljcm9zb2Z0LmNvbYIcKi5uZy5tc2cudGVhbXMubWljcm9zb2Z0LmNvbYIPKi5tc2cuc2t5cGUuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAL6k2g2YNYubaMQKNE1HOCJsRU+ocKgoaCUntNxasdyLm3sRjtpRjulwsmHOrGDRgisqGVKYPLOcPDYZIMeHJRyVC9lP7rDFU4mwEdob9bYoVAdPJ2aPEkM0RXDf2sxO3K11UvhIdAETfgAyN9OClLnbVRlD+uqcSQfdbt9NgeCozGT3uA8rW\/bT\/D+YBI2NyvjucwOF4fAmlb69iaENpHzKyKPP3gChGWXwPlsCAHcWT5DWYPJpL\/3DLl81bF7tO5zY3zxJMB1OeVgvUKXeAS+CwfpLrKG0C\/eU6XUXAM17Wou3AdZL8ESxq7zdQlPlfLXcrxTWn\/9yqOyE2Dy4v0AC0DldAOOVuaP1Qw\/jkncKrZHy6CBjd4i6SlAvV9SXMMji3v+3tCPq3NDcYwEwIaLF7pK3asugmSWv+kUpt0b\/7nszZggDVjiXOaXQXGxlI76wm\/oQiScQLHdORY8mAIDxrFvAZJI7K5Yvpy\/uFT0TJ1pbtUzx0WkkWUFI1ibsaySDvxZ5PLRRf\/b+CTj2DeuAhuHN0bB0Jvlf\/geQ+McX36gP8ZJv4hZskP2p2eU4LlDvKZxVbJkUfzIhrbjoxfdlKOwkktqzdS57vVoeibk02\/OS8fdv79ZBLOsYxfdKaSWNDVEN1Q82426XhaggJ7kscl3nnmFp\/\/6iCwQwe+4wAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC"}
02365{"flow_id":61,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2357,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191015,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPCVAAHEGZdY0cmwIwKgBBgG77JWud4Fhpm4dHIAQBAVUQgAAAQEIClKqKsEwhNAIFgMDGB4CAABeAwNemFWbphWJj3FHoaitshBkuLDswlXgPqBiBzBEu1JtHyDXQAAAZRrutGMTFhK\/e+kmqI+\/Zkfq5RwCFGfplOpyVcAwAAAWAAUAAAAQAAUAAwJoMgAXAAD\/AQABAAsADzgADzUACXcwgglzMIIHW6ADAgECAhMtAAXjKxcECLqmmESDAAAABeMrMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA0MTYxMTE2MzBaFw0yMTA0MTYxMTE2MzBaMCUxIzAhBgNVBAMTGm1zZ2FwaS50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6bCd8p5bTLvzxk8peM7yBrK70g2\/ne6IdANafglT8XcZya+kzQ+Mrq7kzfFADke3O8Tx7TUot+0PBV0bRjhOIjoJDjeYjEK5EYLvzP\/ySf7pw9kLmBrKdGIghjawzgMfBQ+yDuY\/xusYl8Z47kqd+jPCmEco1090vX6eIgZ8wGG2\/T7lHMlix9MM4ujKDmlWL49Z23s\/pkG8X5qSmPCSe8hYe88aLueRsTy6p3v3Xu7dyeSEXAzx\/bDVVaxz3kOPZBiVLWJJOMXLcEmbiMaXAMI6U8P9IrZe+hOcEVIK9XFTfMj\/46Q93XlPcSEmIEfpYZtfvDv7sl6\/A5f5fQGzFwIDAQABo4IFMzCCBS8wggH3BgorBgEEAdZ5AgQCBIIB5wSCAeMB4QB3ALvZ37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABaiXmCwwAAAQDAEgwRgIhAOGrg6reSNR0KyBcO7Q7gCii\/1TfL9g1oiqVd0YwoVapAiEAo0slJl38aVeAP4NsC2+9NTgOONNX+OjfBhbPKxRd44EAdgBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWol5gw+AAAEAwBHMEUCIQDkM0pbU+Au4qjEvxjAp\/EAbF2TL4NdBrZsJZN5DU0NVwIgQTjJD4VNExwZMMAMGeIVulDmRVcC9IBVnX9gEFloCAQAdgBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWol5gsiAAAEAwBHMEUCIQDDgYufFTxeWXSxmFvArocCbZmbbMDfyXZOhvBhqyPhVQIgYFyw6bpP5pJ3KJPpJJoXXep5ToH0HnBguiw6qxLe5xoAdgCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAWol5gsIAAAEAwBHMEUCIBS3pBnZlixZCjQBEekFzZeTixM7WI6B2W3gzs33Y16dAiEA9fSLRhO193sisnPmL+HqxGK+KzX8HMBeMyZ3aF2OKikwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQMd5+v"}
00441{"flow_id":61,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2358,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191074,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG2I\/AqAEGNHJsCOyVAbumbh0crneBYbAQEAn+NAAAAQEICjCE0B1SqiqsAQEFCq53hwGud4yh"}
00424{"flow_id":61,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2359,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191092,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG2JvAqAEGNHJsCOyVAbumbh0crneMoYAQD6+Z4wAAAQEICjCE0B1SqirB"}
02373{"flow_id":61,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2360,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191199,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPCdAAHEGZdQ0cmwIwKgBBgG77JWud4yhpm4dHIAQBAVq7QAAAQEIClKqKsEwhNAIggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBT9VOfspjpsX70VZxDzhO\/uVmwbaRgPMjAyMDA0MTQxMzAxMTVaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhMtAAXjKxcECLqmmESDAAAABeMrgAAYDzIwMjAwNDE0MTMwMTE1WqARGA8yMDIwMDQxODEzMDExNVqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNTEzMDExNVowDQYJKoZIhvcNAQELBQADggEBAK975DEh8WzPdb3FpRReOf5Sy63kYKCuHzsY6rlp\/wgMkCD\/yFhmFRcHLMUO9LPi\/jYfv7Cg"}
00425{"flow_id":61,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2361,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191295,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG2JvAqAEGNHJsCOyVAbumbh0crneSQYAQEACT8gAAAQEICjCE0B1SqirB"}
02366{"flow_id":61,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2362,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191445,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUPChAAHEGZdM0cmwIwKgBBgG77JWud5JBpm4dHIAQBAXk8wAAAQEIClKqKsEwhNAIvhtlQNa8nBY29uJ6awAw5nKVXODG\/oJcUZ9dQ5EjHt1yiRENCi5Y7u21Hb6zTvQxLZoyrSHonebDsj4RZa0Jz4Q5h5gJw3Q4pxTV7w7B9vrrMtBBVu96ReOtAkkInPSrc\/QNXz1Ht60p\/oC4G+SyuJPiei\/yX+Ar9sUqaJEfTXatWvhCaL0LTByCDDeeS0xam0vWl7K6mjAr3BqX8pz5xV2Pe8pNKnLbdoMEdGQyPCzlWRp6DEp9bd+A2eiKEItkI6q2O1mhfHULTzegggUjMIIFHzCCBRswggMDoAMCAQICE24AE\/D2Kp4kxgB1wsEAAAAT8PYwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MB4XDTIwMDMxNTE1MjQzOFoXDTIxMDMxNTE1MjQzOFowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV81X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLL8jj3UBzU\/au5HTPbtPMCk5oVv210n++4hY3ar0HqI9QquzZ4bSqFbTrvtEbBDUYjsuWRRyh7PmGb4\/i5111AQMiqmHCXMlUEoISsFDVWgU7ngCnMhwhp48l8JBmtkGzagdLpyHYHcSiPAlGCLd3jLiBKzM\/ueqOFFcN5TX5VPlL2bsNstKGUgz+WDhIfD0rhDLaagjE5kTA5Hlzx57WHJdADehPDFVjuBfeAlZZfr5n6B895zjgrfQ5aiOSHga1h087GXde6\/l1KqhKH6h6hhEXE5ueZlHVt8E78+aTJ8R72aoP7RFMtNiGy6NcvSO5txy6nvamfpgaF+6trEkXAgMBAAGjgdYwgdMwHQYDVR0OBBYEFP1U5+ymOmxfvRVnEPOE7+5WbBtpMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFAj+JZ906ocEwry7jqg4XzPG0WxlMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBuHFOoYYKg3cb0bUdjBxt0hVtcSnqF5W8ns\/9POrOjPDOf06GOC96qd9hr7hzAMCTioOAKpJ6fxlxkaOZvZAdvbi7AB\/SSaqRPF+sSsVoEuHOeBJYXeKJ2gjkaigkkIN5VcPFG2IjgkgIkk\/ho4Js9P+Uz3qAYfTPWFBpG+Iqrz0ohHyF5lnGmmGqBfpPCaUGisapj1uGyPYySvMpw6VrkfurOb2qw4NKYKHL+lu2XK0iQumrgg5H3wXsc3A2dOpPUQk4f6u4Cl+3z74P+XmrgzFCXvFQsZd46CNTqGRoEomrdF1xluttGd23tPXgK2Ij+kxVrxEG3nuAMNfvpbW6DLNtmaIB2\/MnW5seyQgrzAqc4X4+ejAnzHVfaGwQw8s2APMSDDKPlXsPqR4WzmEcRLj8qZWAjgb7afrWYUdpLL6GNC8talUqDHqz0IUfEREp2wMTNU05Iw3OOmn+EPWxxb3yKSz98D0BK3d0BfGuuINxw7D8yrEe5C7HzxcJW93BSLniXitCzJ7xP7vgE\/u7evLIsG4aYySMy3gMmFMW0e1fLKFisP7WNWhMY40d9"}
00995{"flow_id":61,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2363,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191459,"pkt_caplen":485,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":485,"pkt_l4_len":451,"pkt":"KDc3AG3IEBMx8Tl2CABFAAHXPClAAHEGac80cmwIwKgBBgG77JWud5fhpm4dHIAYBAWziQAAAQEIClKqKsEwhNAIuen4aX8Wo8+uJ5lC2sVG\/Fl3f5qa\/nbuVlQ5c4F9X4YT3X7ghItjAt95eutjN0qOIZLK0vLQBwDDhvcC5C2Ogjgr8KGdKMh8+Xh7DKUI1mYyvgwAAUkDABdBBHWZvN1r+99W06TDuMX70ZqrciJsn7\/PyvG6CrmMf2x1EhOnKWS7R1qwf4dHbb6oif6w1aUdUWx0dNjBtMK9NhoEAQEAUDFhQbDJHVZEigyhQ6OY19eNe49WlTIFacDO6cArNYKFdX3aO7OwgkSg95xYecupFoYU5dn4fpnsra81SKTeXEFwB6FiRblCKkJKIzKFTx20SCKEj3\/d\/irlF7vjsT95FikTrqK6js7LU+sTgvNZhVxsxgB9Si0skq7N2ozhkx6AbncZzuTHgAXuGpi8X6GwYXvWJPRxm7RE4w7ijwEZ839O+mbTB3U5eBTa3t\/6xJnaVXKzZi3tmswPcsznMvcHZEmYEe6wJ8slSmzcofIsynOLsfUf93FAudtVdh15AjE4LuPFvGGWA74M\/a395uxgomkxdqHbi2lOcjnRmdbLdQ4AAAA="}
00425{"flow_id":61,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2364,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":191488,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG2JvAqAEGNHJsCOyVAbumbh0crneZhIAQD8WM6gAAAQEICjCE0B1SqirB"}
00597{"flow_id":61,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2365,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":192558,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG2B3AqAEGNHJsCOyVAbumbh0crneZhIAYEAD7QgAAAQEICjCE0B5SqirBFgMDAEYQAABCQQQK2dJCEMdhX7md\/Lh5ouYbeR0QO78n8njlcA5HQdgEcR4bEQk4KMHqHrxid1o7584ZuY8J6mKXsb02dkJUD4LJFAMDAAEBFgMDACgAAAAAAAAAAA0dAU2U0JIs+ClJsG6565DMr4wwIiXSF2v9oa+FYEKF"}
00555{"flow_id":61,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2366,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":204853,"pkt_caplen":159,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":159,"pkt_l4_len":125,"pkt":"EBMx8Tl2KDc3AG3ICABFAACRAABAAEAG2D7AqAEGNHJsCOyVAbumbh2arneZhIAYEAA6yQAAAQEICjCE0ClSqirBFwMDAFgAAAAAAAAAAbwT8vUFA\/Fojr5f+cigicqpuAuzJpiwa1yz1q\/0GLhLgeNCd3U+W4HLxbcHwGMjOynBOWtzGHt\/xqnqJXowVUdqfRJcmwhgKsejNsTw2mwr"}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2416,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":410839,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2416,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2419,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041691,"pkt_ts_usec":611256,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2419,"source":"teams.pcap","alias":"nDPId-test","type":38}
00780{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2437,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":419649,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzETFAAEARZ+DAqAAB\/\/\/\/\/wBEAEMBHwAAAQEGAPmTDokAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2438,"source":"teams.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1587041686659,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.112","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2438,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1587041692528,"flow_last_seen":0,"flow_min_l4_payload_len":120,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":120,"flow_avg_l4_payload_len":120,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00592{"flow_id":62,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2438,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":528594,"pkt_caplen":186,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":186,"pkt_l4_len":152,"pkt":"KDc3AG3IEBMx8Tl2CABFAACscMtAADIGTDyXCzKLwKgBBgiu1d6yibcLw8sjj4AYAfWSMAAAAQEICnMgXuAwhCbwdBDZH1X2LNSHenV0XPT5UOuNQPq3DAtDODIIsZ4L3xE8W9ceOtMh\/taRn1i3oYCG\/lk5DiXu3JH7RFT8gb0ANFHp9LfVVHPD+A0sB0\/WJaUdO\/QQPvH9sYa9nCylNS5SUfWnuhHHtKPL+2Ql1DSrQI\/KjFfe6Sr3"}
00425{"flow_id":62,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2439,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":528684,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFSAA0AABAAEAGrzfAqAEGlwsyi9XeCK7DyyOPsom3g4AQD\/zTvAAAAQEICjCE1UVzIF7g"}
00526{"flow_id":62,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2440,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":528752,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"EBMx8Tl2KDc3AG3ICABFSAB8AABAAEAGru\/AqAEGlwsyi9XeCK7DyyOPsom3g4AYEADukgAAAQEICjCE1UVzIF7g5AplDBJ5jEkO1U2Mpra9\/PbG6UC\/FVXGQ5pEnr4zSbP3LnLXhdyZOGgH9qsJLTZHLgDXKr5t+q9K3Mvbm5JFapBhK16BH5zD"}
00424{"flow_id":62,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2441,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":578366,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0cMxAADIGTLOXCzKLwKgBBgiu1d6yibeDw8sj14AQAfXhSgAAAQEICnMgXxEwhNVF"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2442,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":611278,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2442,"source":"teams.pcap","alias":"nDPId-test","type":38}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2443,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1587041692808,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":63,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2443,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":808980,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+gHAqAEGp2PXpOyWEVIVrX6QAAAAALAC\/\/9dQAAAAgQFtAEDAwUBAQgKMITWWwAAAAAEAgAA"}
00437{"flow_id":63,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2444,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":880898,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8AABAADQGBganY9ekwKgBBhFS7JY0lYWJFa1+kaAS\/ohhIwAAAgQFrAQCCAoTeUD2MITWWwEDAwc="}
00425{"flow_id":63,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2445,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":880999,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyWEVIVrX6RNJWFioAQECx9\/QAAAQEICjCE1qITeUD2"}
01123{"flow_id":63,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2446,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":881339,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"EBMx8Tl2KDc3AG3ICABFAAI5AABAAEAG+AjAqAEGp2PXpOyWEVIVrX6RNJWFioAYECynDgAAAQEICjCE1qITeUD2FgMBAgABAAH8AwNIwmNvYpaxx4YaNkM5UOMBu+\/rhWm5ROKLkUQ+n9+bqCDe8bvsDQaKZ\/SHTClTSUEpcKfm8tnRcB\/XxmDM4wjf0gByEwITAxMBwCzAMACfzKnMqMyqwCvALwCewCTAKABrwCPAJwBnwArAFAA5wAnAEwAzAK0Aq8yuzK3MrACdAKnMqwCsAKoAnACoAD0APMA4wDYAtwCzAJUAkQA1AK8AjcA3wDUAtgCyAJQAkAAvAK4AjAD\/AQABQQAAABIAEAAADWRhdGkubnRvcC5vcmcACwAEAwABAgAKAAwACgAdABcAHgAZABgAIwAAM3QAAAAQAA4ADAJoMghodHRwLzEuMQAWAAAAFwAAAA0AMAAuBAMFAwYDCAcICAgJCAoICwgECAUIBgQBBQEGAQMDAgMDAQIBAwICAgQCBQIGAgArAAkIAwQDAwMCAwEALQACAQEAMwAmACQAHQAgqeitnlzPDiYBqjP3nyoLl6FANLUWPuCFiHYla5PeYScAFQB8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00847{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2446,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":4,"flow_first_seen":1587041692808,"flow_last_seen":1587041692881,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"TLS.ntop","breed":"Safe","category":"Network"},"tls": {"version":"TLSv1.2","client_requested_server_name":"dati.ntop.org","ja3":"7120d65624bcd2e02ed4b01388d84cdb","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
00424{"flow_id":63,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2447,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":951911,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0HBJAADQG6funY9ekwKgBBhFS7JY0lYWKFa2AloAQAfqJ4wAAAQEIChN5QT0whNai"}
00636{"flow_id":63,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2448,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":953141,"pkt_caplen":218,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":218,"pkt_l4_len":184,"pkt":"KDc3AG3IEBMx8Tl2CABFAADMHBNAADQG6WKnY9ekwKgBBhFS7JY0lYWKFa2AloAYAfrg1wAAAQEIChN5QT8whNaiFgMDAGACAABcAwOUbx5\/B3ZgLf5vCjBFIQRrfoTRnqXQyERycJrp90X9EiDe8bvsDQaKZ\/SHTClTSUEpcKfm8tnRcB\/XxmDM4wjf0sAwAAAU\/wEAAQAAEAALAAkIaHR0cC8xLjEUAwMAAQEWAwMAKHrIfL7WEd9FBF7y+nv07iI\/qncPABmynlkhHQHjbn7q57JKbc2IA90="}
00901{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2448,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":6,"flow_first_seen":1587041692808,"flow_last_seen":1587041692953,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":669,"flow_avg_l4_payload_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"TLS.ntop","breed":"Safe","category":"Network"},"tls": {"version":"TLSv1.2","client_requested_server_name":"dati.ntop.org","ja3":"7120d65624bcd2e02ed4b01388d84cdb","ja3s":"410b9bedaf65dd26c6fe547154d60db4","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","alpn":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}
00425{"flow_id":63,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2449,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":953200,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyWEVIVrYCWNJWGIoAQECd61AAAAQEICjCE1uoTeUE\/"}
00497{"flow_id":63,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2450,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041692,"pkt_ts_usec":953966,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"EBMx8Tl2KDc3AG3ICABFAABnAABAAEAG+drAqAEGp2PXpOyWEVIVrYCWNJWGIoAYECdxjAAAAQEICjCE1uoTeUE\/FAMDAAEBFgMDACgePBs\/C2EWA291JuO3YkDgacglhK1S7Nmn4LfYvs\/WgbNRA6YYJi6T"}
00423{"flow_id":63,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2451,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":63122,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0HBRAADQG6fmnY9ekwKgBBhFS7JY0lYYiFa2AyYAQAfqIYAAAAQEIChN5Qa0whNbq"}
01704{"flow_id":63,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2452,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":63205,"pkt_caplen":1012,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1012,"pkt_l4_len":978,"pkt":"EBMx8Tl2KDc3AG3ICABFAAPmAABAAEAG9lvAqAEGp2PXpOyWEVIVrYDJNJWGIoAYECdb9QAAAQEICjCE11cTeUGtFwMDAycePBs\/C2EWBHZqdpg3lOYecM4psKzphPsK1eYXmL23nMT7IhIfTvLySYYqW9+HMXxLHnkgAudHUd8JoW4t6qRncvY3IoJEUSCBKRIlO9DsgyFRBxHaolDfmMxxHZafY1VlhGHtpM4oKCVnJxqowY6Bb6uD3L9NE02EfYrQudKy85z4BalSO8BMQZIyNrHgHuBlfvVzXuenXm28fI6X4fB6pa20\/MGlcfLGKdh5bVTosKRARTRlzixhU97rIV4C6B7OswAxZEfG8FUEJsb2MLssPGnb6aKhpj\/7drZkh8rmkaQ8HBGP5IfTl89TXyo9\/rDUktlplWN5GD0LAzRtSuJyfwh52DwDQSmbnCGQPcquU5C7hdraynu36lP4lsq0HqBbiZzs03ftehFwS9wUpZqZbBnDdGTtydYUUJCZDfssD2JQGxX5fjmzmInk+j2i7ZNQNwJpUyzeC91WEhBRQlN5rfYRPxJyMJlQ0QHMww9xHzJtBiLhfwMBH49ZgQSVNU9P8SddSLLKW8cwmV8GvlOcOuKT6TYnj6Qc7tOVntXC4OrpGVfJRDq7WyLqD6RhAqLQpU2NMmbb\/pbapPvCVoldR+Myn68xb5K+2b8+ViPS9gSom8Dk7UJF1xIJNa3eXeFXeEyiMhmjU0Q0sXcZfW1uMornSa\/zGS+9urNhBZCUcFuETHxsHe2m2lOPKRttCdXE7q6loIAHbyC3R9f1FiKgwyy\/yZjksXbIsULDLK8zBorzYVrWCTSy6UZdJy40R7mYy7X0MaSvuODOZoiEFqCM4HYTApkQyQ\/66\/RN+itsK8kEdYgZrxLcjf4khmLbudYo2Ol5fqCe0cHPzNt2XODoQS3ukshglxBajROwY\/e7qYGB3hIsEACXCfXq7BBoh8AYCK2ZnHTmeytlc+ilDUpxTGJv16O\/2fVLYSSh3RDLydWxDftCQxidSc9I92TZKAazg+lhm8FebH19hGV1DB2HIiqlnldkJ2qcFlx6oatgZMoG5sSRGmRDRMUWFAvTkx1txJdO9m1gNvbZ0Pg+Cf9H1oVfXmhkgbrDYXxjjeAMVtVr2gm16JgXAwMAgR48Gz8LYRYF1UfzZXVluvxHFvv5uG6g3m1eFKcNzrn1zuRHVHhSxB86DYF75+9edBzMi8xWPUieXm3hTr7Cw+8RWbhrF8KAn5dtdRi6i3hDr7YnVbKFUCuw2ERCF5oKjIQqGGhOZqpLSQQGHsJpXds4y+k6uPi+oQ3M1d+sTQv1kQ=="}
00425{"flow_id":63,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2453,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":131635,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0HBVAADQG6finY9ekwKgBBhFS7JY0lYYiFa2Ee4AQAfWEAgAAAQEIChN5QfEwhNdX"}
02096{"flow_id":63,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2454,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":332385,"pkt_caplen":1291,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1291,"pkt_l4_len":1257,"pkt":"KDc3AG3IEBMx8Tl2CABFAAT9HBZAADQG5S6nY9ekwKgBBhFS7JY0lYYiFa2Ee4AYAfWqGgAAAQEIChN5QrkwhNdXFwMDBMR6yHy+1hHfRnWe2Z+VHlW8uSWmUYf7cLMllEV+oOio8AYtz3DgEouKRmVYpqFNxngiWnYarqSXdlKa5dDAU0z8UNEvoG1B9rgGWXz\/wg\/2PmzXB1I42qW4\/W216XtZl76qTUwZEpag\/aAyn5IrEYp7HyLn1jw3\/rr0V1RYXIcjCDxPtRGypS6A43n+Zd1HQGKu81g39UAB37IGQp\/FMk3gDhpGi9wPdiRW1mTqrcyVgZeir8b7gRWbXoO4lzOyC3uDiHNBOUHmc4I\/0uNv6LoauOx8vF1Wj8EpdeWG1ryHo0qt3yFtcRGXNl\/SMh5pnnoJN028a6CbZeKqUgMWptmEguOIXRfevIDHDU6mC5KCmD6lBVdGbUf6iYZpYhLJr3Lr2JGMpxcUA+xTEFif26dDRsEnxAhFpxWUbO\/2WWUyR\/fHLoSYGhbXdUbH3l5Af5rIo9HulJFlhjDUXoi92GXs3eYcVSgzNw0IKpRtiykmCBIjDNGy1+i+\/NMc4ZH7Z\/fgfP03c+IJMSCE4o9uMrxoIGIcs9wu4EN0QUFE2RPO\/+EjXTSb4pIy66lwT376WziHUf\/fi+J3WpcalQHy+PNTrWR7xf7K8JAEwWzyI98SMqxyHnpQCEe14GWIj5f4xDJq2STAmJE9FTVPWKAWaasgD7Mf35zCK7e4YLwbkGjzG3vrzY7psubW1QhrsA53Dk9BfYgQ1eSxRZDdu1PRu\/Sh40Oh+BOfjOpvPtI55KOIiaHerWAELDPyx3Ps9AH+hb8Qifj1OulYzp0BCmLku3ArqmYAHjCjG1\/4+5Gcq5hiKIoXNj\/k+FMZTHg9GJACrXdUm9EXEjZ8hm0z4U\/5tbtt8N4zbO9q5896+LLyrB9hFTKSqKwEwL2he8AtstySNaUFZG8MxMqv1JjeXOrshdzhskYScw1A5sumUYg1qLpPmi2VU5bIjP7TYV3apZoI34FfoKHd0yZxWqQUOJDU\/AFKsQRNVEE2y1gLfsN7c\/idf1fa6rkSjaD56yNJKQL\/R4yOylA2rSj1Nr9vbU80q+MDvLuPVO\/p6VjF\/HoJJlxqhbnVmu37kLA8gjaNUWmJzRwkVt\/39kRdYu0aZM+CcuLK9MCLAcUIXeiWSj\/OdWGlsmw88+6cnSl7oSPkz+aj9JeAUmNEgFbThXnRYkRpvILy4Ynqz5BtpNQsZBiF49kzoyIeR35aD+SzhQmsTiKdZqWXdi7yDJjdoZXyeeC6580aKHE7kis1rOh4c4HUxHK+ZDI3nEw9K5GCUAD4kV3\/hhyS2zPcN4lprikZjHJtHqPBx4gVB\/jlhr6JOgADsiHXpH+IbQLFR8zETNE0MbGKks1zkrYXQ5QtO4Xa02HTV0zsWO7TTSaEpCKsGjMThV++lmq1VRSuxOGfjUDff69LTHejwINO7p20f6ZMrvAbMhKVKuUmnmL55k6NakFeANmldTo4KBD7HVpnwZiyWP3VqvPnJ2rbPnAoobHVDJ9dcliinnvqy+7c6aeytjk46xxPtELt2JnNeMJ3f9jumuuOAUGEHlnNO8D2VZT7aBFgZHKFKH2jcRPn2VG2MCDghZz9njaybtK\/1JwPsG6oceLYjNAwu0FTYqxB\/vVUHohMG2wXVcTJAg=="}
00425{"flow_id":63,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2455,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":332477,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+g3AqAEGp2PXpOyWEVIVrYR7NJWK64AQEABvXQAAAQEICjCE2GATeUK5"}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2463,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":412749,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2463,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2464,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1587041693428,"flow_last_seen":0,"flow_min_l4_payload_len":977,"flow_max_l4_payload_len":977,"flow_tot_l4_payload_len":977,"flow_avg_l4_payload_len":977,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
01722{"flow_id":64,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2464,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":428391,"pkt_caplen":1019,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1019,"pkt_l4_len":985,"pkt":"EBMx8Tl2KDc3AG3ICABFAAPt48gAAEART4\/AqAEGNHJNiMnhDZYD2eNwBl3+t6o2WT+OKw\/oTFMopoursiGTBsvvLvg3wuBfZT1pBB1vO2396s1T+U1VujmCqj4L5tMtU2F\/1TQzFXSUlw7M8VMfNQQRkYM68GVjRmInITISf9xExqdFNNQs5RQE95Yd7wUQ0WB34xO5EY6WIo8x\/N\/uDXPR3dWPSffY9Pjxt3AuIhSE\/33TPi9IZfwvBkn0Ytl+OD1doGxH0KzkYpDzBS9hB1dBsT+zr8uYQ4OitShMofb6WewMwiNNfNExsV6iWN3hyOrqzEPoHJ8xMa7bW1q9BLkbd5BDoIOv\/MoJUwfM2rHFjSZuGzr\/wQ6fSJlA+ga+XWQ5cCOxemM862mQg5uhFhBag2VuzDKpysLY0ZCqnKz91R2yhrxoXReoN9yIxCUIquc7SAW\/92cRId8y07O6L1X8x\/aDl3FC0Al6caV7h\/r8ddpLTlDH6yLNlYfOWE7QuJLs4lty891N9hHky+P7SbB6VN0+eXLlpdIKbixmAmCZ1p6\/DFecrkQrfBusU7fCQ0m5UtC7A9xyYw8qrbidfp8KJduef6Xu3BA4D0YD6FFqNyrfEvkjpJ+3rNXlm\/vqN6+pA7Pyjrxbc8hNlLHZHBWyirKyjtN28dUXzlP+LsRPGNdQvqJFK3pV96V25LmYF5yiAGBc2dVjL3CV3I8BZIc1iv9PSXq8u5cmF3NAvFW+ejj0aUJys0KqSuB+SsBchm0XJNdD1T31o3cnzHzdRkPqsYgQxN+TMH4xz2ipnYwRm5mpiVbDbtght4DZhZkINSjZm+P+w6KJ1sJkRZyTcItShxjipY0pc0YcI\/iPO8Kihnfm0h7aZYr8JbNTXfrRfggxMyqgTWxlobhHKsiboGB5nz9mqNXgN5f2w6aCT8Ygr4J\/d\/M8CNiCRT+CKMTqRpDBqIcnsL3KBgSmI2li51fHmCYLknW2Aw3F82bIDyzOvtteFfeZxum8+GIS5JvJh64JDL9hUaT9FEJ6txlWLszG+bg1use4IiVMiF2jfKWFA1eFZRDjiQXrMStv0vPT1Ma73OvVsZAHSptss39ti+ltbCNxC0S+MDiB1jQrFVUZ5nHLM44PsanYQ\/0cpyVO6zbbzjzXTUfs+tAIMkUNPFZtCs1rFpKhkI3NcGs+yvSb4SV1GxhoDHVRpRNuKqFbFinCHp\/37lAaE9HGUTnfhxGhnCIfOfHIUUAT3eHul9H3b0Z8OnLYIK1ZDLQGkd0pzOUxUVHtQtXMulhXsHz7fr\/A21yG\/8b8NgTEX+gU6e+h1l0XisCpHYMfVCMz3mHn3ia\/HdLRjG51YnI="}
00444{"flow_id":64,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2480,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":474528,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"KDc3AG3IEBMx8Tl2CABFAABBNJIAAGwR1nE0ck2IwKgBBg2WyeEALeCzAzNiZmY2YTE1LTY4NDEtNDYwNy04YzI3LTllY2ViOWVlZDkzYg=="}
00659{"flow_id":64,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2481,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":475613,"pkt_caplen":235,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":235,"pkt_l4_len":201,"pkt":"KDc3AG3IEBMx8Tl2CABFAADdNJMAAGwR1dQ0ck2IwKgBBg2WyeEAyV65B51cqyKYlOqfHC4eUj71t0+3OzD2kNc2OfFPQNt7fwvuOZltdCnrcr0l94iSgE3VeMj4bdDb+vZ+CObqTNO+QGlUnkV8bcknbNvGUx42nvxp8mhw\/srnkVApKnhDe\/uy29skE82ON2NOubAQd6VBKyo6DT6MaE1A1qjybrSe5XwDrj8OJ1EA\/FUFx\/b063Ar395Oi1sw+DBTZ16KUXaymVRCSFNXRrfz6yWlsSmdtxTLQfpVrW5dlejTUGgaSVxvSg=="}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2482,"source":"teams.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1587041693515,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00487{"flow_id":65,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2482,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":515047,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"EBMx8Tl2KDc3AG3ICABFAABg5p0AAEARo1PAqAEGNHL6e8NgDZYATAKlAAMAMCESpEKyND9uZ\/QdWKy6Y58ADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAI="}
00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2482,"source":"teams.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1587041693515,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50016,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2483,"source":"teams.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1587041693516,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":66,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2483,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":516414,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGShzAqAEGNHL6e8NiAbvwxDFFAAAAALAC\/\/9VoQAAAgQFtAEDAwUBAQgKMITZEwAAAAAEAgAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2484,"source":"teams.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1587041693517,"flow_last_seen":0,"flow_min_l4_payload_len":67,"flow_max_l4_payload_len":67,"flow_tot_l4_payload_len":67,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":55765,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_id":67,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2484,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":517336,"pkt_caplen":109,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":109,"pkt_l4_len":75,"pkt":"EBMx8Tl2KDc3AG3ICABFAABfDxsAAP8RKRvAqAEGwKgBAdnVADUASzsZd8IBAAABAAAAAAAAEmItdHItdGVhbXMtZXVuby0wNQtub3J0aGV1cm9wZQhjbG91ZGFwcAVhenVyZQNjb20AABwAAQ=="}
00681{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2484,"source":"teams.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1587041693517,"flow_last_seen":0,"flow_min_l4_payload_len":67,"flow_max_l4_payload_len":67,"flow_tot_l4_payload_len":67,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":55765,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"b-tr-teams-euno-05.northeurope.cloudapp.azure.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00587{"flow_id":67,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2485,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":530810,"pkt_caplen":185,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":185,"pkt_l4_len":151,"pkt":"KDc3AG3IEBMx8Tl2CABFAACrU5xAADkRak7AqAEBwKgBBgA12dUAlwAAd8KBgAABAAAAAQAAEmItdHItdGVhbXMtZXVuby0wNQtub3J0aGV1cm9wZQhjbG91ZGFwcAVhenVyZQNjb20AABwAAcAfAAYAAQAAAAUAQARwcmQxDmF6dXJlZG5zLWNsb3VkA25ldAAGbXNuaHN0CW1pY3Jvc29mdMA6AAAnEQAAA4QAAAEsAAk6gAAAADw="}
00704{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2485,"source":"teams.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":1587041693517,"flow_last_seen":1587041693530,"flow_min_l4_payload_len":67,"flow_max_l4_payload_len":143,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":55765,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Microsoft","breed":"Safe","category":"Cloud"},"dns": {"query":"b-tr-teams-euno-05.northeurope.cloudapp.azure.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00426{"flow_id":66,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2486,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":561382,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0nZBAAGwGgJc0cvp7wKgBBgG7w2KOQNor8MQxRoAS\/\/8u4wAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":66,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2487,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":561493,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGSjTAqAEGNHL6e8NiAbvwxDFGjkDaLFAQIABPogAA"}
00667{"flow_id":66,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2488,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":561676,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"EBMx8Tl2KDc3AG3ICABFAADjAABAAEAGSXnAqAEGNHL6e8NiAbvwxDFGjkDaLFAYIADs+gAAFgMBALYBAACyAwNemFWdM\/wbLFSI3dPgZpkO7ysDE3\/GJlDQM9ZmaeyX\/AAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAXQAAACAAHgAAG2V1YXoudHIudGVhbXMubWljcm9zb2Z0LmNvbQAKAAgABgAXABgAGQALAAIBAAANABIAEAQBAgEFAQYBBAMCAwUDBgMABQAFAQAAAAAAEgAAABcAAA=="}
00786{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2488,"source":"teams.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":4,"flow_first_seen":1587041693516,"flow_last_seen":1587041693561,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50018,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"euaz.tr.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00650{"flow_id":65,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2489,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":572678,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"KDc3AG3IEBMx8Tl2CABFAADXfJQAAGwR4OU0cvp7wKgBBg2Ww2AAw6emARMApyESpEKyND9uZ\/QdWKy6Y58ADwAEcsZLxoAIAAQAAAAGAAkAPQAABAFUaGUgcmVxdWVzdCBkaWQgbm90IGNvbnRhaW4gYSBNZXNzYWdlLUludGVncml0eSBhdHRyaWJ1dGUADgAIAAENljRy+o0AFAAUAk7L+IJ6YNZTBt6\/p32H0UQC3V0AFQAKInJ0Y21lZGlhIgABAAgAAQ2YNHL6jYCVAAh\/IMTdT4SN+oAgAAgAAcHVcadqCg=="}
00659{"flow_id":64,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2490,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":576546,"pkt_caplen":235,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":235,"pkt_l4_len":201,"pkt":"KDc3AG3IEBMx8Tl2CABFAADdNJQAAGwR1dM0ck2IwKgBBg2WyeEAyV65B51cqyKYlOqfHC4eUj71t0+3OzD2kNc2OfFPQNt7fwvuOZltdCnrcr0l94iSgE3VeMj4bdDb+vZ+CObqTNO+QGlUnkV8bcknbNvGUx42nvxp8mhw\/srnkVApKnhDe\/uy29skE82ON2NOubAQd6VBKyo6DT6MaE1A1qjybrSe5XwDrj8OJ1EA\/FUFx\/b063Ar395Oi1sw+DBTZ16KUXaymVRCSFNXRrfz6yWlsSmdtxTLQfpVrW5dlejTUGgaSVxvSg=="}
00444{"flow_id":64,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2491,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":576566,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"KDc3AG3IEBMx8Tl2CABFAABBNJUAAGwR1m40ck2IwKgBBg2WyeEALeCzAzNiZmY2YTE1LTY4NDEtNDYwNy04YzI3LTllY2ViOWVlZDkzYg=="}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2492,"source":"teams.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1587041693582,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_id":68,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2492,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":582165,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"EBMx8Tl2KDc3AG3ICABFAABgF74AAEARcjPAqAEGNHL6e8N0DZYATEppAAMAMCESpEI9x0RmdejywONbcT4ADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAI="}
00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2492,"source":"teams.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1587041693582,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50036,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2493,"source":"teams.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1587041693582,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":69,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2493,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":582610,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGShzAqAEGNHL6e8NlAbtcWVYoAAAAALAC\/\/\/E5AAAAgQFtAEDAwUBAQgKMITZVQAAAAAEAgAA"}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2494,"source":"teams.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1587041693597,"flow_last_seen":0,"flow_min_l4_payload_len":214,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":214,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00687{"flow_id":70,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2494,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":597783,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"EBMx8Tl2KDc3AG3ICABFAADyLLYAAEARXJfAqAEGNHL6jcNgDZYA3iTJAAMAwiESpEIiL+\/H85JL0bmXJ+QADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAKAlQAIfyDE3U+EjfoAFAAUAk7L+IJ6YNZTBt6\/p32H0UQC3V0AFQAKInJ0Y21lZGlhIgAGADgCAAAkkKDb2wHWGU3iFTe\/yZKgAzJzGvG+3Faa6DvVqwAAAAC\/cbJ2yXgTqN3v61y8eTonekzmPAAIACB+ROZSH0cQpVQPYpCmfWn5X6jy8HHHqFihd3XDn9tzDQ=="}
00520{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2494,"source":"teams.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1587041693597,"flow_last_seen":0,"flow_min_l4_payload_len":214,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":214,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50016,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
02367{"flow_id":66,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2495,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":608822,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZVAAGwGevI0cvp7wKgBBgG7w2KOQOnM8MQyAVAQCARhxAAANjIwWjCBmzCBmDBMMAkGBSsOAwIaBQAEFCmF\/GE9vi+wEg9eQg5MnsPVnv18BBQI\/iWfdOqHBMK8u46oOF8zxtFsZQITLQAGXpgoyD\/NFydgrgAAAAZemIAAGA8yMDIwMDQxNTE5MDYyMFqgERgPMjAyMDA0MTkxOTA2MjBaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTA2MjBaMA0GCSqGSIb3DQEBCwUAA4IBAQAaQYaDpwd6DNwyOUeit6mUOBXgoV06pe6ThWCURamS0COPur719YO54pzaWQ\/wQiNdRfJ+6IxdL624Y9ECjW7h0i3GVY5McK\/JE0+t8QKiDyIrzja2mdM3dr87glc0ghsX25i5Wq+uovmAq2y0kIR5ZDxPkSCewMHChNQBpgB6w7ldXqSVgO6mMxOPGIUJeCKP7XKb6HxICQ+KDOclyTMlRvOfgXDsfJ+qgS\/\/Xx69gdsXVVKuxxVgmTXKPjwc6+0PAhk7AM38T+1uvkyY+cnLoNXnWfuXwei6nw4U+wy7NBkdjTNfderi681shWsjrz7QTveMgXHXa8hDzke10XqeoIIFIzCCBR8wggUbMIIDA6ADAgECAhNuABXTTwZmllgRJK\/RAAAAFdNPMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDA0MDIxNjU4MDlaFw0yMTA0MDIxNjU4MDlaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfNV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt72xRWYGvzznDDT8NXYL9rp9+Ya3b0Z6P2wS3akQ58NdGCNNqh5bkYWl59MsBDUHv9Ef+w2CazdUk3Nynho4E8vpdECh67pX0G62DZBOiFmluBNKbuC5wy0qFpuDZifuCaL\/JIioH+qZxw1n9T+IlPYbhUIt9LEWbIcz3NKvVAjL22uCbIe4fgQeiRQY6CQMOOiKJvbVG0ji+rtc86+Mxhhl4WT\/oA0rEF\/rkByMk2VOShPm7OYdkPB4JadSsYxElQdJQqZtZ7Dx1QoI7ppuYvpwizs9bk5\/qpPbZOX2ffENmbYPX8IEIoHImvw+d5OCujhcH8ND8y2D3AEt3YOySwIDAQABo4HWMIHTMB0GA1UdDgQWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZeWmp3UPfRLZIyUkIOP3qzADvvJHesY63Dc2ynSZnVwywgjceFf+k+yQAXU4qttDwcVbl8RAxZ3TRxOK\/tx9uYmaavtEm3swh9h5B7DCvmIXfqsJJlRpK\/OFGfcf49BNBZXJky59f8YfJ49hsiJiWchclECz2p04IejlY2rjzCMngCMT2bpAzYBsJXomAbKsVRl07LYT4CLhdIIHrd+syTeudyjkMfJb34y+qxxeDCvdd+fLKHcrxUao3ZXsd7wz3mk1EWQVaTo+Md3\/ECUv"}
00424{"flow_id":66,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2496,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":608925,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NiAbvwxDIBjkDaLIAQIAAjCQAAAQEFCo5A6cyOQO94"}
02359{"flow_id":66,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2497,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":608986,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZFAAGwGevY0cvp7wKgBBgG7w2KOQNos8MQyAVAQCASF5gAAFgMDF+kCAABVAwNemFWdsj2BaVsDh5E5y8r1X3UjjxOVlMfMQIu1roLiOiDgQAAALn9hMRlUjUOvDW8rXXboUZyNr1rD5AfhgK2308AwAAANAAUAAAAXAAD\/AQABAAsADuwADukACSswggknMIIHD6ADAgECAhMtAAZemCjIP80XJ2CuAAAABl6YMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA1MjQxNDEwMjZaFw0yMTA1MjQxNDEwMjZaMCExHzAdBgNVBAMTFnRyLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLTNHPfgLoOgUfyR4c2CDg+CoBg7bwaQp6OOdTLjN80e6165bdZW8ryNWADQBv\/\/6Ld1H5eQQNetSDwVifHVU+CteBiHg6T9F1rA96B1Fk1nARcGhMPsZbgvGxJ+NR6ygkRK7GWC6KFZyOiZ0MvWyxQTJBlsBwklHTiX9D0fiSz06Q+tVkIHpWWHGkJRO+Tm3UUtCMr7e1K4eQloaVRg1AeMGEhZEaGXyKum9VwAP15maK0zwKMiUymx8uWFHW4J0+7wZd9kZyUeJvDO2QDZvxPl5w9NBzvGZUQFIkRD+XvUanlt9AtvhnDy5BiPzueeQgaJbyvyJl4Af8nIo8gppfAgMBAAGjggTrMIIE5zCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFq6jb0ngAABAMARzBFAiEA+SbPYnNZBq5NAa+KJuZcLJF6Cs7c51vg2wno92Y73cQCIFui0LePG9Yu0H+TqmpdeWJeVlJ0KiyWWMKI6D92L\/K3AHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFq6jb1LQAABAMARjBEAiAZDnc3oPi8LaNBy6Df89WOlPch018jWvYNKaDO2U51nQIgYZuZffTHCtDDZ3lWVJgiVsjUCTGqki0p6MIBuSQoIfUAdwBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWrqNvNaAAAEAwBIMEYCIQChq4nHPM4twtbxyAgrDLE3a797eV+6L2EiO6pBrFmrUAIhANBHWXnY9HAcs6WqVRp9r8q8wlaSY9pBfB7vJlbCShQPAHUARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFq6jb0QQAABAMARjBEAiAzKKpy8ELEm5AO\/Cl8weRDML0CJ7IOPZ2GbRbx\/8vxWgIgDCW1c1pNKCE9DA2mbQwKGa4Z2H7dNtIRrzU4ZJcZOr8wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSC313bBDWiwUMAeq0EgFmCSqbJVzALBgNVHQ8EBAMC"}
01145{"flow_id":66,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2498,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":608999,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnZJAAGwGfn00cvp7wKgBBgG7w2KOQN\/Y8MQyAVAYCAT2ggAABLAwgZAGA1UdEQSBiDCBhYIWdHIudGVhbXMubWljcm9zb2Z0LmNvbYIYKi50ci50ZWFtcy5taWNyb3NvZnQuY29tghh0dXJuLnRlYW1zLm1pY3Jvc29mdC5jb22CGioudHVybi50ZWFtcy5taWNyb3NvZnQuY29tghsqLnJlbGF5LnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABCcisiO+DAS4OPnUkT5drdGW+ySCAd1BsW3Lp1Fdet9nBRcfBcsaKZ66uJsRxluxJrhagjZ4fh8tXKFj90="}
00424{"flow_id":66,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2499,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609049,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NiAbvwxDIBjkDf2IAQH9IdiwAAAQEFCo5A6cyOQO94"}
00426{"flow_id":66,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2500,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609051,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NiAbvwxDIBjkDh\/IAQH8EbeAAAAQEFCo5A6cyOQO94"}
02371{"flow_id":66,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2501,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609106,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZNAAGwGevQ0cvp7wKgBBgG7w2KOQOH88MQyAVAQCATkPAAAW6sdwoMA3bRkqxv5VpjyajDfFXWqL4G9QZfl841dfR9SjQLMnRDtMHjHLLEHhJCKLU2ikazGCdNZMqtfaxeWquCIWw56s0bCKwmin9Y3DIsAdEejps5dwVGPEJfdlpEbIxcuBzCIRY0C23wA8SsmAke7nyJfwnrDoCjE4H7m3XXod08er9hfv0q4nITSnedP3o61Oc42o6ZTtprTcb83jeNHnfqPTx\/r7JoPcNdqLrU2S9F5B\/3\/72kY0IJW8GVz3JfVywG\/oGQZf4DtR+N9iCPyVunnsxwatk5VQeVSeoKWofbhmm5\/59\/eJyGGKNh6xcOod+zQ\/yRc87f6tHNG2YoyFngY2b4iSL5cKDGkUG4HW8AD3tnSSMB+eS+kUxAHQWzl9sk8GGj5SN\/h6yZsZx0M8Cajppy8O10hsA4MnuDtB3uK64JLD12Do4vw3+8vrlcfGCUgqrNGgRVPtSVulxGnCvWOq0JhUVItmI195Is0h3MiJgXc2KNuZpMfbIcuyiiUJx2zdkFT81nL1PidcMdiaFVUoMih7rr4UtgVbmkgKemK\/Z7z3no4iLWFOB0NszihbN+mXEPfve7ERdipQf9N4gAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUF"}
01152{"flow_id":66,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2502,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609123,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnZRAAGwGfns0cvp7wKgBBgG7w2KOQOeo8MQyAVAYCAT6XAAABwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUxOTA="}
00425{"flow_id":66,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2503,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609155,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NiAbvwxDIBjkDnqIAQH5QV+QAAAQEFCo5A6cyOQO94"}
00409{"flow_id":66,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2504,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609158,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGSjTAqAEGNHL6e8NiAbvwxDIBjkDveFAQH1U6RgAA"}
01148{"flow_id":66,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2505,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":609230,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnZZAAGwGfnk0cvp7wKgBBgG7w2KOQO948MQyAVAYCAQXbQAAEO5WjXjIe6ycKomslpwe+EFt6Mjgit5TOxZ3H33HANI4vT53PRNoyKZhkE4S9iFCZzfCTWensJkZpnlLMABE4aqNQAX6ZU\/zapbAGS9LPTaiKv9Ry1gMKarsrTbdnF5winwAmVhwqa89tPKzbfBk4V04yBPdDJ2DjFTLanTQ3ELGqhKqqmcvrsuHghO2d9ak1HP13ExxC0+i4+GrhqIUwyWxdjniUJlyleN+iiIaKEg6jvrVHFWrR3PUtDbo8TEacEyF96c8xXcjPVnUVrhVI++2dvqyNpMZ8ACJADw9JEE8gToopzGHlqjm36adlbvaZA10Gxs+B\/nQx7a7NeW17x1RViO2RGJOk4lHSYkzJLzAXxFd+J6icgx2JzFBiVk7job1q60ezkEMDfaRdnPXFQ8MAAFpAwAYYQTcFelLA9oFcMXaZ1+o4whLp\/a59umnbq2FWq3OKBO8zamaxT2FyU19rYZ0ZilAUrKQf46lDK+8Hxp0k3fgqsnaxCN0dCohw\/JNH9hjSMMszCDsvH6g7UTzxGxVCtADiowEAQEACew2uQQDAc0TMzu4GCnlS5Qzgmai2FDlIr6yuHqj75k4WxQ8qA6CvskecRbf1DI9baDBITgISolwC9cfOnzbJSFP+LKDved8MDt+3jHN4TLLYVmpkkTYoA1qlWzMDaUvs17YThv1FNMmlaagZcuSaMDHizlaM3P7XnJYM0O9ky+rQRcXOKg="}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2510,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":611228,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2510,"source":"teams.pcap","alias":"nDPId-test","type":38}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2511,"source":"teams.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1587041693611,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50017,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_id":71,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2511,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":611913,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"EBMx8Tl2KDc3AG3ICABFAABgfyMAAEARCrzAqAEGNHL6jcNhDZYATBjuAAMAMCESpELalY8VcoE3uJ+0vVMADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAI="}
00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2511,"source":"teams.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1587041693611,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50017,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00648{"flow_id":68,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2515,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":625394,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"KDc3AG3IEBMx8Tl2CABFAADXVxUAAGwRBmU0cvp7wKgBBg2Ww3QAwyhaARMApyESpEI9x0RmdejywONbcT4ADwAEcsZLxoAIAAQAAAAGAAkAPQAABAFUaGUgcmVxdWVzdCBkaWQgbm90IGNvbnRhaW4gYSBNZXNzYWdlLUludGVncml0eSBhdHRyaWJ1dGUADgAIAAENljRy+okAFAAUPK7\/QeTw1Z9oICgNLxST+LDzEgAAFQAKInJ0Y21lZGlhIgABAAgAAQ2YNHL6iYCVAAhb5VsGDC2J+oAgAAgAAc5scadqCg=="}
00427{"flow_id":69,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2516,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":628354,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0Nx9AAGwG5wg0cvp7wKgBBgG7w2XeqFvwXFlWKYAS\/\/\/MOwAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":69,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2517,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":628427,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGSjTAqAEGNHL6e8NlAbtcWVYp3qhb8VAQIADs+gAA"}
00664{"flow_id":69,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2518,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":628756,"pkt_caplen":241,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":241,"pkt_l4_len":207,"pkt":"EBMx8Tl2KDc3AG3ICABFAADjAABAAEAGSXnAqAEGNHL6e8NlAbtcWVYp3qhb8VAYIADHIgAAFgMBALYBAACyAwNemFWdJel+38T72uo9XNMIcFrJVaaQNKpU+a+Uq8VSQwAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAXQAAACAAHgAAG2V1YXoudHIudGVhbXMubWljcm9zb2Z0LmNvbQAKAAgABgAXABgAGQALAAIBAAANABIAEAQBAgEFAQYBBAMCAwUDBgMABQAFAQAAAAAAEgAAABcAAA=="}
00786{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2518,"source":"teams.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":4,"flow_first_seen":1587041693582,"flow_last_seen":1587041693628,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":187,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50021,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"euaz.tr.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00602{"flow_id":65,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2519,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":640777,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC1fJUAAGwR4QY0cvp7wKgBBg2Ww2AAoaFUAQMAhSESpEIiL+\/H85JL0bmXJ+QADwAEcsZLxgANAAQAAAA8AAEACAABDZg0cvqNgAgABAAAAAaAIAAIAAHB1XGnagqAUAAYm3E8YjrBv7v21SN1g6+m0xjhRrQAAAAAgCIACTIuMC4xLjIxMQAQAAQAAC7gAAgAIK\/9w8VcH20Bp+o9r1mX6tB+MRypEJNYTX2DO\/tetQep"}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2520,"source":"teams.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1587041693654,"flow_last_seen":0,"flow_min_l4_payload_len":214,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":214,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00687{"flow_id":72,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2520,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":654732,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"EBMx8Tl2KDc3AG3ICABFAADySXIAAEARP9\/AqAEGNHL6icN0DZYA3q9FAAMAwiESpELOvwn047sA+HEU4bYADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAKAlQAIW+VbBgwtifoAFAAUPK7\/QeTw1Z9oICgNLxST+LDzEgAAFQAKInJ0Y21lZGlhIgAGADgCAAAkkKDb2wHWGU3iFTe\/yZKgAzJzGvG+3Faa6DvVqwAAAAC\/cbJ2yXgTqN3v61y8eTonekzmPAAIACCU7UyKuDgKSJKUvk8SSs9ovhsGMp06Kok2oE1dFOuKzQ=="}
00520{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2520,"source":"teams.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1587041693654,"flow_last_seen":0,"flow_min_l4_payload_len":214,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":214,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50036,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00649{"flow_id":71,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2521,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":658468,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"KDc3AG3IEBMx8Tl2CABFAADXfJYAAGwR4NE0cvqNwKgBBg2Ww2EAw+F\/ARMApyESpELalY8VcoE3uJ+0vVMADwAEcsZLxoAIAAQAAAAGAAkAPQAABAFUaGUgcmVxdWVzdCBkaWQgbm90IGNvbnRhaW4gYSBNZXNzYWdlLUludGVncml0eSBhdHRyaWJ1dGUADgAIAAENljRy+o0AFAAUPpo\/SSn4PJAIkOO6zaqfvtmAt1IAFQAKInJ0Y21lZGlhIgABAAgAAQ2YNHL6jYCVAAiQUL8kDsWN+oAgAAgAAcwTcadqCg=="}
00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2525,"source":"teams.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1587041693668,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50037,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_id":73,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2525,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":668523,"pkt_caplen":110,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":110,"pkt_l4_len":76,"pkt":"EBMx8Tl2KDc3AG3ICABFAABgYKIAAEARKUHAqAEGNHL6icN1DZYATE9EAAMAMCESpEJNv3gTxWrFDZ5wS8sADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAI="}
00516{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2525,"source":"teams.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1587041693668,"flow_last_seen":0,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":68,"flow_avg_l4_payload_len":68,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50037,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
02370{"flow_id":69,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2526,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675117,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNyJAAGwG4WU0cvp7wKgBBgG7w2XeqGPBXFlW5FAQCASBlQAAW6sdwoMA3bRkqxv5VpjyajDfFXWqL4G9QZfl841dfR9SjQLMnRDtMHjHLLEHhJCKLU2ikazGCdNZMqtfaxeWquCIWw56s0bCKwmin9Y3DIsAdEejps5dwVGPEJfdlpEbIxcuBzCIRY0C23wA8SsmAke7nyJfwnrDoCjE4H7m3XXod08er9hfv0q4nITSnedP3o61Oc42o6ZTtprTcb83jeNHnfqPTx\/r7JoPcNdqLrU2S9F5B\/3\/72kY0IJW8GVz3JfVywG\/oGQZf4DtR+N9iCPyVunnsxwatk5VQeVSeoKWofbhmm5\/59\/eJyGGKNh6xcOod+zQ\/yRc87f6tHNG2YoyFngY2b4iSL5cKDGkUG4HW8AD3tnSSMB+eS+kUxAHQWzl9sk8GGj5SN\/h6yZsZx0M8Cajppy8O10hsA4MnuDtB3uK64JLD12Do4vw3+8vrlcfGCUgqrNGgRVPtSVulxGnCvWOq0JhUVItmI195Is0h3MiJgXc2KNuZpMfbIcuyiiUJx2zdkFT81nL1PidcMdiaFVUoMih7rr4UtgVbmkgKemK\/Z7z3no4iLWFOB0NszihbN+mXEPfve7ERdipQf9N4gAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUF"}
01151{"flow_id":69,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2527,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675141,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNyNAAGwG5Ow0cvp7wKgBBgG7w2XeqGltXFlW5FAYCASXtQAABwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUxOTA="}
00424{"flow_id":69,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2528,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675196,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NlAbtcWVbk3qhb8YAQIAArqAAAAQEFCt6oY8HeqGlt"}
00424{"flow_id":69,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2529,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675207,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NlAbtcWVbk3qhb8YAQIAAphAAAAQEFCt6oY8HeqGuR"}
02361{"flow_id":69,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2530,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675355,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNyBAAGwG4Wc0cvp7wKgBBgG7w2XeqFvxXFlW5FAQCATP3wAAFgMDF+kCAABVAwNemFWdngMnqp\/ovA6U\/hymYCvRusCyWeTpZ1CTzcejKyDnDAAAU2IVNK2d1lPAfzPvUIBuCgoy2y3VInTQOrOJ6MAwAAANAAUAAAAXAAD\/AQABAAsADuwADukACSswggknMIIHD6ADAgECAhMtAAZemCjIP80XJ2CuAAAABl6YMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA1MjQxNDEwMjZaFw0yMTA1MjQxNDEwMjZaMCExHzAdBgNVBAMTFnRyLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLTNHPfgLoOgUfyR4c2CDg+CoBg7bwaQp6OOdTLjN80e6165bdZW8ryNWADQBv\/\/6Ld1H5eQQNetSDwVifHVU+CteBiHg6T9F1rA96B1Fk1nARcGhMPsZbgvGxJ+NR6ygkRK7GWC6KFZyOiZ0MvWyxQTJBlsBwklHTiX9D0fiSz06Q+tVkIHpWWHGkJRO+Tm3UUtCMr7e1K4eQloaVRg1AeMGEhZEaGXyKum9VwAP15maK0zwKMiUymx8uWFHW4J0+7wZd9kZyUeJvDO2QDZvxPl5w9NBzvGZUQFIkRD+XvUanlt9AtvhnDy5BiPzueeQgaJbyvyJl4Af8nIo8gppfAgMBAAGjggTrMIIE5zCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFq6jb0ngAABAMARzBFAiEA+SbPYnNZBq5NAa+KJuZcLJF6Cs7c51vg2wno92Y73cQCIFui0LePG9Yu0H+TqmpdeWJeVlJ0KiyWWMKI6D92L\/K3AHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFq6jb1LQAABAMARjBEAiAZDnc3oPi8LaNBy6Df89WOlPch018jWvYNKaDO2U51nQIgYZuZffTHCtDDZ3lWVJgiVsjUCTGqki0p6MIBuSQoIfUAdwBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWrqNvNaAAAEAwBIMEYCIQChq4nHPM4twtbxyAgrDLE3a797eV+6L2EiO6pBrFmrUAIhANBHWXnY9HAcs6WqVRp9r8q8wlaSY9pBfB7vJlbCShQPAHUARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFq6jb0QQAABAMARjBEAiAzKKpy8ELEm5AO\/Cl8weRDML0CJ7IOPZ2GbRbx\/8vxWgIgDCW1c1pNKCE9DA2mbQwKGa4Z2H7dNtIRrzU4ZJcZOr8wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSC313bBDWiwUMAeq0EgFmCSqbJVzALBgNVHQ8EBAMC"}
00425{"flow_id":69,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2531,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675393,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGSijAqAEGNHL6e8NlAbtcWVbk3qhhnYAQH9IkBgAAAQEFCt6oY8HeqGuR"}
01145{"flow_id":69,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2532,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675485,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNyFAAGwG5O40cvp7wKgBBgG7w2XeqGGdXFlW5FAYCAST2wAABLAwgZAGA1UdEQSBiDCBhYIWdHIudGVhbXMubWljcm9zb2Z0LmNvbYIYKi50ci50ZWFtcy5taWNyb3NvZnQuY29tghh0dXJuLnRlYW1zLm1pY3Jvc29mdC5jb22CGioudHVybi50ZWFtcy5taWNyb3NvZnQuY29tghsqLnJlbGF5LnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABCcisiO+DAS4OPnUkT5drdGW+ySCAd1BsW3Lp1Fdet9nBRcfBcsaKZ66uJsRxluxJrhagjZ4fh8tXKFj90="}
00409{"flow_id":69,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2533,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675526,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGSjTAqAEGNHL6e8NlAbtcWVbk3qhrkVAQH7Dc7wAA"}
02369{"flow_id":69,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2534,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675605,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNyRAAGwG4WM0cvp7wKgBBgG7w2XeqGuRXFlW5FAQCAT\/HAAANjIwWjCBmzCBmDBMMAkGBSsOAwIaBQAEFCmF\/GE9vi+wEg9eQg5MnsPVnv18BBQI\/iWfdOqHBMK8u46oOF8zxtFsZQITLQAGXpgoyD\/NFydgrgAAAAZemIAAGA8yMDIwMDQxNTE5MDYyMFqgERgPMjAyMDA0MTkxOTA2MjBaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTA2MjBaMA0GCSqGSIb3DQEBCwUAA4IBAQAaQYaDpwd6DNwyOUeit6mUOBXgoV06pe6ThWCURamS0COPur719YO54pzaWQ\/wQiNdRfJ+6IxdL624Y9ECjW7h0i3GVY5McK\/JE0+t8QKiDyIrzja2mdM3dr87glc0ghsX25i5Wq+uovmAq2y0kIR5ZDxPkSCewMHChNQBpgB6w7ldXqSVgO6mMxOPGIUJeCKP7XKb6HxICQ+KDOclyTMlRvOfgXDsfJ+qgS\/\/Xx69gdsXVVKuxxVgmTXKPjwc6+0PAhk7AM38T+1uvkyY+cnLoNXnWfuXwei6nw4U+wy7NBkdjTNfderi681shWsjrz7QTveMgXHXa8hDzke10XqeoIIFIzCCBR8wggUbMIIDA6ADAgECAhNuABXTTwZmllgRJK\/RAAAAFdNPMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDA0MDIxNjU4MDlaFw0yMTA0MDIxNjU4MDlaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfNV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt72xRWYGvzznDDT8NXYL9rp9+Ya3b0Z6P2wS3akQ58NdGCNNqh5bkYWl59MsBDUHv9Ef+w2CazdUk3Nynho4E8vpdECh67pX0G62DZBOiFmluBNKbuC5wy0qFpuDZifuCaL\/JIioH+qZxw1n9T+IlPYbhUIt9LEWbIcz3NKvVAjL22uCbIe4fgQeiRQY6CQMOOiKJvbVG0ji+rtc86+Mxhhl4WT\/oA0rEF\/rkByMk2VOShPm7OYdkPB4JadSsYxElQdJQqZtZ7Dx1QoI7ppuYvpwizs9bk5\/qpPbZOX2ffENmbYPX8IEIoHImvw+d5OCujhcH8ND8y2D3AEt3YOySwIDAQABo4HWMIHTMB0GA1UdDgQWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZeWmp3UPfRLZIyUkIOP3qzADvvJHesY63Dc2ynSZnVwywgjceFf+k+yQAXU4qttDwcVbl8RAxZ3TRxOK\/tx9uYmaavtEm3swh9h5B7DCvmIXfqsJJlRpK\/OFGfcf49BNBZXJky59f8YfJ49hsiJiWchclECz2p04IejlY2rjzCMngCMT2bpAzYBsJXomAbKsVRl07LYT4CLhdIIHrd+syTeudyjkMfJb34y+qxxeDCvdd+fLKHcrxUao3ZXsd7wz3mk1EWQVaTo+Md3\/ECUv"}
01150{"flow_id":69,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2535,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675618,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNyVAAGwG5Oo0cvp7wKgBBgG7w2XeqHE9XFlW5FAYCAQYlAAAEO5WjXjIe6ycKomslpwe+EFt6Mjgit5TOxZ3H33HANI4vT53PRNoyKZhkE4S9iFCZzfCTWensJkZpnlLMABE4aqNQAX6ZU\/zapbAGS9LPTaiKv9Ry1gMKarsrTbdnF5winwAmVhwqa89tPKzbfBk4V04yBPdDJ2DjFTLanTQ3ELGqhKqqmcvrsuHghO2d9ak1HP13ExxC0+i4+GrhqIUwyWxdjniUJlyleN+iiIaKEg6jvrVHFWrR3PUtDbo8TEacEyF96c8xXcjPVnUVrhVI++2dvqyNpMZ8ACJADw9JEE8gToopzGHlqjm36adlbvaZA10Gxs+B\/nQx7a7NeW17x1RViO2RGJOk4lHSYkzJLzAXxFd+J6icgx2JzFBiVk7job1q60ezkEMDfaRdnPXFQ8MAAFpAwAYYQRKVIndAMDCZx1\/nmDSDhCU8lGc4sJHvdVvcxuDirJGIeA4bGSz8UhEHvvcqcwxUq+znKjO7IKqyQE3STmAHUPjK8cqoQNeOX4QO5FtyZHFURwt7j3oFxYelHgeZanf6vsEAQEAcfEZoht1m1x\/1hC0vYqrMgCj0aeurM9eBAaoI7iRwsk3KmWpV8IAYRbkHIsmkpb0mQBNY4oOJzIM4Vqz716CaTLJhUnkBgaT7aMtgV6SgIOsR+i7dOsNliOdf+YLYfwO\/wazQXSX16jzm7Meh2vICQEwI\/TPmaZJb0z773rIv466NzkuRn4="}
00581{"flow_id":69,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2536,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":675620,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"KDc3AG3IEBMx8Tl2CABFAACmNyZAAGwG5o80cvp7wKgBBgG7w2XeqHNhXFlW5FAYCASYbwAA8CGs2DtbRdAb1Xgy4OWoDAo6QUCqXVyfkiCcZ\/OkC5tzYgLT0jnpyawrwv87OERD9XAYG4w2FJIYZM5cidKX5Zc2bXaKJCId5C2Lvu4bMrE+0KvOonXz6arB41w4Zm7zEG6JkuSYRKWmWBUuLW7VxJdKNsq0NJWfIMgOAAAA"}
00599{"flow_id":68,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2542,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":698272,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC1VxYAAGwRBoY0cvp7wKgBBg2Ww3QAoWPcAQMAhSESpELOvwn047sA+HEU4bYADwAEcsZLxgANAAQAAAA8AAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHObHGnagqAUAAYmiULR7BQSjV7GJ7mOy6WXuQ5anUAAAAAgCIACTIuMC4xLjIxMQAQAAQAAC7gAAgAIJWLEhTAIKUMzT0EuyGZ9cU94RPVJanGef0JixSMSj4H"}
00688{"flow_id":71,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2543,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":711026,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"EBMx8Tl2KDc3AG3ICABFAADyfgoAAEARC0PAqAEGNHL6jcNhDZYA3rEpAAMAwiESpEJLDXUDhL3sfvdJg10ADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAKAlQAIkFC\/JA7FjfoAFAAUPpo\/SSn4PJAIkOO6zaqfvtmAt1IAFQAKInJ0Y21lZGlhIgAGADgCAAAkkKDb2wHWGU3iFTe\/yZKgAzJzGvG+3Faa6DvVqwAAAAC\/cbJ2yXgTqN3v61y8eTonekzmPAAIACBfcijkK3I1E6fsjRiPsKvs33Xfpf\/cKnDyh7VrIY168g=="}
00647{"flow_id":73,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2545,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":714142,"pkt_caplen":229,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":229,"pkt_l4_len":195,"pkt":"KDc3AG3IEBMx8Tl2CABFAADXVxcAAGwRBlU0cvqJwKgBBg2Ww3UAwwtKARMApyESpEJNv3gTxWrFDZ5wS8sADwAEcsZLxoAIAAQAAAAGAAkAPQAABAFUaGUgcmVxdWVzdCBkaWQgbm90IGNvbnRhaW4gYSBNZXNzYWdlLUludGVncml0eSBhdHRyaWJ1dGUADgAIAAENljRy+okAFAAUc60+h2VE9PTAWxn4K2V6NOmKA20AFQAKInJ0Y21lZGlhIgABAAgAAQ2YNHL6iYCVAAjDwJ1K7o6J+oAgAAgAAcBocadqCg=="}
00600{"flow_id":71,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2551,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":756239,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC1fJcAAGwR4PI0cvqNwKgBBg2Ww2EAoTssAQMAhSESpEJLDXUDhL3sfvdJg10ADwAEcsZLxgANAAQAAAA8AAEACAABDZg0cvqNgAgABAAAAAaAIAAIAAHME3GnagqAUAAYLOxJmLF8a9P8QJMpg69OprVoITMAAAAAgCIACTIuMC4xLjIxMQAQAAQAAC7gAAgAIMhO7y5FcPLOAgpkLIJifRx7Dv8ek2QLf5zo\/BiwDhB4"}
00688{"flow_id":73,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2552,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":763689,"pkt_caplen":256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":256,"pkt_l4_len":222,"pkt":"EBMx8Tl2KDc3AG3ICABFAADy1jgAAEARsxjAqAEGNHL6icN1DZYA3qn\/AAMAwiESpEK\/FrW6Bpt+jaFgT0IADwAEcsZLxoA3AAQAAAACgAgABAAAAAaABgAEAAAAAQAQAAQAAC7ggFUABAACAAKAlQAIw8CdSu6OifoAFAAUc60+h2VE9PTAWxn4K2V6NOmKA20AFQAKInJ0Y21lZGlhIgAGADgCAAAkkKDb2wHWGU3iFTe\/yZKgAzJzGvG+3Faa6DvVqwAAAAC\/cbJ2yXgTqN3v61y8eTonekzmPAAIACAOMJjC3yWHP2a8uRvQ6tdNq4Cf2VvwjY\/Ply+68rS7wg=="}
00603{"flow_id":73,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2556,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":808734,"pkt_caplen":195,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":195,"pkt_l4_len":161,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC1VxgAAGwRBnY0cvqJwKgBBg2Ww3UAoXQEAQMAhSESpEK\/FrW6Bpt+jaFgT0IADwAEcsZLxgANAAQAAAA8AAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHAaHGnagqAUAAYaOUMdiD0+ug9lexVR\/3YR6\/W6KUAAAAAgCIACTIuMC4xLjIxMQAQAAQAAC7gAAgAIL4g0LfB18yA2q\/RVWXcDhE8D9XtCMo2nCqOglxViaD8"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2559,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1587041693828,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00444{"flow_id":74,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2559,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":828302,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGSf\/AqAEGNHL6mMNeAbvdNMkXAAAAALAC\/\/\/QFQAAAgQFtAEDAwUBAQgKMITaQwAAAAAEAgAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2562,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1587041693849,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00442{"flow_id":75,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2562,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":849498,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGSf7AqAEGNHL6mcN0AbuMksvlAAAAALAC\/\/8dvwAAAgQFtAEDAwUBAQgKMITaVwAAAAAEAgAA"}
00427{"flow_id":74,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2564,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869354,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0nZxAAGwGgG40cvqYwKgBBgG7w17cXACa3TTJGIAS\/\/81\/QAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":74,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2565,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869423,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMkY3FwAm1AQIABWvAAA"}
00644{"flow_id":74,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2566,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869663,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWAABAAEAGSWnAqAEGNHL6mMNeAbvdNMkY3FwAm1AYIACuOQAAFgMBAKkBAAClAwNemFWd9sBVDmqpQ1JOmTf85+s9vRwXDIKd7RSpfqD9hwAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAUAAAABMAEQAADjUyLjExNC4yNTAuMTUyAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"}
00776{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2566,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":4,"flow_first_seen":1587041693828,"flow_last_seen":1587041693869,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.152","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00426{"flow_id":75,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2567,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893017,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0NypAAGwG5t80cvqZwKgBBgG7w3QJhgXYjJLL5oAS\/\/9RUwAAAgQFoAEDAwgBAQQC"}
00408{"flow_id":75,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2568,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893121,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksvmCYYF2VAQIAByEgAA"}
00645{"flow_id":75,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2569,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893319,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWAABAAEAGSWjAqAEGNHL6mcN0AbuMksvmCYYF2VAYIAA4UQAAFgMBAKkBAAClAwNemFWd\/1XCA+79geTWEWiWwTsvTSnBi9NExcEsdrOoSgAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAUAAAABMAEQAADjUyLjExNC4yNTAuMTUzAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"}
00776{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2569,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":4,"flow_first_seen":1587041693849,"flow_last_seen":1587041693893,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.153","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
02359{"flow_id":74,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2576,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912361,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZ1AAGwGes00cvqYwKgBBgG7w17cXACb3TTJxlAQCARdzwAAFgMDF+kCAABVAwNemFWdM9zHzxbjC7QANdHz8AfaCDM7kl4CH3iC8m+C5SA8HQAAdg+4AWMXjI8CbVJCHoa9vuL+BAQY6d2I21i7H8AwAAANAAUAAAAXAAD\/AQABAAsADuwADukACSswggknMIIHD6ADAgECAhMtAAZemCjIP80XJ2CuAAAABl6YMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA1MjQxNDEwMjZaFw0yMTA1MjQxNDEwMjZaMCExHzAdBgNVBAMTFnRyLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLTNHPfgLoOgUfyR4c2CDg+CoBg7bwaQp6OOdTLjN80e6165bdZW8ryNWADQBv\/\/6Ld1H5eQQNetSDwVifHVU+CteBiHg6T9F1rA96B1Fk1nARcGhMPsZbgvGxJ+NR6ygkRK7GWC6KFZyOiZ0MvWyxQTJBlsBwklHTiX9D0fiSz06Q+tVkIHpWWHGkJRO+Tm3UUtCMr7e1K4eQloaVRg1AeMGEhZEaGXyKum9VwAP15maK0zwKMiUymx8uWFHW4J0+7wZd9kZyUeJvDO2QDZvxPl5w9NBzvGZUQFIkRD+XvUanlt9AtvhnDy5BiPzueeQgaJbyvyJl4Af8nIo8gppfAgMBAAGjggTrMIIE5zCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFq6jb0ngAABAMARzBFAiEA+SbPYnNZBq5NAa+KJuZcLJF6Cs7c51vg2wno92Y73cQCIFui0LePG9Yu0H+TqmpdeWJeVlJ0KiyWWMKI6D92L\/K3AHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFq6jb1LQAABAMARjBEAiAZDnc3oPi8LaNBy6Df89WOlPch018jWvYNKaDO2U51nQIgYZuZffTHCtDDZ3lWVJgiVsjUCTGqki0p6MIBuSQoIfUAdwBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWrqNvNaAAAEAwBIMEYCIQChq4nHPM4twtbxyAgrDLE3a797eV+6L2EiO6pBrFmrUAIhANBHWXnY9HAcs6WqVRp9r8q8wlaSY9pBfB7vJlbCShQPAHUARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFq6jb0QQAABAMARjBEAiAzKKpy8ELEm5AO\/Cl8weRDML0CJ7IOPZ2GbRbx\/8vxWgIgDCW1c1pNKCE9DA2mbQwKGa4Z2H7dNtIRrzU4ZJcZOr8wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSC313bBDWiwUMAeq0EgFmCSqbJVzALBgNVHQ8EBAMC"}
01144{"flow_id":74,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2577,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912478,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnZ5AAGwGflQ0cvqYwKgBBgG7w17cXAZH3TTJxlAYCAT9qQAABLAwgZAGA1UdEQSBiDCBhYIWdHIudGVhbXMubWljcm9zb2Z0LmNvbYIYKi50ci50ZWFtcy5taWNyb3NvZnQuY29tghh0dXJuLnRlYW1zLm1pY3Jvc29mdC5jb22CGioudHVybi50ZWFtcy5taWNyb3NvZnQuY29tghsqLnJlbGF5LnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABCcisiO+DAS4OPnUkT5drdGW+ySCAd1BsW3Lp1Fdet9nBRcfBcsaKZ66uJsRxluxJrhagjZ4fh8tXKFj90="}
00408{"flow_id":74,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2578,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912518,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMnG3FwIa1AQH8FOfQAA"}
02370{"flow_id":74,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2579,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912851,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZ9AAGwGess0cvqYwKgBBgG7w17cXAhr3TTJxlAQCATrYwAAW6sdwoMA3bRkqxv5VpjyajDfFXWqL4G9QZfl841dfR9SjQLMnRDtMHjHLLEHhJCKLU2ikazGCdNZMqtfaxeWquCIWw56s0bCKwmin9Y3DIsAdEejps5dwVGPEJfdlpEbIxcuBzCIRY0C23wA8SsmAke7nyJfwnrDoCjE4H7m3XXod08er9hfv0q4nITSnedP3o61Oc42o6ZTtprTcb83jeNHnfqPTx\/r7JoPcNdqLrU2S9F5B\/3\/72kY0IJW8GVz3JfVywG\/oGQZf4DtR+N9iCPyVunnsxwatk5VQeVSeoKWofbhmm5\/59\/eJyGGKNh6xcOod+zQ\/yRc87f6tHNG2YoyFngY2b4iSL5cKDGkUG4HW8AD3tnSSMB+eS+kUxAHQWzl9sk8GGj5SN\/h6yZsZx0M8Cajppy8O10hsA4MnuDtB3uK64JLD12Do4vw3+8vrlcfGCUgqrNGgRVPtSVulxGnCvWOq0JhUVItmI195Is0h3MiJgXc2KNuZpMfbIcuyiiUJx2zdkFT81nL1PidcMdiaFVUoMih7rr4UtgVbmkgKemK\/Z7z3no4iLWFOB0NszihbN+mXEPfve7ERdipQf9N4gAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUF"}
00408{"flow_id":74,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2580,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912924,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMnG3FwOF1AQIABIkgAA"}
01152{"flow_id":74,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2581,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913230,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnaBAAGwGflI0cvqYwKgBBgG7w17cXA4X3TTJxlAYCAQDhAAABwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUxNzA="}
00409{"flow_id":74,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2582,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913259,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMnG3FwQO1AQH+5GgAAA"}
02368{"flow_id":74,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2583,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913477,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnaFAAGwGesk0cvqYwKgBBgG7w17cXBA73TTJxlAQCASc0wAANTA1WjCBmzCBmDBMMAkGBSsOAwIaBQAEFCmF\/GE9vi+wEg9eQg5MnsPVnv18BBQI\/iWfdOqHBMK8u46oOF8zxtFsZQITLQAGXpgoyD\/NFydgrgAAAAZemIAAGA8yMDIwMDQxNTE3MDUwNVqgERgPMjAyMDA0MTkxNzA1MDVaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxNzA1MDVaMA0GCSqGSIb3DQEBCwUAA4IBAQAeBlju+Bk8y9loNywmQduZG4vnsADIVOxrHwFDnlBuunDk3ICaZx4wK6m9ivD5M022cpjNZnVqryu4PhlvNBEmbfkg8kao6U8HlpI2WvX78jsc4bJjy+2Gu7b44KpbB8D3\/z16ntBvpqRM3nFjhy\/osreAQDPfZBdXsFDqYwBgcr21zhN+a+2xDJiymBT2ez9LWXwRVTa0vspjfdNsak2ljytLjN8EglWs2FjRqVz0aTyPocmLxHKlAs0Sc\/TyGsqYQomSLPABh0rsRmXkqE0dNpzs6a1b7XwxHlOi8n9+XwMR7di1d5FAi1XR3XPr91vUU4nTGA1yy3\/MpPq+1L1IoIIFIzCCBR8wggUbMIIDA6ADAgECAhNuABXTTwZmllgRJK\/RAAAAFdNPMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDA0MDIxNjU4MDlaFw0yMTA0MDIxNjU4MDlaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfNV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt72xRWYGvzznDDT8NXYL9rp9+Ya3b0Z6P2wS3akQ58NdGCNNqh5bkYWl59MsBDUHv9Ef+w2CazdUk3Nynho4E8vpdECh67pX0G62DZBOiFmluBNKbuC5wy0qFpuDZifuCaL\/JIioH+qZxw1n9T+IlPYbhUIt9LEWbIcz3NKvVAjL22uCbIe4fgQeiRQY6CQMOOiKJvbVG0ji+rtc86+Mxhhl4WT\/oA0rEF\/rkByMk2VOShPm7OYdkPB4JadSsYxElQdJQqZtZ7Dx1QoI7ppuYvpwizs9bk5\/qpPbZOX2ffENmbYPX8IEIoHImvw+d5OCujhcH8ND8y2D3AEt3YOySwIDAQABo4HWMIHTMB0GA1UdDgQWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZeWmp3UPfRLZIyUkIOP3qzADvvJHesY63Dc2ynSZnVwywgjceFf+k+yQAXU4qttDwcVbl8RAxZ3TRxOK\/tx9uYmaavtEm3swh9h5B7DCvmIXfqsJJlRpK\/OFGfcf49BNBZXJky59f8YfJ49hsiJiWchclECz2p04IejlY2rjzCMngCMT2bpAzYBsJXomAbKsVRl07LYT4CLhdIIHrd+syTeudyjkMfJb34y+qxxeDCvdd+fLKHcrxUao3ZXsd7wz3mk1EWQVaTo+Md3\/ECUv"}
01153{"flow_id":74,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2584,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913602,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnaJAAGwGflA0cvqYwKgBBgG7w17cXBXn3TTJxlAYCAQnDgAAEO5WjXjIe6ycKomslpwe+EFt6Mjgit5TOxZ3H33HANI4vT53PRNoyKZhkE4S9iFCZzfCTWensJkZpnlLMABE4aqNQAX6ZU\/zapbAGS9LPTaiKv9Ry1gMKarsrTbdnF5winwAmVhwqa89tPKzbfBk4V04yBPdDJ2DjFTLanTQ3ELGqhKqqmcvrsuHghO2d9ak1HP13ExxC0+i4+GrhqIUwyWxdjniUJlyleN+iiIaKEg6jvrVHFWrR3PUtDbo8TEacEyF96c8xXcjPVnUVrhVI++2dvqyNpMZ8ACJADw9JEE8gToopzGHlqjm36adlbvaZA10Gxs+B\/nQx7a7NeW17x1RViO2RGJOk4lHSYkzJLzAXxFd+J6icgx2JzFBiVk7job1q60ezkEMDfaRdnPXFQ8MAAFpAwAYYQQhQf1daOeyhgiavOXY\/txK+QPeehjV4SAFwgk2\/7vZFfnvBpx3s79fUnAwIryC0QS1\/SQoFkL+wU7sxxwPvq+ruhfRWOuXB4uL2Rh3JHRqTevg\/\/GagRR8oAQLHABO2g0EAQEAAFpM+ijJH609K8Xd4u7I\/GpZsxkUnc1ySSo2E\/dDEZ7xCReh8uynQdfZkfJaSbRKJmhhmUU+xVoZLwzoqlQhwyPtxEv7I4b1oax8FTuY+k7WDigByZC2b8eLQVWHprFPRqAGAXk7TEa8sB3CwmuSJ1iD75izcK4LDTR17k+CeJ81gvVdt3w="}
00584{"flow_id":74,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2585,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913604,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"KDc3AG3IEBMx8Tl2CABFAACmnaNAAGwGf\/U0cvqYwKgBBgG7w17cXBgL3TTJxlAYCARH6AAAoGYXVjxNjX0u94sb8EN71aR8FxRAxm4b7QhVDBFJeFyj2oxCVxEyLIOQM9r2Y\/py\/X1yaMdHm1JKh4uaQ14MPCaKxipbs9DYx5FnTDsagbvW939x1tOszgRxqrOpD63\/UszJQ1xtkbtRA8XFVVi29UHzj+W5gCPWBr0OAAAA"}
01235{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2585,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":14,"flow_first_seen":1587041693828,"flow_last_seen":1587041693913,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6300,"flow_avg_l4_payload_len":450,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"10":"TLS Certificate Mismatch","15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.152","server_names":"tr.teams.microsoft.com,*.tr.teams.microsoft.com,turn.teams.microsoft.com,*.turn.teams.microsoft.com,*.relay.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5","issuerDN":"CN=tr.teams.microsoft.com","fingerprint":"A7:90:8D:41:ED:24:D2:83:48:95:90:CE:18:D3:A6:C2:62:7A:07:75"}}
00409{"flow_id":74,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2586,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":913642,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMnG3FwYC1AQH+4+sAAA"}
02360{"flow_id":75,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2595,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":937910,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNyxAAGwG4T00cvqZwKgBBgG7w3QJhgXZjJLMlFAQCAT\/SwAAFgMDF+kCAABVAwNemFWdlZ1o0K1pDuc31o7KbeFA6zW0UoTj74rN53YU1yAVNwAAZbPmUJGFDDA3baQ8RQ+flEqSYPNJweq+ysirz8AwAAANAAUAAAAXAAD\/AQABAAsADuwADukACSswggknMIIHD6ADAgECAhMtAAZemCjIP80XJ2CuAAAABl6YMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA1MjQxNDEwMjZaFw0yMTA1MjQxNDEwMjZaMCExHzAdBgNVBAMTFnRyLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLTNHPfgLoOgUfyR4c2CDg+CoBg7bwaQp6OOdTLjN80e6165bdZW8ryNWADQBv\/\/6Ld1H5eQQNetSDwVifHVU+CteBiHg6T9F1rA96B1Fk1nARcGhMPsZbgvGxJ+NR6ygkRK7GWC6KFZyOiZ0MvWyxQTJBlsBwklHTiX9D0fiSz06Q+tVkIHpWWHGkJRO+Tm3UUtCMr7e1K4eQloaVRg1AeMGEhZEaGXyKum9VwAP15maK0zwKMiUymx8uWFHW4J0+7wZd9kZyUeJvDO2QDZvxPl5w9NBzvGZUQFIkRD+XvUanlt9AtvhnDy5BiPzueeQgaJbyvyJl4Af8nIo8gppfAgMBAAGjggTrMIIE5zCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFq6jb0ngAABAMARzBFAiEA+SbPYnNZBq5NAa+KJuZcLJF6Cs7c51vg2wno92Y73cQCIFui0LePG9Yu0H+TqmpdeWJeVlJ0KiyWWMKI6D92L\/K3AHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFq6jb1LQAABAMARjBEAiAZDnc3oPi8LaNBy6Df89WOlPch018jWvYNKaDO2U51nQIgYZuZffTHCtDDZ3lWVJgiVsjUCTGqki0p6MIBuSQoIfUAdwBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWrqNvNaAAAEAwBIMEYCIQChq4nHPM4twtbxyAgrDLE3a797eV+6L2EiO6pBrFmrUAIhANBHWXnY9HAcs6WqVRp9r8q8wlaSY9pBfB7vJlbCShQPAHUARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFq6jb0QQAABAMARjBEAiAzKKpy8ELEm5AO\/Cl8weRDML0CJ7IOPZ2GbRbx\/8vxWgIgDCW1c1pNKCE9DA2mbQwKGa4Z2H7dNtIRrzU4ZJcZOr8wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSC313bBDWiwUMAeq0EgFmCSqbJVzALBgNVHQ8EBAMC"}
01144{"flow_id":75,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2596,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":937947,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNy1AAGwG5MQ0cvqZwKgBBgG7w3QJhguFjJLMlFAYCAQZAAAABLAwgZAGA1UdEQSBiDCBhYIWdHIudGVhbXMubWljcm9zb2Z0LmNvbYIYKi50ci50ZWFtcy5taWNyb3NvZnQuY29tghh0dXJuLnRlYW1zLm1pY3Jvc29mdC5jb22CGioudHVybi50ZWFtcy5taWNyb3NvZnQuY29tghsqLnJlbGF5LnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABCcisiO+DAS4OPnUkT5drdGW+ySCAd1BsW3Lp1Fdet9nBRcfBcsaKZ66uJsRxluxJrhagjZ4fh8tXKFj90="}
00408{"flow_id":75,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2597,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938036,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksyUCYYNqVAQH8Fp0wAA"}
02370{"flow_id":75,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2598,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938114,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNy5AAGwG4Ts0cvqZwKgBBgG7w3QJhg2pjJLMlFAQCAQGugAAW6sdwoMA3bRkqxv5VpjyajDfFXWqL4G9QZfl841dfR9SjQLMnRDtMHjHLLEHhJCKLU2ikazGCdNZMqtfaxeWquCIWw56s0bCKwmin9Y3DIsAdEejps5dwVGPEJfdlpEbIxcuBzCIRY0C23wA8SsmAke7nyJfwnrDoCjE4H7m3XXod08er9hfv0q4nITSnedP3o61Oc42o6ZTtprTcb83jeNHnfqPTx\/r7JoPcNdqLrU2S9F5B\/3\/72kY0IJW8GVz3JfVywG\/oGQZf4DtR+N9iCPyVunnsxwatk5VQeVSeoKWofbhmm5\/59\/eJyGGKNh6xcOod+zQ\/yRc87f6tHNG2YoyFngY2b4iSL5cKDGkUG4HW8AD3tnSSMB+eS+kUxAHQWzl9sk8GGj5SN\/h6yZsZx0M8Cajppy8O10hsA4MnuDtB3uK64JLD12Do4vw3+8vrlcfGCUgqrNGgRVPtSVulxGnCvWOq0JhUVItmI195Is0h3MiJgXc2KNuZpMfbIcuyiiUJx2zdkFT81nL1PidcMdiaFVUoMih7rr4UtgVbmkgKemK\/Z7z3no4iLWFOB0NszihbN+mXEPfve7ERdipQf9N4gAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUF"}
01151{"flow_id":75,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2599,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938128,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNy9AAGwG5MI0cvqZwKgBBgG7w3QJhhNVjJLMlFAYCAQc2gAABwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUxOTA="}
00409{"flow_id":75,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2600,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938156,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksyUCYYVeVAQH8FiAwAA"}
02368{"flow_id":75,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2601,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938366,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUNzBAAGwG4Tk0cvqZwKgBBgG7w3QJhhV5jJLMlFAQCASEQQAANjIwWjCBmzCBmDBMMAkGBSsOAwIaBQAEFCmF\/GE9vi+wEg9eQg5MnsPVnv18BBQI\/iWfdOqHBMK8u46oOF8zxtFsZQITLQAGXpgoyD\/NFydgrgAAAAZemIAAGA8yMDIwMDQxNTE5MDYyMFqgERgPMjAyMDA0MTkxOTA2MjBaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTA2MjBaMA0GCSqGSIb3DQEBCwUAA4IBAQAaQYaDpwd6DNwyOUeit6mUOBXgoV06pe6ThWCURamS0COPur719YO54pzaWQ\/wQiNdRfJ+6IxdL624Y9ECjW7h0i3GVY5McK\/JE0+t8QKiDyIrzja2mdM3dr87glc0ghsX25i5Wq+uovmAq2y0kIR5ZDxPkSCewMHChNQBpgB6w7ldXqSVgO6mMxOPGIUJeCKP7XKb6HxICQ+KDOclyTMlRvOfgXDsfJ+qgS\/\/Xx69gdsXVVKuxxVgmTXKPjwc6+0PAhk7AM38T+1uvkyY+cnLoNXnWfuXwei6nw4U+wy7NBkdjTNfderi681shWsjrz7QTveMgXHXa8hDzke10XqeoIIFIzCCBR8wggUbMIIDA6ADAgECAhNuABXTTwZmllgRJK\/RAAAAFdNPMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDA0MDIxNjU4MDlaFw0yMTA0MDIxNjU4MDlaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfNV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt72xRWYGvzznDDT8NXYL9rp9+Ya3b0Z6P2wS3akQ58NdGCNNqh5bkYWl59MsBDUHv9Ef+w2CazdUk3Nynho4E8vpdECh67pX0G62DZBOiFmluBNKbuC5wy0qFpuDZifuCaL\/JIioH+qZxw1n9T+IlPYbhUIt9LEWbIcz3NKvVAjL22uCbIe4fgQeiRQY6CQMOOiKJvbVG0ji+rtc86+Mxhhl4WT\/oA0rEF\/rkByMk2VOShPm7OYdkPB4JadSsYxElQdJQqZtZ7Dx1QoI7ppuYvpwizs9bk5\/qpPbZOX2ffENmbYPX8IEIoHImvw+d5OCujhcH8ND8y2D3AEt3YOySwIDAQABo4HWMIHTMB0GA1UdDgQWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAZeWmp3UPfRLZIyUkIOP3qzADvvJHesY63Dc2ynSZnVwywgjceFf+k+yQAXU4qttDwcVbl8RAxZ3TRxOK\/tx9uYmaavtEm3swh9h5B7DCvmIXfqsJJlRpK\/OFGfcf49BNBZXJky59f8YfJ49hsiJiWchclECz2p04IejlY2rjzCMngCMT2bpAzYBsJXomAbKsVRl07LYT4CLhdIIHrd+syTeudyjkMfJb34y+qxxeDCvdd+fLKHcrxUao3ZXsd7wz3mk1EWQVaTo+Md3\/ECUv"}
01153{"flow_id":75,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2602,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938381,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMNzFAAGwG5MA0cvqZwKgBBgG7w3QJhhsljJLMlFAYCATpCwAAEO5WjXjIe6ycKomslpwe+EFt6Mjgit5TOxZ3H33HANI4vT53PRNoyKZhkE4S9iFCZzfCTWensJkZpnlLMABE4aqNQAX6ZU\/zapbAGS9LPTaiKv9Ry1gMKarsrTbdnF5winwAmVhwqa89tPKzbfBk4V04yBPdDJ2DjFTLanTQ3ELGqhKqqmcvrsuHghO2d9ak1HP13ExxC0+i4+GrhqIUwyWxdjniUJlyleN+iiIaKEg6jvrVHFWrR3PUtDbo8TEacEyF96c8xXcjPVnUVrhVI++2dvqyNpMZ8ACJADw9JEE8gToopzGHlqjm36adlbvaZA10Gxs+B\/nQx7a7NeW17x1RViO2RGJOk4lHSYkzJLzAXxFd+J6icgx2JzFBiVk7job1q60ezkEMDfaRdnPXFQ8MAAFpAwAYYQR9Xzasg6o56fwVydh8\/2qHt6uNNjQsgEydKcdG8qpRHli+PKMoJeNKLPLwYJA\/NVQY9Mgsc2LsWo924Dp37+uJHJoKxlwS\/mcRdQEFZSjE9BkNuroZHuDQnnNMsKYyv1UEAQEAK4yX\/YhVEwd2zEFvWPVpwix8vVQtkifJlrXh74kG4KB2YpM6atsG6NGDuhleV5Q8I0DDXGvheEFR\/He2pQR6uNZ7aZd3nT2DLVDCbVHDOETZ+6ZW0YfuvH3OsFI+LfFXOCxaCdQu8\/oStOwZaB186hoKZA2VJkkbUo285KLz3Q1iCsTYa\/E="}
00583{"flow_id":75,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2603,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938382,"pkt_caplen":180,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":180,"pkt_l4_len":146,"pkt":"KDc3AG3IEBMx8Tl2CABFAACmNzJAAGwG5mU0cvqZwKgBBgG7w3QJhh1JjJLMlFAYCAQnLgAAvPhf6s8atadXOYIv8S\/kfh4lalB+\/KO7EsW7qibh4IX25u6kJs295JdF00jtndo3KB+O5mLywq7lVcO2UaxV7pBao4ZK\/1jPpcSNa98o6xrwsOJ+MWsHZAWq9r7iEbUJV++auMwbgBpMe6uRjTmnSy9VPw119vTUh0QOAAAA"}
01235{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2603,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":13,"flow_first_seen":1587041693849,"flow_last_seen":1587041693938,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6300,"flow_avg_l4_payload_len":484,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"10":"TLS Certificate Mismatch","15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.153","server_names":"tr.teams.microsoft.com,*.tr.teams.microsoft.com,turn.teams.microsoft.com,*.turn.teams.microsoft.com,*.relay.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 5","issuerDN":"CN=tr.teams.microsoft.com","fingerprint":"A7:90:8D:41:ED:24:D2:83:48:95:90:CE:18:D3:A6:C2:62:7A:07:75"}}
00409{"flow_id":75,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2604,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938410,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksyUCYYdSVAQH8FaMwAA"}
00409{"flow_id":75,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2605,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":938413,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksyUCYYdx1AQH71ZuQAA"}
02001{"flow_id":64,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2629,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":120717,"pkt_caplen":1227,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1227,"pkt_l4_len":1193,"pkt":"EBMx8Tl2KDc3AG3ICABFAAS9\/boAAEARNM3AqAEGNHJNiMnhDZYEqZVHBl3+t6o2WT+OKw\/oTFMoposi76goQSvdTkAkvomrWFuLQAOPtN1PZOmBbtTke\/YgFGvZ0KvPBNQ5Wm2b8RSp8MLBeXUbSb3ihMwS+jtgaiyGWs+98DH\/XiUzP5qF03kNm6hkC2X4f90uSk+qnKDXx+nMgrAp0\/c4ktIgnvwSKlQuZz9ri97ShVTO0OWHpHehFI8ySmDhIQvj+B8Ons2z5Lvg3ffuGNYe6crWNgXZ0qKFgPHpXjJx\/wdodQrdlhUSFIrhAuf7ipEjkyD1z1y2FzfwouTPXUXbzMBEFC4M+pre6XPfxER5ZFN2Z5ot8Wfj4sMpfOmqwegxunkQP4u4Dpoyl1yTFZ5tGVDoS8bVR9dEvjepY1DyFVKh4lzFW8ooCq3R0u0NzPR1zbXcsUK2vRNQfkuFkm8kJpBPm+sDRNV0E7nocNcIy9cbzYY8R2L5n8Ei8aRtWWInQYVRebKHiM3bT78vy8pu91j3o6F7sj94167kkAjRqNewpzCwSD0Wg+CSHSzVXmncsbo8cUJmybHnSbzP2\/cVCW0tIuklqz\/yTGItsOKa14YayXwz8NM3QLabWUJcuzL2qgJeZM7ds+vJhDjMub1jJ0pY7\/AOgd1gx6v1aOpp83mXc849HgYCS4FHRhVJbviqYw3Qz7wEvIPnET9G5D9tT3taEhj8OsCry0Cv3Cdh60qxw7GhkX8C4KBQtcxkOzOFQvaN4P465wdmFCboScbCuxn4wCzFtcVhwooyaX9ParD4z\/JHSlm+cuHZFX0k4mhOL3rzKGDphdIiWrabG7bPDeIDWqx1979JFMahbtO9RC+9rtm8+2gjkSuDvk0mptCERf0EwFD1njDYdIkeyeHjVG7sJKOHmalzFx0NsAyJtfSeRPQO2szzmHsmxH3+otQV5gmzsVCZSGXuqGpX7iUa5voQifaQEBkPxFidHtFPkMsZFsYJsRHYaYKEgt\/+t9tdfO7KOEvvqkgGd4snxb6kryNJr2z4yoU2Uz6XCNoppFlA4n61o5lQX4TMyUOL3fUpNNrNMH8xLyxBEJ5RjmQ0uf814MIfXsYQqHMfNWhc9ff5G6ZsWJPmEUmgVZHeYDD2QEWXT+zPq0BWChHEwinek+mjRLoa6CYfNtWd8mE3A7g5ww9TFyamhwXowuT3QA9V3xAvMgNzqScDow\/fkYkgloS2F\/LZ6qCI1z\/DibL70ZeKbW3al8cF73MCwSxTCGB6EtBn48z\/yXevDNcWU2DL7arg\/QaX6Mm7dmtwH7Y8+9SgfRZ5O8Kg9d7ih\/FsyUgMgAF2h7e\/pym\/O6Ou\/89k2PfYJHRfrd1M61FVy5Uhs5kfsIAbGuSuMrDL5oCbdnJOcJ2XQgIKrjquEvSMSpkabv7tbKU2YFGQ97\/wTqpxOGPbhfS0XvKh1GR2BI3nCh31aHfAeBu8fsfZlFOvbAd0oZC9Q6h7vGIgcDuEy0O7t7cX7xKNwyLUtO7hmIUkhppFuIdcKwrHlWqVKc2WE77kUDf1xEVdexjFM7FKjmNQk8nMclH5R\/ou8m94L58wLC2ILhY4q0WDOvWLmGIorcxK4E+MnpjO\/SgE"}
00444{"flow_id":64,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2630,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":166447,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"KDc3AG3IEBMx8Tl2CABFAABBNJYAAGwR1m00ck2IwKgBBg2WyeEALargAzk5ZGQ3NzNkLTE5NGQtNDI0MC04MzliLTMxMTIxNWQ3OGZjMw=="}
01426{"flow_id":64,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2631,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":217771,"pkt_caplen":795,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":795,"pkt_l4_len":761,"pkt":"KDc3AG3IEBMx8Tl2CABFAAMNNJcAAGwR06A0ck2IwKgBBg2WyeEC+aecB1UVQ0I8M6FxU9jkNGUVrfYsu7yDLmG89ZSTvlNF5TpUlzTQ8G\/WoZAcduFrX9xwwsgTlyWR\/ZJXdWBPXcQKDMBDl8GHaw3lWitB0YSSDN\/6aj6wVTGssPy0SacuJz4PM485lC\/WpQEUg\/dwTCBKSb4sZpaN+b4fa4H63Sras9CRRkNNZX8Oo9eyIyZ3gqUv9gPVTI150j7g3RDPNpeJNlf85JSIyyePgyMPvxSZBMqkSilqp1nYF18Exoly8w9aSdwAwZImrCEE1FiGLxTlBeZR5SojZLildRr+USDoQk4aPiyQCz8uW6vXBZDAVScTmaYW4KeHzCPn1Zi5Z1D5ohg239NFCPP7p0w20EvQqZtbtw6YdY8FFZJ4Xjka3LlyJ0LqUH+CyBqrbB\/jfF+y+fX1zfSErh\/AtY\/SHoHzRUK3ptds98ieAen3ZuR2zX9OCRPVjiecyOb1JF5sRoUw\/Fg0RSBKhZH1fRsz5fI9R3e8DC\/QYF6HGWV1kuMhPh7vnQS3GA9w061KitjkHMdmB1O7EFgska2ph1S4NYSpXr9TmiS\/5YRKt09eo9iN2SjkJTb96gJStpSbNR\/tbZZRrH8bZODZsf7i3\/4S2mlJX9KHA8CaNu\/8hdp8pfDPEZ3ygGD\/G\/LmYqao4O\/cprao85GqyLmFi0fJKyD\/QOixF8jqWlPrfO+6l0217b9TQn22e3jScw4kcpjFpnMc9Exibi4Ka7ZxpjLsaCg3th\/eTjUhyYLe5f2OMo3hezY+\/hd+3gqV+axaOZ9DVnh0Oa\/IxOpvqVU4sDicawTrJAVg7xBYRMKpTnNFnt\/RJh5KkJRZLTMxPCIRwose2fhDQ\/0qv94wuRRujWSPz4LfVns\/mjvv9LOwg+aCsDOQj4NqAxYVlzysfVVXB6MT9pCHm8HRXlYWtA3+jSTKtcCBfysZ1ekXEmi0tG\/WUYPmN39o\/dbKs8XmGYfABSUkKMhZErAWH4pRMuDbO8vknAtW\/8ZIAEH0"}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2632,"source":"teams.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1587041694219,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":60567,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00443{"flow_id":76,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2632,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":219802,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG9w\/AqAEGNHJNiOyXAbs8mpamAAAAALAC\/\/8lfgAAAgQFtAEDAwUBAQgKMITbvgAAAAAEAgAA"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2633,"source":"teams.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1587041694221,"flow_last_seen":0,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":58,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60837,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00474{"flow_id":77,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2633,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":221137,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"EBMx8Tl2KDc3AG3ICABFAABWS5cAAP8R7KfAqAEGwKgBAe2lADUAQpDJn88BAAABAAAAAAAAG2MtZmxpZ2h0cHJveHktZXVuby0wMS10ZWFtcwhjbG91ZGFwcANuZXQAABwAAQ=="}
00670{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2633,"source":"teams.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1587041694221,"flow_last_seen":0,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":58,"flow_tot_l4_payload_len":58,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60837,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"c-flightproxy-euno-01-teams.cloudapp.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00575{"flow_id":77,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2634,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":234511,"pkt_caplen":176,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":176,"pkt_l4_len":142,"pkt":"KDc3AG3IEBMx8Tl2CABFAACixyFAADkR9tHAqAEBwKgBBgA17aUAjgAAn8+BgAABAAAAAQAAG2MtZmxpZ2h0cHJveHktZXVuby0wMS10ZWFtcwhjbG91ZGFwcANuZXQAABwAAcAoAAYAAQAAAA4AQARwcmQxDmF6dXJlZG5zLWNsb3VkwDEGbXNuaHN0CW1pY3Jvc29mdANjb20AfaP8PAAAA4QAAAEsAAk6gAAAADw="}
00692{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":2634,"source":"teams.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_first_seen":1587041694221,"flow_last_seen":1587041694234,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":134,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60837,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"c-flightproxy-euno-01-teams.cloudapp.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00426{"flow_id":76,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2637,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":262764,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0VplAAGwGdII0ck2IwKgBBgG77Jdw4z8APJqWp4AS\/\/+58wAAAgQFoAEDAwgBAQQC"}
00409{"flow_id":76,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2638,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":262870,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG9yfAqAEGNHJNiOyXAbs8mpancOM\/AVAQIADasgAA"}
00675{"flow_id":76,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2639,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":263191,"pkt_caplen":249,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":249,"pkt_l4_len":215,"pkt":"EBMx8Tl2KDc3AG3ICABFAADrAABAAEAG9mTAqAEGNHJNiOyXAbs8mpancOM\/AVAYIADbZQAAFgMBAL4BAAC6AwNemFWex6L93KvTNrWWS\/8PQ2rao\/9bFvV0yUUyu2nlvwAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAZQAAACgAJgAAI2FwaS5mbGlnaHRwcm94eS50ZWFtcy5taWNyb3NvZnQuY29tAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"}
00793{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2639,"source":"teams.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":4,"flow_first_seen":1587041694219,"flow_last_seen":1587041694263,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":195,"flow_tot_l4_payload_len":195,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":60567,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Teams","breed":"Safe","category":"Collaborative"},"tls": {"version":"TLSv1.2","client_requested_server_name":"api.flightproxy.teams.microsoft.com","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}}
00444{"flow_id":64,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2640,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":264118,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"KDc3AG3IEBMx8Tl2CABFAABBNJgAAGwR1ms0ck2IwKgBBg2WyeEALargAzk5ZGQ3NzNkLTE5NGQtNDI0MC04MzliLTMxMTIxNWQ3OGZjMw=="}
02369{"flow_id":76,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2641,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308351,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVptAAGwGbuA0ck2IwKgBBgG77Jdw40StPJqXalAQCAQlEAAAcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA0LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUenuMwc\/noMoc1Gv6++Ezww8aop0wHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQCGBg8ckx9UDTW7UZXC+1At9FP7A44gNWDP9CaNquKk0Ym4Hc6H0wUEGjC2TPH4ZMpVVvzoaDTGQwOYpaTTUvX3MEMOYKEG1Cvx9tqcsdP3yUB2L0u\/Y3lBDRRYTQjeuiKHInHCIKjjX\/QCOyzvB5\/C0exDQl9fWwS+qncho+mgAfK2IA8Fxzsv6+EtDoQ7Dvl6yGFB0IOq2h0mRJqrPawbpWi2DqNdE30PlqszN6KarfO3etdnYrpJGC2USn7nux+J+nU9mSFC0ZsLRlurcf+j5mIScxOoR1R1zgqZUwqnxhpp4P1IJVImICPzlelUrV+V7b3YppHp2Rgn\/+S4J10m17s2TbLTa97JGjEE\/3YQ7h5IdjwTnwuq1dP++rQhXt3FX3MOWAHLNAKjiWyKZFU6vIewI5Hi6y2fkjqSeRt4\/aWEgJvh20gdM0p+zqdmShg\/748CHucnl5Zm4aJe3RbjYEYoFcds8ex0ujMudADb\/QzGDXRU0vzS1rVbA4cYFxJP\/arXmxNmNaQws3ulhsztenPZhSi+YjcTSxMjLvyNTiFRWl6oPmD03juUR4abmC3Z6rh\/ORpnPJ\/Em03uuhRVjI2A+WVhItVGj\/kDERprkC2fKCqbcztcQMil\/Kk2WHT\/UliJtmxX7yjxKPFWCSC+MDNsBV3uBwoK+m\/VewoOUwAFuDCCBbQwggScoAMCAQICEAtqs7A+san2xGCSaqjN\/rMwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUyMzhaFw0yNDA1MjAxMjUyMzhaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKvl612jazme9TSIErsdUiZdfQkLxnmOq7cO3xmy3e4P9u70VuRG4pIP4mcL4xxxpNRBc7TLmRaOv3d9sK8ebO1xLsMId0pekq7sWtBIgdDF6aD1eo8ejV7TrZLA2saRNTEguTkEzRAqPJcdAJ6ZGBgJz0uX5Mn8APAMWp026LJAwUqshCiqPUYYK6eKrPSvS6h+SULHYiDA5qc7XeuQH7uK2JyQ4zqxbMKUzj4ya8txs0EuucXhXdhZJ4L74UgNfugE8fkBJ0H6lFp9xTC7trrXEZuI+gHMbkuSufh4PMucaJoWZojQk7Aqgy6XER1+gSBh5LC5m5xuU5WVIsbZvXUQutl1jDw\/HdCW+DNFe3sfVDPlSJenBSSi29Hcla4gKn2WiUh7knrQJLHeSBH3Zzy03\/hYYPVPezRo"}
02362{"flow_id":76,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2642,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308388,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVppAAGwGbuE0ck2IwKgBBgG77Jdw4z8BPJqXalAQCAQxsQAAFgMDFxgCAABVAwNemFWez81PLBKBZ\/ZpWXJH6TAXSuhpR6LjZ9O5\/Ib1biDUNwAAmksidY2QH9d8PFbA8ZxWhvJjR72URb6wfpIuXsAwAAANAAUAAAAXAAD\/AQABAAsADhsADhgACFowgghWMIIGPqADAgECAhN4ABOX6qx\/dbFtLnWXAAAAE5fqMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNDAeFw0yMDAzMjQwNDQ3MDZaFw0yMjAzMjQwNDQ3MDZaMCwxKjAoBgNVBAMMISouZmxpZ2h0cHJveHkudGVhbXMubWljcm9zb2Z0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5cPc7+ffK5nA0L4JgyJVHq5gssIfEdRmtC73dVI6zgnGtpT6f3nwYpTDAQKMlx6QsudSvJ2pakD8uGh72z+HfVZkUmpPe5HPUgy1w7rfw5LOkFR51Ypaumu6aB51uPVwr5ibsSYWY3hG5ucc\/Fn9\/HeGIvOHWZAl8Fv0RRb4k5k1AJpccrpd9E2zNB3GiJmtrMIXuhWVXnyfpngGQbH0SM6dSEdm8JZcHarOtVgxYQQG\/b1ODleAEzslbmo86WxY6Z1cSJq33dsyCLLLD7LqitPXTTIoJz3Pd3tcRV4T8gAVTyZBtgIeBCpt\/+d6nv5Dj3LOJiKm1ezIikFMa9YWECAwEAAaOCBA8wggQLMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdQCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAXEK5s89AAAEAwBGMEQCIGAcfPGmuUGLqlrtIZKVsZNpcprCDipXuImCLtIeofxOAiAJCiZ4ErCA5qX67EyXj01VyLmTNMWAvahgRq6K6zvqnwB2AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABcQrm0FYAAAQDAEcwRQIhAJKFCfeWNvf1IxKewyf4Xx8dQsiTrAwAumZ30GCkn7hZAiADsvQWiokkf8qqj+AUZjNgCqKxE\/Ch2mf8PRQt8JGvPQB3AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2AAABcQrmz2MAAAQDAEgwRgIhAJ1EiYGY8MIsWsVz++Q4MhHeZVQpPNpzqTWMVhZGWHu\/AiEAuZhwzU+0SjAULNYTIgEjQDfa3HJLPfxzSMnkXO0tRp0wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDQuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBQu7tiLoY1nJpN+\/JvokwgNNDQ88jALBgNVHQ8EBAMCBLAwLAYDVR0RBCUwI4IhKi5mbGlnaHRwcm94eS50ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2Nv"}
00425{"flow_id":76,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2643,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308504,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG9xvAqAEGNHJNiOyXAbs8mpdqcOM\/AYAQIAAzCwAAAQEFCnDjRK1w40pZ"}
00408{"flow_id":76,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2644,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308507,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG9yfAqAEGNHJNiOyXAbs8mpdqcONKWVAQH6XO8gAA"}
02372{"flow_id":76,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2645,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308535,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVpxAAGwGbt80ck2IwKgBBgG77Jdw40pZPJqXalAQCAQjKwAA5v2sJgi28yxD20\/EFtCbDHGHsQdrht2PoLH7ZtrYy+ny8GXljtgc6i+6LWTxXtAbULIMhUrPO8guKmp1jMCuXNnpwHx9fNqc471KsGAHgit9XcgQry5ijNya\/eHZuVlIl0Iaw1CBCx+DImvkm7wpIoL9gFFcdV8ONcLdfy96Z589jluMu6+d9MwM+6gfnSHB8+dSGl3OFFdtULhJ7rELJ9LiaScSbsbAJj7npCsbi1M4BvoahzrgS3+ZFk5ZPVlp8XGnZWUbAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUenuMwc\/noMoc1Gv6++Ezww8aop0wHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAEf5yBjohCjduyPUpIgJinkUO7foGn++\/niQ1F\/45iLK7AeF439GLl\/23d\/GKck9JOuizKdd0h+S58xdgh4iSVYK92X0TSH8GkDqJZuedlveVzWAP1+HK9nbu+ps1SKGYfdKTKk+BFseolrvRJfOmb1DaAJsqqPQ1AOP9LDvt5RWbfxYPx47JNiCU8B0BuRJQUJmB4ChCLI54\/+3GntXkyumgqrNIT6Rf5IsY\/xMCLZARNhhmKDoimt6V8Vnun20qF3WTUMMFEtXeZLS2vNvXdln+pdblVuH+Rlw7ivjsDvvvEpCRziASgbo8UuN\/40D0DEEgZocY2jJp4PbcjyjyvRYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBSf5XT0Ei8HGSR2kg+kjipmqRRaChgPMjAyMDA0MTQyMzM2NDJaMIGbMIGYMEwwCQYFKw4DAhoFAAQUIq8AHIB1Ygcm4MiTGuynQhwyEjoEFHp7jMHP56DKHNRr+vvhM8MPGqKdAhN4ABOX6qx\/dbFtLnWXAAAAE5fqgAAYDzIwMjAwNDE0MjMzNjQyWqARGA8yMDIwMDQxODIzMzY0MlqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNTIzMzY0MlowDQYJKoZIhvcNAQELBQADggEBAHwznQ\/hzUSTWHBxpAJ4aqKv6m7rJBDb4CqDYdLDNhXtlYpCM6n\/9QOn6NmbMjdDIBj9FUSZ3+FYTXyBqoGNyFjaZkIQtaPRye0L+rigTeedFQgBc7xiBZwIf7uKUP1iM1kq4X1XyEO\/\/2EhObdPM5\/pw8QcnTL9Qi+4CjnHQQl1Gx3KF7LkDBZyQW1QEjgdool1nso3yUbTT0\/3Os2JUrAC0nvMGlKPmmswqrT7zojqNgGv0aE\/W4IVLfm5r1yGJpMwE9FhdD3\/rZNT5GbtgiTS8Rbhmtu5zuCl7MUzU7dND8YiiTpQvKiZ2q4m0lzPoOoA+SpgmZZnCqQ4ojhQOdagggUjMIIFHzCCBRswggMDoAMCAQICE3gAErJ3YfnO2ox+\/bwAAAASsncwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy"}
00409{"flow_id":76,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2646,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308573,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG9yfAqAEGNHJNiOyXAbs8mpdqcONQBVAQIADI6wAA"}
02372{"flow_id":76,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2647,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308611,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUVp1AAGwGbt40ck2IwKgBBgG77Jdw41AFPJqXalAQCASA6AAAb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA0MB4XDTIwMDMxNTE1MzUzOVoXDTIxMDMxNTE1MzUzOVowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV80X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAEyAX+5SqsGiqoUBRMLbUF1MOQcsxK8kPSKDVxGywx62TXqosok\/w8WIw51eitl2x7hGoq0+h3f95iPllxy7yEMgH7qmedNRiuGxRK+fAa5MH9aVtlomaFyqBArysde41\/HXuL4UW4GtwiAkT5ExgE2wHYEV7T5X03YsAWWM3JKQwMjB+rXZkft+Uk5MWL\/cJto5+yML0QwJr2wL9Ak66bKsuEMnGd8UzoAOAp5Rk0DmxRztNTjl\/lZ2ntFXsAyJALx3q0EDreLw0q2SftDOieUHmNsOvbAPjYsWKtDXayhXR0gqkwAbamSUrmFXf6QE7XDQuHTRyG7d\/srUScNlDAgMBAAGjgdYwgdMwHQYDVR0OBBYEFJ\/ldPQSLwcZJHaSD6SOKmapFFoKMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFHp7jMHP56DKHNRr+vvhM8MPGqKdMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBQf\/nlSogs2KaMuQIKX+dZl6u\/fN4stOkBATIA+8WfgJ+qNyF20yCllnRhbqa4pd5JTrRYGJZhGA7agazmyim9wGvV0HcHxLLN3oNZBP5gF5jLC0IqxgJEvTiyy1\/1wYRdtr+SpcKNi2ZCac3x7voBvsf3YH\/f1jAp2zQ87qKhRy1PmcUkJdsJR2OnkYNgdR6oPKCsPkPve+qZXjBdfEVjq9duYM1IFFq0MYXUlFCy8YhnxEcasx4mCnA6B14O98ewaSZZhGaP6Py\/67LRhuWf36qXptvXI8bFJZEld25A5aR+COHvYWrlWmmfie3I9YEeDGTVodHmHxesLeBLQQmxpuZgnJ1eZYwSS2g4bPN+OSonsgPlHLzmBJcUpzxJl3mgtcjyN+2OgF46A4V1ENucCVGdLYjsbo\/kk6U7V0KiqERMGjIUeUVMt9tfNUf6xYXUsVOKsIfNcAMbDiCO2hf6q+1nKxCJw6p0qsB1ANlzJi00XH17tvsddvABkR26jQRxWpc1ck4l6ErNYoE186dUnlcdlKjaIHU4jQ4CS6fS1HuZFQD6VdPpfAFSv8BxzC46PHD4wMhUHF2gx9Kp9\/ATrborJ6OxeXVS1Ba+IQzGX6MpVsGiH22VzumR7tEvftwy0MX7pfN+X9yHBrJmVvFG4s6d6wUOHM9cT9DziFvLgAwAAWkDABhhBCVbEBe\/greGH8q+Bx9Slo8fHhKPnhHx4wGu6voLGdaXjVYg\/vc3XNqFmQ7O1kupVUMAVYE2YS4sQyUtE4pPdQ3MFnP0ghDVmAeHapntrn8OzRl90RZglKUNeMwZqB9h5gQBAQCtINfMnu1gMqI0WMe0p78Z4jPGCo71cBL5WvRy\/HZ5FIqKrQXTUZ\/JDDDH7\/VV3tZVfY\/GJvHVFZK+Ktw050lHxBJB2bLUwIHvgB6CRl1L8BC1dK3xtImBzoCslIZkLMk7dd9mkuX00vi1QvRDhK+X\/7b7M4ncbCP2oyKpWwamBg3tG56IzDtXuDU9ZYlbz7KlECXni94d"}
00563{"flow_id":76,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2648,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308613,"pkt_caplen":163,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":163,"pkt_l4_len":129,"pkt":"KDc3AG3IEBMx8Tl2CABFAACVVp5AAGwGdBw0ck2IwKgBBgG77Jdw41WxPJqXalAYCASinwAA4GKHnx+FKT4GOwbta3OHELM5eFeUfR1P8Mvmn7KM4L9S7DH6PDf+W9UTtqfn7Qy\/8\/fMvKXDbXORw+YgC9S4peUPAB9PsnXolxlLIrZRJY30pIn5X59MLsaRO1m9\/u42G6aFlecI6a48DgAAAA=="}
00410{"flow_id":76,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2649,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":308645,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAG9yfAqAEGNHJNiOyXAbs8mpdqcONWHlAQH8\/DAwAA"}
01427{"flow_id":64,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2650,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":326905,"pkt_caplen":795,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":795,"pkt_l4_len":761,"pkt":"KDc3AG3IEBMx8Tl2CABFAAMNNJkAAGwR0540ck2IwKgBBg2WyeEC+aecB1UVQ0I8M6FxU9jkNGUVrfYsu7yDLmG89ZSTvlNF5TpUlzTQ8G\/WoZAcduFrX9xwwsgTlyWR\/ZJXdWBPXcQKDMBDl8GHaw3lWitB0YSSDN\/6aj6wVTGssPy0SacuJz4PM485lC\/WpQEUg\/dwTCBKSb4sZpaN+b4fa4H63Sras9CRRkNNZX8Oo9eyIyZ3gqUv9gPVTI150j7g3RDPNpeJNlf85JSIyyePgyMPvxSZBMqkSilqp1nYF18Exoly8w9aSdwAwZImrCEE1FiGLxTlBeZR5SojZLildRr+USDoQk4aPiyQCz8uW6vXBZDAVScTmaYW4KeHzCPn1Zi5Z1D5ohg239NFCPP7p0w20EvQqZtbtw6YdY8FFZJ4Xjka3LlyJ0LqUH+CyBqrbB\/jfF+y+fX1zfSErh\/AtY\/SHoHzRUK3ptds98ieAen3ZuR2zX9OCRPVjiecyOb1JF5sRoUw\/Fg0RSBKhZH1fRsz5fI9R3e8DC\/QYF6HGWV1kuMhPh7vnQS3GA9w061KitjkHMdmB1O7EFgska2ph1S4NYSpXr9TmiS\/5YRKt09eo9iN2SjkJTb96gJStpSbNR\/tbZZRrH8bZODZsf7i3\/4S2mlJX9KHA8CaNu\/8hdp8pfDPEZ3ygGD\/G\/LmYqao4O\/cprao85GqyLmFi0fJKyD\/QOixF8jqWlPrfO+6l0217b9TQn22e3jScw4kcpjFpnMc9Exibi4Ka7ZxpjLsaCg3th\/eTjUhyYLe5f2OMo3hezY+\/hd+3gqV+axaOZ9DVnh0Oa\/IxOpvqVU4sDicawTrJAVg7xBYRMKpTnNFnt\/RJh5KkJRZLTMxPCIRwose2fhDQ\/0qv94wuRRujWSPz4LfVns\/mjvv9LOwg+aCsDOQj4NqAxYVlzysfVVXB6MT9pCHm8HRXlYWtA3+jSTKtcCBfysZ1ekXEmi0tG\/WUYPmN39o\/dbKs8XmGYfABSUkKMhZErAWH4pRMuDbO8vknAtW\/8ZIAEH0"}
00561{"flow_id":76,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2651,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":346651,"pkt_caplen":161,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":161,"pkt_l4_len":127,"pkt":"EBMx8Tl2KDc3AG3ICABFAACTAABAAEAG9rzAqAEGNHJNiOyXAbs8mpdqcONWHlAYIACaAAAAFgMDAGYQAABiYQQGSN+eS\/KFb8Ri+9QZUqm\/p+HJuiNYhjvW7ADwia6h\/rnvemPZfb2xkuVwO2i1nU8wXvu\/nQ+esfQAHxFC+8JpOowtnq+be6g\/jkMwCDoJVU1CwSWklPP5ZN6DxUWuPvI="}
00417{"flow_id":76,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2652,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":431149,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"KDc3AG3IEBMx8Tl2CABFAAAoVp9AAGwGdIg0ck2IwKgBBgG77Jdw41YePJqX1VAQCATaYwAAAAAAAAAA"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2658,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041694,"pkt_ts_usec":611281,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2658,"source":"teams.pcap","alias":"nDPId-test","type":38}
00963{"flow_id":64,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2659,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":96661,"pkt_caplen":459,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":459,"pkt_l4_len":425,"pkt":"KDc3AG3IEBMx8Tl2CABFAAG9NJoAAGwR1O00ck2IwKgBBg2WyeEBqR78BzFRC256ljiqGAOx7NuC0kMOISiV3n6Cx+OVY3CV14TLJWVP6sirMGK8dPJHKR+K+LulCFKJT3LCilqMdLkQQ+\/1Q0BNGLB4+UEh8DCu7cFDlpmLEL+p8+eVXA6bpMeDE+W4cFhOysPpu91TUTxZi\/SuaHB3foegEX4Nwu5HYl9vxmkfFgN8elnpYDwLX3Nhc\/1rYHbhcjJKP8OmypeFdWdeEojlTbF+idsDENwTYVc9oIqOAY9o2187d\/+gitOuPcY2u24liZKUCWhC6b4TaDA8N5aW2kPLg4cZQ5TgvwUJzFfAzJaxnjTrqL6fo337kbBSZARHmCbWw6d9dKzUJk+\/4WdiACJUTI3acWG7qcvT\/JapM2u3drPOaz2qrx4SYsAj2G+k\/e0\/eIrAkLfPaq6UFfI3g3Wf\/iGxHi9ZDhRV9HyF97akUFZ8oL1udGFlSo1L\/TLzy3JJdW3txiJCoctEiP2XectUF1XkqQ71cMA5Y872zuCRepP\/YFDkK8ohFtS4svEtTuKMBY6j4c81dG2gYLhr7ghcnqnOkc\/3KXc4"}
00444{"flow_id":64,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2660,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":97624,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"EBMx8Tl2KDc3AG3ICABFAABBKVQAAEARDbDAqAEGNHJNiMnhDZYALb7kAzM3NDM4ZWNlLWQ1NmMtNDFjNy1hMTZjLTQ3M2QyM2ZjNWU3YQ=="}
00617{"flow_id":64,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2661,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":97646,"pkt_caplen":203,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":203,"pkt_l4_len":169,"pkt":"EBMx8Tl2KDc3AG3ICABFAAC96aQAAEARTOPAqAEGNHJNiMnhDZYAqZXIBl3+t6o2WT+OKw\/oTFMopouEH4gbE0oRDnfWSnKbiyKA1UFShjfP9XQMr3SuktBSg1fr9\/Cv\/\/M0m+iLV\/dO3k6aT89fa6A5A3fRXT6CWOsUW+zzpL9t2NYyp4ILTyhEca0jB07mOJmmtnQSS9730zSyT7ohVjIYmPNHU1Xc22zVUEHiNv5tw+qb5rATPwWbZIu65v4RMfw\/EGgkViIlMBU="}
01834{"flow_id":64,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2662,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":266056,"pkt_caplen":1099,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1099,"pkt_l4_len":1065,"pkt":"KDc3AG3IEBMx8Tl2CABFAAQ9NJsAAGwR0mw0ck2IwKgBBg2WyeEEKflMB9ibKDPiSDb+odHTLUFZkznbbNX+J75f4EKLo2v0jCX9AvnGgnVouaqfXtzVQexQAc1YLo9VPn1LnUy8C7YtiqmZA3\/Ycz29Q47Bpz7+p7QpPt6afnEOkBNbHEYWCCM+cq9EqFlbk9xc5YxsB8NIXcrytxDWz107+fOlbAP13E3AQrUoBlqIIil7ONM2N7g\/p\/vOe7i+nBW6l5WsxqWBzGz5Z5SICVeaiJoijcw2GNy5+jpe+kX08oNLuVfb\/NcVKqJ7Die4rlf9+C0PChMRQfilNjUjoWrkB9otn9V6wwExztequjn7uHyTieBqABT4hA3ockTP4mHSvE6G8V1bBtnrjKgYUZcKyYHBZc2DUmMKgTtwVTI2lk2Ea4gNMhCkUI7CNsEhyXwHoIhlVmQ7onfB6Jc+F0jJSdcmF1yTybA\/5lqI+deTAFxg2\/aAnHDrqjSP5cORcUVkW46ncl8M7JV\/nscb7XMxRyI5n6mWYtVbf3Iv0sH\/o91BzYkFqHjiUvwg7REoM83Gmj0VgUKSoRgtaN6\/cmfPC0E3oNeNP8ahVyhxTk7Ca1HKX1Yu6RBSNA1aX5zVIz838T7cv8L6hG+iUFfvjecGsexC4eODgN3nDBC91YpnOOWUos+a4eFAQrc4NrPsKniLHhpePKN6WiIkebuyLDcfO9FHlcZFCJ5gTOXtRUyqf1p4fAbrNUhPFcauPNjp\/B85U054L82CiNU\/jFCTJ3qAPXoONXavaAeymRDmy8BAcJ4d7r4d06TQNZzAXQm2MBDzFf7+x3tbuHDGcjO7RoRMhJgKaAdXFjXWtVnAfkIzgslTHMFtjC1R9tDE4kIOpSZEOWpvFdvU0uVqpRJH8ubukf84dzqEyIDsjGztiC+J0gZX5b0oZVrQdmwydICESBjOc9j1c\/oF+inRp\/lgoaRIfqSs+TaCQv\/XuP5OyyrUr9NRFJbSrec0dnvPYIFeN69MqRRxwdMf6pNO+W0eiTsAmVR3\/mRnbyfLfzYSH4LU\/McDNvqvrWe+3gopqgFDOthv\/drY026C7XUxgMnxISnEt5j6+J1hnjP45lGL\/PpwjCQfzk\/2QrUr8qNxxBiFFT7ei6ujcr9Z4Udrk4490KsI66pR6Au6hZHyLGUcAwME9WkeaItuTSDZSY1hy5SJdkooAg34C0Uf4ikN8uhL4eHQY4pTyaUjOulk7o1b9\/XiUpUyggJ4jF+ZtuPdSg98uOUKlaLEDJhEfxy5hCwAjhXB2GTYcleyj8HZClU0UU1+3sZMQQ0x9vuwGJ1w1xw9yJfsGlVpVNL139cr0Zf+un4U8owBnI2QVbk9FV6koX\/eF+3WBbOIl6azfwspFauN09SX1VriWH6aV2RSN3QYNWsI\/EMJmca6gEVuzDU\/NDsSiPyuKcUkBhWe8w=="}
00446{"flow_id":64,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2663,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":267528,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"EBMx8Tl2KDc3AG3ICABFAABBBqUAAEARMF\/AqAEGNHJNiMnhDZYALR2vA2RlNzNhMDFmLTQ3NmQtNDQ3NC1hNzliLTMxM2VmOGRmNjI0ZQ=="}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2665,"source":"teams.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1587041695278,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50016,"dst_port":50005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00550{"flow_id":78,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2665,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":278787,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMhisAAEARcdvAqAEGwKgABMNgw1UAeNtRAAEAXCESpELGQpqANK6irJWNCoEABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUNaR7w6XgHLmtRZxpBWKVkGuwhq2AKAAE+3W4lQ=="}
00575{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2665,"source":"teams.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1587041695278,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50016,"dst_port":50005,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2666,"source":"teams.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1587041695278,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50036,"dst_port":50020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00551{"flow_id":79,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2666,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":278905,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMZ7QAAEARkFLAqAEGwKgABMN0w2QAeBWjAAEAXCESpEJMnOcpR8XuRjfgdwcABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUZBvpMZrPL2uguq2xDA1A6CBjF+2AKAAEncV\/3g=="}
00575{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2666,"source":"teams.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1587041695278,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50036,"dst_port":50020,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.Teams","breed":"Safe","category":"VoIP"}}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2667,"source":"teams.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1587041695305,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16332,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00551{"flow_id":80,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2667,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":305290,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"KDc3AG3IEBMx8Tl2CABFAACMbOkAADURirVdR27NwKgBBj\/Mw2AAeJv\/AAEAXCESpEJpQfrkOEmJN4IqUAgABgAJRlkzMjpvNS9JAAAAgCkACAAAf+1eBY4AgHAABAAAAAeANgAEAAAAAQAkAARu\/\/3+gDcABAAAAAIACAAUCA60OBRrDjRc1P+cP0BpsLC+QjmAKAAEPxxxZQ=="}
00587{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2667,"source":"teams.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1587041695305,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16332,"dst_port":50016,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.SkypeCall","breed":"Acceptable","category":"VoIP"}}
00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2668,"source":"teams.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1587041695305,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16333,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00551{"flow_id":81,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2668,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":305879,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"KDc3AG3IEBMx8Tl2CABFAACM2aMAADURHftdR27NwKgBBj\/Nw3QAeFT\/AAEAXCESpEKjF0z2+O91Jw0PY1cABgAJK21JdjpKRndqAAAAgCkACAAAf+1eBY4AgHAABAAAAAeANgAEAAAAAQAkAARu\/\/3+gDcABAAAAAIACAAUo4jart22gVLrHF0JHGaI64vA9HeAKAAEUHwvEg=="}
00587{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2668,"source":"teams.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1587041695305,"flow_last_seen":0,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":112,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16333,"dst_port":50036,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.SkypeCall","breed":"Acceptable","category":"VoIP"}}
01662{"flow_id":63,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2669,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":309999,"pkt_caplen":975,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":975,"pkt_l4_len":941,"pkt":"EBMx8Tl2KDc3AG3ICABFAAPBAABAAEAG9oDAqAEGp2PXpOyWEVIVrYR7NJWK64AYEACfCgAAAQEICjCE3\/cTeUK5FwMDA4gePBs\/C2EWBhPnt9rTOeXlSRdCMdWlZ2hh1ujeyOz+vtQgRyqCjB7KcrqhhBcxiY09Yi+fzRdUCWlCMJFUYL5wD58NG6SGlo0m3MhaTL91MJQpfXPSARG\/okUk3oikkWt2Y9HD7HWNcYWFF0yvbFjLzDgm5QxcwuP3SstmF+R9Q87mOgyoEIHcDEqqNgi6j3pUupR9xSOWXujI\/V+\/BlZwv+zlPIs4KeSyM6oQ3qSZLgQiKW0gIsjlC5tRTmglZXFCqVTYU7oid1B4d5\/QkMDGDfXVCom\/BfWLGl3fbPSsbpp49\/NF2u8dWirTFY74SFjQS\/S3kzcGU\/EURpKpFaL431RKZO+KTpeiknpknGjGhBqsrcG4UOorL4fICHt66HlO0wlyO\/vUlCotPVii5tIdtVQgenz8KMwH2eVEV8C43IdapCIHC9+dc1+ey0Vz5WVQ+3GcEYSOZupnBqfrs4fecnDXp6mseSbm6JfxpHVS5morMgrwggHinCmCYoICGC9jqCWuW910945bwzfBoidpMmIacF5WtPa41f3kMjr5YXpF3rcJxYphmKNQeL3pUK0fCdiaZpaSr5FXuhwxFxXRVxQydXgrg5XmpNfVgHwgjFcwfEHgPD3zmR2JN0JdFYiuhlBpc3qSK8uRgWqnshsw6vxTKE3ZVA4tDuoS\/Hc8CY5vVN9QF1cOUcCIqBRAFJbe074Emz1iwrUi9Gfh4CX8kowsqRlDLnSk2nZES+96m\/tjoELojBJTfZhS2lXlq\/B7uDRBXaPBDHITtXVzChOFETwLwNxn9QfNV\/pxPiA5l6XeaebaDQcoLNGKVOfGe2AwHZHtb\/CYi2KRPrdcUjBOEX1kTcpS8P2a6eDnlp\/TrfacOzcAGFN5jHF1c3+g12vlHy8Xd+pNKjm+Q9b7nUwRqFM31CC4ycvN230wK7pDN280O01BngHaKLuB7lKV7r45KfubnyWwOef2C\/zXz4dgkFQuivCiWJOp0xpKvobvUbfCmGGrb97acBiKLo5IEfn0S5+7i9oNt0XV2Pt9yu7iLVzZI26qTDOQ8HM6NBeNXRl5NWQHESYXo23gzSvuwl0sBlZMsvMjSezPfTTq3TDzB8k0OTld7SjweAtyrY4v4AyqPPu4oCABh95kVfnqrl\/GPUJMQqFKTpOo3eG7KkBBEe4LPXMLyu7nJ\/wA3\/VWsVyGsDoSb\/Gu"}
00515{"flow_id":80,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2670,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":330085,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB0TLUAAEARoAHAqAEGXUduzcNgP8wAYAttAQEARCESpEJpQfrkOEmJN4IqUAiAcAAEAAAABwAgAAgAAR7efFXKj4A3AAQAAAACgDYABAAAAAEACAAUlU+ROI4McMZBUuZSU8\/gWyGrdx6AKAAE+OcqVw=="}
00551{"flow_id":80,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2671,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":330306,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMkXkAAEARWyXAqAEGXUduzcNgP8wAeAk2AAEAXCESpEL9LF5WbGc54yQwO\/cABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAU1YbVJoGA61aUBne1Qcfqud7BOGOAKAAEmnK+Jw=="}
00514{"flow_id":81,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2672,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":330316,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"EBMx8Tl2KDc3AG3ICABFAAB0gkYAAEARanDAqAEGXUduzcN0P80AYEblAQEARCESpEKjF0z2+O91Jw0PY1eAcAAEAAAABwAgAAgAAR7ffFXKj4A3AAQAAAACgDYABAAAAAEACAAUNbjIzLk8Htcx5rlGPdUzB6Mtkf+AKAAECmy4uA=="}
00552{"flow_id":81,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2673,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":330389,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMX9EAAEARjM3AqAEGXUduzcN0P80AeEAgAAEAXCESpEJvsFtMkRg8G\/ztdLwABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUIVL6+UU6k643kpe64\/MzitD9Q4eAKAAEwjOytg=="}
00769{"flow_id":70,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2674,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":381451,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEsaPwAAEARIBfAqAEGNHL6jcNgDZYBGBOdAAQA\/CESpEIsNFIeR67x\/KSTudUADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP8xdR27NABMAfAABAGghEqRCH9y33u2t\/jYyT2+1AAYACW81L0k6RlkzMgAAAIAqAAgAAH+KUoZYAIBwAAQAAAAHgDYABAAAAAEAJAAEbv\/4\/4CVAAh\/IMTdT4SN+oA3AAQAAAACAAgAFLkI9+jCSAoSd\/OOXciVMXiIrqbdgCgABLPHZEgACAAg7sRmb8sPDDsK8L9wIx7c4\/un3a7csABeHu5jm1wMzFk="}
00764{"flow_id":72,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2675,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":381585,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEsXTYAAEARK+HAqAEGNHL6icN0DZYBGMK2AAQA\/CESpEIeamDBSEqcaMKGtFYADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP81dR27NABMAfAABAGghEqRCa6gY9jQ3F4QYLRqEAAYACUpGd2o6K21JdgAAAIAqAAgAAH+KUoZYAIBwAAQAAAAHgDYABAAAAAEAJAAEbv\/4\/4CVAAhb5VsGDC2J+oA3AAQAAAACAAgAFGPigS6EUGSGggUbRbFSk1APqJ0agCgABKpfQ2cACAAguGTqGqFZLfExfohAPRW3NYW9D0LDg15vdpj82BiyuIs="}
00426{"flow_id":63,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2676,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":385416,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0HBdAADQG6fanY9ekwKgBBhFS7JY0lYrrFa2ICIAQAfVqPgAAAQEIChN5Sr8whN\/3"}
00608{"flow_id":70,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2677,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":389155,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC4fJgAAGwR4O40cvqNwKgBBg2Ww2AApNd+ARUAiMLWdk9T8dgTMFhVlH2+EmsADwAEcsZLxgASAAgAAT\/MXUduzQATAHAAAQBcIRKkQpOT7iqoT5owckEG1gAGAAlGWTMyOm81L0kAAACAKQAIAAB\/7V4FjgCAcAAEAAAAB4A2AAQAAAABACQABG7\/\/f6ANwAEAAAAAgAIABQwsyB\/3AcVNGFmgIYtfHOO0Vm54oAoAAR90b9H"}
00609{"flow_id":72,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2678,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":389378,"pkt_caplen":198,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":198,"pkt_l4_len":164,"pkt":"KDc3AG3IEBMx8Tl2CABFAAC4VxkAAGwRBnI0cvqJwKgBBg2Ww3QApCdjARUAiE\/LrilDXPJWtp6yDikzcPIADwAEcsZLxgASAAgAAT\/NXUduzQATAHAAAQBcIRKkQlPk9TFAsI2GK+OZoAAGAAkrbUl2OkpGd2oAAACAKQAIAAB\/7V4FjgCAcAAEAAAAB4A2AAQAAAABACQABG7\/\/f6ANwAEAAAAAgAIABQqoNaJl5j6Qph3wmShySpejyG1ZYAoAAR\/OzfK"}
00516{"flow_id":80,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2679,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":406639,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB0Bd0AADUR8dldR27NwKgBBj\/Mw2AAYJiUAQEARCESpEL9LF5WbGc54yQwO\/eAcAAEAAAABwAgAAgAAcHVcadqCoA3AAQAAAACgDYABAAAAAEACAAUfLZK4Jp9GCnUwepSRXJ0QYfNKUiAKAAEeKXxaw=="}
00516{"flow_id":81,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2680,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":407379,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB0iYEAADURbjVdR27NwKgBBj\/Nw3QAYAIVAQEARCESpEJvsFtMkRg8G\/ztdLyAcAAEAAAABwAgAAgAAc5scadqCoA3AAQAAAACgDYABAAAAAEACAAUt0fBakPBlSed9Q+UJ+6ZvN9VvN+AKAAELvJkIw=="}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2681,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":413161,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2681,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2682,"source":"teams.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1587041695421,"flow_last_seen":0,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.21","dst_ip":"192.168.1.6","src_port":3480,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00565{"flow_id":82,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2682,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":421892,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"pkt":"KDc3AG3IEBMx8Tl2CABFAACYUPwAAGwRCyM0cvwVwKgBBg2Yw3QAhCaSAAEAaCESpEK59F1PLtIJs2rQCYoABgAJK21JdjpKRndqAAAAgCkACAAAf+1eBY4AgHAABAAAAAeANgAEAAAAAQAkAARu\/\/n+gJUACGUfNM4ueRX8gDcABAAAAAIACAAUDNg3puCxSSnyiCvs+zLb4wfWy9WAKAAEDuovdw=="}
00586{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2682,"source":"teams.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1587041695421,"flow_last_seen":0,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.21","dst_ip":"192.168.1.6","src_port":3480,"dst_port":50036,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.SkypeCall","breed":"Acceptable","category":"VoIP"}}
00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2683,"source":"teams.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1587041695422,"flow_last_seen":0,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.8","dst_ip":"192.168.1.6","src_port":3479,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00565{"flow_id":83,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2683,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":422685,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"pkt":"KDc3AG3IEBMx8Tl2CABFAACY4AMAAG0Reyg0cvwIwKgBBg2Xw2AAhBBVAAEAaCESpEKBJ1p+KLNk2I89FPkABgAJRlkzMjpvNS9JAAAAgCkACAAAf+1eBY4AgHAABAAAAAeANgAEAAAAAQAkAARu\/\/n+gJUACN6qKWcI9wj8gDcABAAAAAIACAAUyAS6wVT6GpHQ1gnRXe5kbQ9LDuWAKAAEokvlFA=="}
00585{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2683,"source":"teams.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1587041695422,"flow_last_seen":0,"flow_min_l4_payload_len":124,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":124,"flow_avg_l4_payload_len":124,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.8","dst_ip":"192.168.1.6","src_port":3479,"dst_port":50016,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"STUN.SkypeCall","breed":"Acceptable","category":"VoIP"}}
00716{"flow_id":70,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2684,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":432593,"pkt_caplen":278,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":278,"pkt_l4_len":244,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEIQwIAAEARRjXAqAEGNHL6jcNgDZYA9FdMAAQA2CESpEKfui7uErrywVVZDhwADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP8xdR27NABMAWAEBAEQhEqRCk5PuKqhPmjByQQbWgHAABAAAAAcAIAAIAAEe3nxVyo+ANwAEAAAAAoA2AAQAAAABAAgAFFFp\/EIw9m0w0dRwmYyqML3\/iSKPgCgABN8vUt8ACAAgqGRf4o8r70c+bwbjLKjnyOxfHW\/RCLgda6bT0E3pUpo="}
00534{"flow_id":83,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2685,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":432665,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"EBMx8Tl2KDc3AG3ICABFAACA0aoAAEARtpnAqAEGNHL8CMNgDZcAbO2O\/xAAYN6qKWcI9wj8AQEARCESpEKBJ1p+KLNk2I89FPmAcAAEAAAABwAgAAgAASyFFWBYSoA3AAQAAAACgDYABAAAAAEACAAUmYtT\/sgffZE\/GPjMTGRSk5h1N+2AKAAEPqesNg=="}
00768{"flow_id":70,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2686,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":432806,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEsslcAAEAR1rvAqAEGNHL6jcNgDZYBGA46AAQA\/CESpEKGfpR3I6Wm38Zk7TUADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP8xdR27NABMAfAABAGghEqRCH9y33u2t\/jYyT2+1AAYACW81L0k6RlkzMgAAAIAqAAgAAH+KUoZYAIBwAAQAAAAHgDYABAAAAAEAJAAEbv\/4\/4CVAAh\/IMTdT4SN+oA3AAQAAAACAAgAFLkI9+jCSAoSd\/OOXciVMXiIrqbdgCgABLPHZEgACAAg4ni\/MyGpn0IPPfamZXcwXcyTP9hFKqNf3gjYqNKVXl0="}
00714{"flow_id":72,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2687,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":433232,"pkt_caplen":278,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":278,"pkt_l4_len":244,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEIB74AAEARgX3AqAEGNHL6icN0DZYA9JXXAAQA2CESpEJpchKVO4fonPIh+aAADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP81dR27NABMAWAEBAEQhEqRCU+T1MUCwjYYr45mggHAABAAAAAcAIAAIAAEe33xVyo+ANwAEAAAAAoA2AAQAAAABAAgAFKSOPm9ycNiS3mJyX4fapy4vEu1\/gCgABIqjvoYACAAg+pL5K0Lk7MyR0ZqbhlMFnDsKGKI3TTZKmRHPJasNnPQ="}
00532{"flow_id":82,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2688,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":433333,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":142,"pkt_l4_len":108,"pkt":"EBMx8Tl2KDc3AG3ICABFAACAFs8AAEARcWjAqAEGNHL8FcN0DZgAbMYz\/xAAYGUfNM4ueRX8AQEARCESpEK59F1PLtIJs2rQCYqAcAAEAAAABwAgAAgAASyKFWBYV4A3AAQAAAACgDYABAAAAAEACAAUb+d2GMvNHhGxBtT1sjJNLSVYAvSAKAAEqoFJXQ=="}
00764{"flow_id":72,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2689,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":433459,"pkt_caplen":314,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":314,"pkt_l4_len":280,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEsR2QAAEARQbPAqAEGNHL6icN0DZYBGOj5AAQA\/CESpELTjfKyZNTNUCzFgVAADwAEcsZLxoAIAAQAAAAGAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8ABEACAABP81dR27NABMAfAABAGghEqRCa6gY9jQ3F4QYLRqEAAYACUpGd2o6K21JdgAAAIAqAAgAAH+KUoZYAIBwAAQAAAAHgDYABAAAAAEAJAAEbv\/4\/4CVAAhb5VsGDC2J+oA3AAQAAAACAAgAFGPigS6EUGSGggUbRbFSk1APqJ0agCgABKpfQ2cACAAgUB2ZPqsXXGYjBv8pRG+HEjCK6R8QdiEsnAYTs3tf1IE="}
00573{"flow_id":70,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2692,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":487462,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"KDc3AG3IEBMx8Tl2CABFAACgfJkAAGwR4QU0cvqNwKgBBg2Ww2AAjOyBARUAcKB5W+zxYEZI0BvFP4MTXuMADwAEcsZLxgASAAgAAT\/MXUduzQATAFgBAQBEIRKkQh\/ct97trf42Mk9vtYBwAAQAAAAHACAACAABLIoVYF7PgDcABAAAAAKANgAEAAAAAQAIABQu4nbMkN65GU2342ZGB1HTuyfL4oAoAASbSS9w"}
00572{"flow_id":72,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2693,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":489389,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"KDc3AG3IEBMx8Tl2CABFAACgVxoAAGwRBok0cvqJwKgBBg2Ww3QAjPtSARUAcHDIdy6ELI5VgNlGYLKQR0cADwAEcsZLxgASAAgAAT\/NXUduzQATAFgBAQBEIRKkQmuoGPY0NxeEGC0ahIBwAAQAAAAHACAACAABLIoVYF7LgDcABAAAAAKANgAEAAAAAQAIABQmkyqTHQT6T56Pujrgj0IEPNmqmoAoAATGhbwj"}
00550{"flow_id":78,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2696,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":586059,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMZh4AAEARkejAqAEGwKgABMNgw1UAeNtRAAEAXCESpELGQpqANK6irJWNCoEABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUNaR7w6XgHLmtRZxpBWKVkGuwhq2AKAAE+3W4lQ=="}
00552{"flow_id":79,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2697,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":586146,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMyucAAEARLR\/AqAEGwKgABMN0w2QAeBWjAAEAXCESpEJMnOcpR8XuRjfgdwcABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUZBvpMZrPL2uguq2xDA1A6CBjF+2AKAAEncV\/3g=="}
00574{"flow_id":70,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2698,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":591686,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"KDc3AG3IEBMx8Tl2CABFAACgfJoAAGwR4QQ0cvqNwKgBBg2Ww2AAjP\/jARUAcEsH9LrSqS+R0AO4vj8MjjMADwAEcsZLxgASAAgAAT\/MXUduzQATAFgBAQBEIRKkQh\/ct97trf42Mk9vtYBwAAQAAAAHACAACAABLIoVYF7PgDcABAAAAAKANgAEAAAAAQAIABQu4nbMkN65GU2342ZGB1HTuyfL4oAoAASbSS9w"}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2699,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":611288,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2699,"source":"teams.pcap","alias":"nDPId-test","type":38}
00573{"flow_id":72,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2700,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":621161,"pkt_caplen":174,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":174,"pkt_l4_len":140,"pkt":"KDc3AG3IEBMx8Tl2CABFAACgVxsAAGwRBog0cvqJwKgBBg2Ww3QAjH\/oARUAcJSaToyZriiQZEEn466yVrgADwAEcsZLxgASAAgAAT\/NXUduzQATAFgBAQBEIRKkQmuoGPY0NxeEGC0ahIBwAAQAAAAHACAACAABLIoVYF7LgDcABAAAAAKANgAEAAAAAQAIABQmkyqTHQT6T56Pujrgj0IEPNmqmoAoAATGhbwj"}
00550{"flow_id":78,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2701,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":890424,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACM6boAAEARDkzAqAEGwKgABMNgw1UAeNtRAAEAXCESpELGQpqANK6irJWNCoEABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUNaR7w6XgHLmtRZxpBWKVkGuwhq2AKAAE+3W4lQ=="}
00551{"flow_id":79,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2702,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041695,"pkt_ts_usec":890513,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMMbQAAEARxlLAqAEGwKgABMN0w2QAeBWjAAEAXCESpEJMnOcpR8XuRjfgdwcABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUZBvpMZrPL2uguq2xDA1A6CBjF+2AKAAEncV\/3g=="}
00550{"flow_id":78,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2707,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":194345,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMXPIAAEARmxTAqAEGwKgABMNgw1UAeNtRAAEAXCESpELGQpqANK6irJWNCoEABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUNaR7w6XgHLmtRZxpBWKVkGuwhq2AKAAE+3W4lQ=="}
00551{"flow_id":79,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2708,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":194432,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMFBgAAEAR4+7AqAEGwKgABMN0w2QAeBWjAAEAXCESpEJMnOcpR8XuRjfgdwcABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUZBvpMZrPL2uguq2xDA1A6CBjF+2AKAAEncV\/3g=="}
00550{"flow_id":78,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2709,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":498337,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMrv0AAEARSQnAqAEGwKgABMNgw1UAeNtRAAEAXCESpELGQpqANK6irJWNCoEABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUNaR7w6XgHLmtRZxpBWKVkGuwhq2AKAAE+3W4lQ=="}
00553{"flow_id":80,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2710,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":498551,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"EBMx8Tl2KDc3AG3ICABFAACQu2oAAEARMTDAqAEGXUduzcNgP8wAfBKsAAEAYCESpEKyalJ26c+bCI1C0PUABgAJbzUvSTpGWTMyAAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAlAAAAJAAEbv\/+\/4A3AAQAAAACAAgAFNd7wOvI0gzaWL0JHAJmvaCW1OcegCgABLiDaXI="}
00551{"flow_id":79,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2711,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":498651,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"pkt":"EBMx8Tl2KDc3AG3ICABFAACMPIAAAEARu4bAqAEGwKgABMN0w2QAeBWjAAEAXCESpEJMnOcpR8XuRjfgdwcABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAkAARu\/\/7\/gDcABAAAAAIACAAUZBvpMZrPL2uguq2xDA1A6CBjF+2AKAAEncV\/3g=="}
00553{"flow_id":81,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2712,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":498784,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"EBMx8Tl2KDc3AG3ICABFAACQSB8AAEARpHvAqAEGXUduzcN0P80AfNVTAAEAYCESpEKDWwnX0gcAJk8k2boABgAJSkZ3ajorbUl2AAAAgCoACAAAf4pShlgAgHAABAAAAAeANgAEAAAAAQAlAAAAJAAEbv\/+\/4A3AAQAAAACAAgAFPLvVpmLRoXR+XSjZzwE+pIZjkn7gCgABO2z0lM="}
00515{"flow_id":80,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2713,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":573676,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB0Vi4AADURoYhdR27NwKgBBj\/Mw2AAYGMtAQEARCESpEKyalJ26c+bCI1C0PWAcAAEAAAABwAgAAgAAcHVcadqCoA3AAQAAAACgDYABAAAAAEACAAUTaPAXiqXttOIXVsgmCJWtNuFFMWAKAAEjgd9gw=="}
00515{"flow_id":81,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2714,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":574201,"pkt_caplen":130,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":130,"pkt_l4_len":96,"pkt":"KDc3AG3IEBMx8Tl2CABFAAB0IwoAADUR1KxdR27NwKgBBj\/Nw3QAYHcAAQEARCESpEKDWwnX0gcAJk8k2bqAcAAEAAAABwAgAAgAAc5scadqCoA3AAQAAAACgDYABAAAAAEACAAUw6PYcnYrotsM1O+VvNKE3YekJS+AKAAETRcPqA=="}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2715,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041696,"pkt_ts_usec":611304,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2715,"source":"teams.pcap","alias":"nDPId-test","type":38}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2730,"source":"teams.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1587041697061,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60568,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00441{"flow_id":84,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2730,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":61972,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGxpHAqAEGKE+KKeyYAbtVmTcwAAAAALAC\/\/8wcwAAAgQFtAEDAwUBAQgKMITmwQAAAAAEAgAA"}
00436{"flow_id":84,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2731,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":91344,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8X+VAAG4GOLAoT4opwKgBBgG77Jhhqm+9VZk3MaASIADeAQAAAgQFoAEDAwgEAggKC\/ZmGDCE5sE="}
00423{"flow_id":84,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2732,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":91452,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyYAbtVmTcxYapvvoAQEAkclQAAAQEICjCE5t4L9mYY"}
00748{"flow_id":84,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2733,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":92026,"pkt_caplen":305,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":305,"pkt_l4_len":271,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEjAABAAEAGxa7AqAEGKE+KKeyYAbtVmTcxYapvvoAYEAlljAAAAQEICjCE5t4L9mYYFgMBAOoBAADmAwMvt9\/l19PgHHhBJ7fePZ9nkIIpM9PqvMR3RuXFQQr78gAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACV\/wEAAQAAAAAXABUAABJnYXRlLmhvY2tleWFwcC5uZXQAFwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAM3QAAAASAAAAEAAwAC4CaDIFaDItMTYFaDItMTUFaDItMTQIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xAAsAAgEAAAoACgAIAB0AFwAYABk="}
00761{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2733,"source":"teams.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":4,"flow_first_seen":1587041697061,"flow_last_seen":1587041697092,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":239,"flow_tot_l4_payload_len":239,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60568,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"gate.hockeyapp.net","ja3":"a69708a64f853c3bcc214c2c5faf84f3","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
02350{"flow_id":84,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2734,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123566,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUX+dAAG4GMxYoT4opwKgBBgG77JhhqnVeVZk4IIAQBAXnDAAAAQEICgv2ZjgwhObedGlvbmluc2lnaHRzLmF6dXJlLmNvbYISZ2F0ZS5ob2NrZXlhcHAubmV0ghVkYy50cmFmZmljbWFuYWdlci5uZXSCH2F1c3NlLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHmJyenMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdY2NhLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWNmci1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1jaW4tYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdY2tvLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWN1cy1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh9jdXMwMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1lYXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdZWF1LWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHWVqcC1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1ldXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDItYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDQtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIfZXVzMDUtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIeZXVzMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh5uY3VzLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHW5ldS1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh5zYWZuLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHnNjdXMtYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdc2VhLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHXN1ay1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh1zd24tYnJlZXppZXN0LWluLmNsb3VkYXBwLm5ldIIdd2V1LWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCH3dldTAyLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCH3dldTAzLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCHXd1cy1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0gh53dXMyLWJyZWV6aWVzdC1pbi5jbG91ZGFwcC5uZXSCIHd1czIwMi1icmVlemllc3QtaW4uY2xvdWRhcHAubmV0MIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAJWTZzx1MK5GdVXHHDNo4UfZmpqNSZyuP+i0NBu9AKrV3sQoq5pmeYJ7vP+oV2p39mLTb2oqM52AGvlnpmoTNJwN7XVFBPYI8jrT6ZwWv1hAZa"}
02368{"flow_id":84,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2735,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123656,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUX+ZAAG4GMxcoT4opwKgBBgG77Jhhqm++VZk4IIAQBAVyJQAAAQEICgv2ZjgwhObeFgMDGyQCAABVAwNemFWhbnl7WUqfYm1R+o3Ql0XAiScTRcea89UxKH+n8yCpFQAAQf+OsMwa2a86lyxGKjOde+fqEWJ1inJtKjMpocAoAAANAAUAAAAXAAD\/AQABAAsAEkcAEkQADIYwggyCMIIKaqADAgECAhNuABQ+IygxVnX+3gt8AAAAFD4jMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0yMDAzMTcyMTQ2MTRaFw0yMjAzMTcyMTQ2MTRaMCcxJTAjBgNVBAMTHGRjLnNlcnZpY2VzLnZpc3VhbHN0dWRpby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTjRhywpCP09kk\/FUbRL0JHcwFbXYrKO+yEnwFM3rPYCWH\/N3ytkgm55W3De9R7TQ4nG6hXjvu49n3GFbb7tzgjX4oUgzhxxZTMBnakqeLogod6D5ZdDfokss9bp+ils6rtyCJ2XgEKGa5\/c8Mrrd6rtcviCMBXmgB2qxkza1z3wKmopsTvC\/wZ3Plw8ddfnLBdhAtnPdFwhZLXumxfbNwCtNzeqzd3gMfj6Vx9tJpzRnOOnFRUc8UHNW\/hDyGqfdV9oadinJHISOkaW14SG+NiKCbs62+K4kOYuse8tDejJHAH5YGV2juPptMgDxbpvzxpK0cFfQD7NTJKkWmOjp7AgMBAAGjgghAMIIIPDCCAYAGCisGAQQB1nkCBAIEggFwBIIBbAFqAHcARqVV63X6kSAwtaKJafTzfREsQXS+\/Um4havy\/HD+bUcAAAFw6n9T+QAABAMASDBGAiEAmX768G6NS+ZYbiNO9DZJmZdvkp6\/SHor7vGRrNqzQZQCIQCzE3PNmahLeoD1Ru15LTmGBf3T\/5eQtpKsbupBPVD5rAB2AEHIyrHfIkZKEMahOglCh15OMYsbA+vrS8do8JBilgb2AAABcOp\/U6gAAAQDAEcwRQIhAMlAkpZnDcncwQhl8yQ9bv\/urmUo\/HvBUXlQ2OoHaY9wAiBX8w8hdwe+ti1JzlOgo+l6ERsL\/85ZiYbyBS4PLBobRAB3AFWB1MIWkDYBSuoLm1c8U\/DA5Dh4cCUIFy+jqh0HE9MMAAABcOp\/VMgAAAQDAEgwRgIhAKECRib58RCo5MlQHGb4ATWRjKZrjAjdUPi+tLxPf7uOAiEAilsYu+v0osacw7zHLY7aZ\/y5oCRfVO4yXuUTkPyx1scwJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSJNZ2CkQqUlyOTG\/kUtmT72TvlhTALBgNVHQ8EBAMCBLAwggRZBgNVHREEggRQMIIETIIcZGMuc2VydmljZXMudmlzdWFsc3R1ZGlvLmNvbYIkZGMuYXBwbGljYXRpb25pbnNpZ2h0cy5taWNyb3NvZnQuY29tgiBkYy5hcHBsaWNh"}
00440{"flow_id":84,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2736,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123672,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAGxpHAqAEGKE+KKeyYAbtVmTggYapvvrAQEAkxvQAAAQEICjCE5v4L9mYYAQEFCmGqdV5hqnr+"}
00425{"flow_id":84,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2737,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123703,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyYAbtVmTggYap6\/oAQD68QgAAAAQEICjCE5v4L9mY4"}
02372{"flow_id":84,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2738,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123794,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUX+hAAG4GMxUoT4opwKgBBgG77Jhhqnr+VZk4IIAQBAUGowAAAQEICgv2ZjgwhObeF\/KtH5EMefO8hv0pjo+hGaXILLf3FXEJEUNym4UkrCLWDamR59f1QmpKcgSIkZifPw\/6jT04Lx3G8j0u\/4Zr8jqlRUvE3IGU2i\/9PtddIGVo8QNa6Xkq8YGSG5VNgIqMIWbCkj8KJ+Czz+OcotlKrPgIDMBvcI4lpWpdQBZoNdY\/ftIR1NdqVrXotwyqYoxBWW54gatmCMI5+vrG+wwV9MdXq3rBSGLoxQncTvajDkV9i5fN4tSuYczQhYrBGR08owS10B3943mfIHr5DhObTJG3iM8z8j7RasCVMq\/+VyYlJVIsyOMCOHG8sv9fTaE2ij6GigWf\/juNwMk1x5uPV9+\/O8dKEkydhAbtb9ZVHFRiFtv\/fXg8D\/Yemtk8TlkLO6Zhh+iFVXckQUpYNXe1ooy7P7hUDicTS++Mgu1XjAkhTrNNty8pZaWucLOG4jFDYVxnhRF9NoO8URVfJk3w9jlssLCVT0Qxx7zinN8mIQmEz1QrPdOYm1I\/wWe+HOjmr36nHdTbGfZNfvsP5qR2Y+OL8cjV1OlMkGgqfDsgP5F+alHjTAiU4lKdHxO5qwAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4UEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEF"}
00425{"flow_id":84,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2739,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":123861,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyYAbtVmTggYaqAnoAQEAAKjwAAAQEICjCE5v4L9mY4"}
02370{"flow_id":84,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2740,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":124052,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUX+lAAG4GMxQoT4opwKgBBgG77JhhqoCeVZk4IIAQBAWSHQAAAQEICgv2ZjgwhObeBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBT9VOfspjpsX70VZxDzhO\/uVmwbaRgPMjAyMDA0MTQwNDQwMzNaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhNuABQ+IygxVnX+3gt8AAAAFD4jgAAYDzIwMjAwNDE0MDQ0MDMzWqARGA8yMDIwMDQxODA0NDAzM1qhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNTA0NDAzM1owDQYJKoZIhvcNAQELBQADggEBADkM19U0SmHlL3R\/ESJ19x4t0n8W5SjucBIYgjTO1GQJumgjW5tDii0LSvw3I3s7tfy8FCPvc2nuzYzAhWQU9+cGQBggRJE9+ZGhKKBB7ZmH0xtC8Lr0nt+OteoA4exsoLuFgGUdO5BnD4\/wtOusidOwcg1JE9GcgShEEPuRymds\/ZsCDQggl5k7w44OeYPJTAQQGFQrvNB0QQHCkXUCbnIxI74IMxt8cDmviehsHK3aLW60XdXL4Ul2HA6ASDdjOamK7xKakasLBICIXjY3LTREzy1mSB1\/ankSr+1o2t0XDCFVFKpaLTief2n7NrXROL\/o9qRXBV09fHsj2VsBp\/WgggUjMIIFHzCCBRswggMDoAMCAQICE24AE\/D2Kp4kxgB1wsEAAAAT8PYwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsTDE1pY3Jvc29mdCBJVDEeMBwGA1UEAxMVTWljcm9zb2Z0IElUIFRMUyBDQSA1MB4XDTIwMDMxNTE1MjQzOFoXDTIxMDMxNTE1MjQzOFowKzEpMCcGA1UEAwwgTWljcm9zb2Z0X0lUX1RMU19DQV81X0tleUJpbmRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLL8jj3UBzU\/au5HTPbtPMCk5oVv210n++4hY3ar0HqI9QquzZ4bSqFbTrvtEbBDUYjsuWRRyh7PmGb4\/i5111AQMiqmHCXMlUEoISsFDVWgU7ngCnMhwhp48l8JBmtkGzagdLpyHYHcSiPAlGCLd3jLiBKzM\/ueqOFFcN5TX5VPlL2bsNstKGUgz+WDhIfD0rhDLaagjE5kTA"}
02036{"flow_id":84,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2741,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":124067,"pkt_caplen":1259,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1259,"pkt_l4_len":1225,"pkt":"KDc3AG3IEBMx8Tl2CABFAATdX+pAAG4GNAooT4opwKgBBgG77JhhqoY+VZk4IIAYBAUm6QAAAQEICgv2ZjgwhObe5Hlzx57WHJdADehPDFVjuBfeAlZZfr5n6B895zjgrfQ5aiOSHga1h087GXde6\/l1KqhKH6h6hhEXE5ueZlHVt8E78+aTJ8R72aoP7RFMtNiGy6NcvSO5txy6nvamfpgaF+6trEkXAgMBAAGjgdYwgdMwHQYDVR0OBBYEFP1U5+ymOmxfvRVnEPOE7+5WbBtpMA4GA1UdDwEB\/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDCTAPBgkrBgEFBQcwAQUEAgUAMB8GA1UdIwQYMBaAFAj+JZ906ocEwry7jqg4XzPG0WxlMD4GCSsGAQQBgjcVBwQxMC8GJysGAQQBgjcVCIfahnWD7tkBgsmFG4G1nmGF9OtggV2BzJtHgcjpFgIBZAIBBzAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4ICAQBuHFOoYYKg3cb0bUdjBxt0hVtcSnqF5W8ns\/9POrOjPDOf06GOC96qd9hr7hzAMCTioOAKpJ6fxlxkaOZvZAdvbi7AB\/SSaqRPF+sSsVoEuHOeBJYXeKJ2gjkaigkkIN5VcPFG2IjgkgIkk\/ho4Js9P+Uz3qAYfTPWFBpG+Iqrz0ohHyF5lnGmmGqBfpPCaUGisapj1uGyPYySvMpw6VrkfurOb2qw4NKYKHL+lu2XK0iQumrgg5H3wXsc3A2dOpPUQk4f6u4Cl+3z74P+XmrgzFCXvFQsZd46CNTqGRoEomrdF1xluttGd23tPXgK2Ij+kxVrxEG3nuAMNfvpbW6DLNtmaIB2\/MnW5seyQgrzAqc4X4+ejAnzHVfaGwQw8s2APMSDDKPlXsPqR4WzmEcRLj8qZWAjgb7afrWYUdpLL6GNC8talUqDHqz0IUfEREp2wMTNU05Iw3OOmn+EPWxxb3yKSz98D0BK3d0BfGuuINxw7D8yrEe5C7HzxcJW93BSLniXitCzJ7xP7vgE\/u7evLIsG4aYySMy3gMmFMW0e1fLKFisP7WNWhMY40d9uen4aX8Wo8+uJ5lC2sVG\/Fl3f5qa\/nbuVlQ5c4F9X4YT3X7ghItjAt95eutjN0qOIZLK0vLQBwDDhvcC5C2Ogjgr8KGdKMh8+Xh7DKUI1mYyvgwAAUkDABdBBENApT1WD8n+NPcc2lwkTMjKX2Pye0J8Q5LDXJfkJSsUCvGWlB\/XE6N2ulNsQZIFfT52adqXcpcO64Fyx9I6xm8EAQEAm1VgO4cYvXkkgC7ngwUlBKaIqA0J8j8ohsYrm4ucJLjUjBEaoLZou+zWc30TQgrUyvVRfDkXL1tTnoikLwVJr1r2x0lZRJD8mmubfoq42WcxRwRpAvHdy+IA7f765vp7354YyIkdmnsuECAi6he4ddDU1KadrcJ+CZJO2rlTmuw6UCpv0N6SqYGAPnbMLr1K+O9c\/3FOYKlvLt3jFunLCcm+YSyW40I140tVad2Zwan0auD2aszzrTjs\/7PYLAxAwv047pocwBHy0vrOQyf99HPAX25tg4PM7j5BHQR2lGma+zJg0538EQBu2g\/rNEXWH+j2Vrj7lLcObIEflZPvgA4AAAA="}
00425{"flow_id":84,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2742,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":124090,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAGxp3AqAEGKE+KKeyYAbtVmTggYaqK54AQD60AmQAAAQEICjCE5v4L9mY4"}
00674{"flow_id":84,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2745,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":161437,"pkt_caplen":248,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":248,"pkt_l4_len":214,"pkt":"EBMx8Tl2KDc3AG3ICABFAADqAABAAEAGxefAqAEGKE+KKeyYAbtVmTggYaqK54AYEACwDQAAAQEICjCE5yIL9mY4FgMDAEYQAABCQQRk8tbv6LeIp5gvcVYSxbCbmrbJQXr2V6WVIW9RSbM5ImfOurPDyt+oH5YG9KbvRr8hl3+B0iut5oQYoLu9t8+7FAMDAAEBFgMDAGCeLHdUZZ7GAv2JeIoTdx\/rO7Ic8\/2f7pPTu1lbX1y63KilM+TATij0QmDKUBbqXyQZKpaV4t6wCKADr7Wj93PHQ5b6xqlbnJHh6TgWE9tCVuUaVY+AeAvLTWQIHeMynf4="}
00575{"flow_id":84,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2746,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":192237,"pkt_caplen":173,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":173,"pkt_l4_len":139,"pkt":"KDc3AG3IEBMx8Tl2CABFAACfX+tAAG4GOEcoT4opwKgBBgG77JhhqornVZk41oAYBARoXwAAAQEICgv2Zn4whOciFAMDAAEBFgMDAGCBuVC\/T2rq99KYQBtaZ6auSviulGhAjILc6MEt1qo75gJZV6zYvdzGwYkgsi33Sttx+cXsDaengjJqcN\/wUT3dgs+mfVctteiVd4mK5Y808w0Xtsmk3O3+43rDaBw\/1Ys="}
00386{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2753,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":412826,"pkt_caplen":60,"pkt_type":34969,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWriJklgAAA2A0X1lWrAACAAADYDRfWVauACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00149{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2753,"source":"teams.pcap","alias":"nDPId-test","type":34969}
00781{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2754,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":427096,"pkt_caplen":321,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":321,"pkt_l4_len":287,"pkt":"\/\/\/\/\/\/\/\/2A0X1lWrCABFAAEzETJAAEARZ9\/AqAAB\/\/\/\/\/wBEAEMBHwAAAQEGANGFbXcAAIAAAAAAAAAAAAAAAAAAAAAAANgNF9ZVqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEBNwIBAwwJVEwtU0cxMTZFPAlUTC1TRzExNkU9BwHYDRfWVav\/"}
00546{"flow_id":80,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2755,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":540741,"pkt_caplen":152,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":152,"pkt_l4_len":118,"pkt":"KDc3AG3IEBMx8Tl2CABFAACKzoQAADURKRxdR27NwKgBBj\/Mw2AAdvoBgMkACwAAdOzKWqyy7khbuMy2CPAOdSlm9vfV\/zA8Fjk6DoSrzk1YoR3CjL6fRwBFxfILywlH\/e+ZsaLsnUb0kk1pdZ8vvvffelHLEDAb56eIg0Fd5N31Iq33qt+Cl3MrgAAAALb8aZ7glFC0uQE="}
00543{"flow_id":80,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2756,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":591500,"pkt_caplen":150,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":150,"pkt_l4_len":116,"pkt":"KDc3AG3IEBMx8Tl2CABFAACI1P8AADURIqNdR27NwKgBBj\/Mw2AAdIEuAAEAWCESpELLiCydeYhToi1VX7EABgAJRlkzMjpvNS9JAAAAgHAABAAAAAcAJAAEbv\/9\/oApAAgAAH\/tXgWOAIAzAACANwAEAAAAAgAIABT7q3YVkpLtqIBDQ4idBK1C1vp3woAoAASNt2uk"}
00456{"flow_id":81,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2760,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":604150,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"EBMx8Tl2KDc3AG3ICABFAABKHYAAAEARz2DAqAEGXUduzcN0P80ANmsVj84ABwAA5ltKwaXSuIo5xp1Mj3jnyAE4NEe2i8T7sf+AAAAAGmJ5GWX+DBatLA=="}
00375{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":2761,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":611318,"pkt_caplen":60,"pkt_type":38,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":60,"pkt_l4_len":0,"pkt":"AYDCAAAAeCjKBfrMACZCQgMAAAAAAJAAeCjKBfrMAAAAAJAAeCjKBfrMgAEAAAYAAQAEAKWlpaWlpaWl"}
00146{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":2761,"source":"teams.pcap","alias":"nDPId-test","type":38}
00648{"flow_id":71,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2762,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":617344,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADW2xEAAEARrlfAqAEGNHL6jcNhDZYAwt8iAAMApiESpEINQAd8TvBOvXDWMxoADwAEcsZLxoAIAAQAAAAGAA0ABAAAAACAUAAEAAAAAQAUABQ+mj9JKfg8kAiQ47rNqp++2YC3UgAVAAoicnRjbWVkaWEiAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8AAgAILegjOD1prOmcIML6MAq3Q5voM\/8\/Vbx8\/OHsgTOe6Dx"}
00444{"flow_id":80,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2763,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":617788,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"EBMx8Tl2KDc3AG3ICABFAABC4dsAAEARCw3AqAEGXUduzcNgP8wALqScgMkABQAA5looGQQtzyCqRiLs2mAILrHggAAAAIzs+vyI2S6eRnE="}
02044{"flow_id":80,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2764,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":617801,"pkt_caplen":1256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1256,"pkt_l4_len":1222,"pkt":"EBMx8Tl2KDc3AG3ICABFAATab+wAAEAReGTAqAEGXUduzcNgP8wExulzgMkBKwAA5lpsDx4xU6SHE\/lu1cbeWFc6naonT4JAuuoZuxzI2sow1YFjz\/bN9xje4nS4yGtK00hDpzDL30dBZsmDCgne5kA+GN7AB2rifeH85TWum9Ym\/tooPmTKi3RcSOyfHYutcmofKWKT6s5HQ0fhH3Z6TEwNM2mVI03jCxYraV2r9+r5vX2roR9dDhYZCtVYnoe2G94imh042ouKgMpu\/PMbneFIAUoIzKFlb4+KVdOQi9CqtSXinHYzN36ema5KYQpc1KyqvWCh55IReBkkf6eXTLqqSI6dTY6hZFgWciY5RYQ99JlURiHAJmhbQCRd7pQy9wAMJ3Dnv7MNtqksN+FOQwHUroTwANyMahHw5ah6ol+IhGg0tCOZU15M2KXffB2FHYXsLZhb9DdAb2qruuCuBo5bKggCZkeu6pQBS89aR5KgMU6ytD3htUIcxm7sAn89EmzHwqHEosUqx7BKyXmBTAXIz8JPiWv4VXpinCTtxDlo4SXifwylOdC+0SNYYJkWZzihLlaFHygFs2vHgi0K9WD\/oXvHIXSuuSTK2uxSj1jG8bJL2ykEEIxDyRFtdGh\/ZE+wftE\/mQ9YXajIN01\/z5xd2TdxJ0XFoYpjBA9wx2VkHjJOrAnh+sS74cNKz4juprWtOva9feBFvVQ2uTErBycBhDWnXY7mNb758ZVjfw29b82kC6yxlDX8dlXihl5NMKEZ\/fCkQXLDgFAGqlpUrD4YEvyEhCkoLyVGJNr5DnFltRPr75k4W1UHlJ4hsnM96fngXx1PRBKQxtntySydf\/gewnTwKpCJ8\/juYQd2cFLFENXsYY0fwFh2HyqUUXe8HKSkkeqSwdNLCW4SXakZRfCCfmRstuKJ+gtEoyR0bBA7yiN7oxZy0k\/tJgXCtVHO+dYMPxJ8U+Zf\/ERaIb9VcqVayqmjK7lYUYQlzr5xtjIN\/y0BnFwqnCVWK017RciqG4gAJJWDvcipvgXrLv+WM7\/tYsOzW\/qf5M22Wa\/bJs6LLzWeKJU7KuB3je3ekpHAgCGd6vhl4mmLHuyOJ2bQjGOBKgDEP+8zAn\/xVpFQp4pSUFWWTAOYY86A9jXXifGlGdfKSBIRj\/N7atpZUjpXIWN\/lbvz5PUw4ARDgWv2vNavHz0cekm1PzRbGRDiPVIF7xSamOQ8dimSWFLS7fiHfvE9z+Tn\/yKWVVYf5xtDBW8FR2DNl8k7005dCen26fidZ7EVGcXBoxCWAAl1+Gq23N9F9uql\/K43EHmfqI5N8AkOMCeCNZ3pAxfN0oPKGpjfR5ccfWU1eot6BRyBYU07SODDhNtU1JtVCI53CZfa64aKe13fJU4CW+tdR9bUMGuyvOtjXg\/1K9e3w6ZaYqdgp1xWudLj0ck5PlQ74yF50ptQb375kNBzIJn1Hbj013yqUM5\/A7z2NgaYTw1hPuYNkfagxRT1lhzj\/sbPqPshs89+pGA6B9WlovHvPUJG9OLlaXw4YEkUlGuNBUMdBG15ZKU2BXf0h+ZSUw79WtohyoMCIfVTG+ydvas7vDDIrwS3noXqCCRMOk26U0AffjXMPbLbB8QQLVPEQD1SOSr+39h6G5W1ha3VeQ4FgAAAAeAuqGnJ7B5kI8U="}
02040{"flow_id":80,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2765,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":617826,"pkt_caplen":1256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1256,"pkt_l4_len":1222,"pkt":"EBMx8Tl2KDc3AG3ICABFAATae2IAAEARbO7AqAEGXUduzcNgP8wExoSUgMkBKwAA5lrJLZgVPA0x9\/Ak0gXdsUJRceCTjz3PuRUPmAV78wFmDZkhlnERaBeQZTpXK7bb\/ZH2EdSRPwMpfg3keJ58F4NQW+eV73UAjqTTnUBcDAv4nztEOLvuqB+OuNNskceTT8J7XXNMIpnjNsBafsA15HhMWLJaTdLNJtYKxyGCuP1VHuGj+r0Sw8IL4\/l8CXmZ2YSMG\/JXV31DGroywkc5SLibL6tUGhgUNTM9EyJ3F6vXgq9CwLKp4El4q5iXjQyPZPdko\/XT+rXs3DmTySkPluXO97qvFJADso\/8EZbcYND++Hol2E0eGRWcqUYVhXKl6eto\/rOtNHC451D+lCLNPyd5NpgXFwGBbGvjzLFOR+ar+fgxtOOWcBpZfxr97EamwQ78f3XF4tXmtiVMV4IZU\/QB\/t5IBKVFJBryw9fHaodywEBQirqg1SqRFeQeBk5FzDTKm3N7fmuuTmxvAVjS7XIOvD8eq4KUrPejRpMwDJ\/f5O2dFeBVCSvt7BOneZRjxfJPvUBLFqqsVbRshIFGF9x2dGPFE6lpi7JIzhS4bN5efAHfWQucmHyMmWgeifrr7ErMUkIT8aJzIkTuXYe5hJmB\/z6RlF14OrhD67zleJHeO8g69SbdnyfWIYgAwYy2h5IInehvzD9mSoMmMf3602PdTBLaKaiyoeCcWEZIwkWEcfXM620bAzyDuDDM7ApjYN\/5x5YoCj0dfw3GHGZADAIszp14jYwX1iwT9tAu3yjXNHx7khS\/tbMQUF4q2az6FFcm0PS\/+qmcYsSx3cV7Z9IE0s85tnkXHyt+QxoAKaj4E1rVE1DTJTvEDp2NP6zcLKH6HDxjOqKRNc3rNv4xPzyidKQCH5YMzM4omH5JtzeyfgMhlyWUz9DjzAVtcjLInCJP5M96JlK1AafIqKkoFOqVR1nccfWFvPH7oF8im2KRr+bfIoJCLvbtqfadTbYXNuGKkpf+T8Daa3aN598fQt4lebspWWyj+hL3MvHqO9a0LS9kXdoJ5PXDUKjMnUDUAhIKq6tPlnBz+aBDmyu68zxLDJRcLsAX5+TEjy6f3gEfac3trJeU5hy39luehdZFNd+wwlJG2HxtJ7WXUmXTOo8GYGy6fF3bJyvr+25UbtzAFR9tz536T1QiIIM54x\/OT6B55TEl5UvBujxsfFmPOM6E0kyQSAjGPezPNZ7ECAvkGuCgOI2+NqY1OwrHlSFWjIAIe15st5Kcec82qv1Xjqrj1teCXNpFr8erfFbrNsyW3qiEIqSG48TeN2bP9AUHSIFxDK1A0GrG4VCWiC25uQBGPm2n7YnEOTbvJdHlnw4Wudkk1HhECOyrQhed5OqGtk6BqjAVRMV\/5y895yJn8U9SloFoPNb538uegseNseABC8atFUO8nTyX+rPC0KklbhzUxRJ92ZSEK2V99cuFw+LEvM\/9osmUOWMvrOqTF2taeFSZBxKuej\/7molrThcqLQMKoJgnjpVMurXpzk9uNuZetKRCs47i2AikShegzcyro\/UcnnUaChxa3F57u9EihqryxV1pfnonBIM1jDU5+0fDvcQFQwVL8Rdxv4p\/be2RjKyH4+cnxm\/KgAAAAq6K4T8PVd6LFAo="}
00480{"flow_id":81,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2766,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":619539,"pkt_caplen":104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":104,"pkt_l4_len":70,"pkt":"EBMx8Tl2KDc3AG3ICABFAABanjAAAEARTqDAqAEGXUduzcN0P80ARteagMkABAAA5lsmU+EIO4Jd\/4VVSEgk4ZreSec3uDuofyQ83QvCKgJVhk3g5k7mDymOgAAAAaxz4Wn0\/8jj7Tk="}
00450{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2767,"source":"teams.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1587041697660,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
00433{"flow_id":85,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2767,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":660621,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"KDc3AG3IEBMx8Tl2CABFoAA40fgAADUBJWpdR27NwKgBBgMDcCsAAAAARQAASh2AAAAyEd1gwKgBBl1Hbs3DdD\/NADaJWQ=="}
00482{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2767,"source":"teams.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1587041697660,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","l4_proto":"icmp","ndpi": {"proto":"ICMP","breed":"Acceptable","category":"Network"}}
00592{"flow_id":71,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2768,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":663187,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"KDc3AG3IEBMx8Tl2CABFAACtfJsAAGwR4PY0cvqNwKgBBg2Ww2EAmWC+AQMAfSESpEINQAd8TvBOvXDWMxoADwAEcsZLxgANAAQAAAAAAAEACAABDZg0cvqNgAgABAAAAAaAIAAIAAHME3GnagqAUAAYLOxJmLF8a9P8QJMpg69OprVoITMAAAAAgCIACTIuMC4xLjIxMQAIACBXZEEobQtnwOsCYr30FXefykLuRj2+vxB\/THVizwWzVA=="}
00543{"flow_id":80,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2769,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":668816,"pkt_caplen":150,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":150,"pkt_l4_len":116,"pkt":"EBMx8Tl2KDc3AG3ICABFAACILyMAAEARvX\/AqAEGXUduzcNgP8wAdKAIAAEAWCESpEJpNUW874Cqp91dCQQABgAJbzUvSTpGWTMyAAAAgHAABAAAAAcAJAAEbv\/+\/4AqAAgAAH+KUoZYAIAzAACANwAEAAAAAgAIABSrJHBh7YcwQRz+xslFJPGEt4fI4oAoAAQWqXBo"}
00648{"flow_id":73,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2770,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":668978,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWXowAAEARKuHAqAEGNHL6icN1DZYAwtlEAAMApiESpEJ\/K8mw63L1SVFc8SkADwAEcsZLxoAIAAQAAAAGAA0ABAAAAACAUAAEAAAAAQAUABRzrT6HZUT09MBbGfgrZXo06YoDbQAVAAoicnRjbWVkaWEiAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8AAgAIBF1x2DO\/FnH+NItZ0DdGmNq9Qpo8WCUVFVIxiEnjM\/h"}
00647{"flow_id":72,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2771,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":669056,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWQkgAAEARRyXAqAEGNHL6icN0DZYAwvo0AAMApiESpEKq36JSlpzO4UFUsSMADwAEcsZLxoAIAAQAAAAGAA0ABAAAAACAUAAEAAAAAQAUABQ8rv9B5PDVn2ggKA0vFJP4sPMSAAAVAAoicnRjbWVkaWEiAAYAOAIAACSQoNvbAdYZTeIVN7\/JkqADMnMa8b7cVproO9WrAAAAAL9xsnbJeBOo3e\/rXLx5Oid6TOY8AAgAIMgHBX+t\/XNKPsdtlpAIVsPeBDDuW\/3OC5VvHSABRDTj"}
00498{"flow_id":80,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2773,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":671802,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"pkt":"KDc3AG3IEBMx8Tl2CABFAABlk\/cAADURY85dR27NwKgBBj\/Mw2AAUZjdkGg9EgleGUgAAHTsvt4AARKGkmBAR7apLL2NaEeL+wrY+tF3wd8\/xqTTl+bYW8pH+25dWXaHopKg6FqOsrw1czRCD5j2jR6V3w=="}
00433{"flow_id":85,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2774,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":673040,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"KDc3AG3IEBMx8Tl2CABFoAA4akMAADUBjR9dR27NwKgBBgMDcBsAAAAARQAAWp4wAAAyEVygwKgBBl1Hbs3DdD\/NAEaJWQ=="}
00449{"flow_id":80,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2775,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":673792,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"KDc3AG3IEBMx8Tl2CABFAABCxvIAADURMPZdR27NwKgBBj\/Mw2AALmUCgMkABQAAdOyunrWZXbYN\/Vl+Ik3K\/wMCgAAAAca5CAqZNW\/6ojY="}
02051{"flow_id":80,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2776,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":676447,"pkt_caplen":1256,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1256,"pkt_l4_len":1222,"pkt":"KDc3AG3IEBMx8Tl2CABFAATa6dkAADURCXddR27NwKgBBj\/Mw2AExilggMkBKwAAdOzsa5K8UoqAgMkd6DyrDFM5Z5ls+wHmur1BhbBuUi5o3AHNCpvPNXoPapE6jrC+JzT+SZK8D06h9KkWZnNZ0to+rDxXAL8qfeNCyQf8VSQ0AntLdH\/K59E3hXZoxKxbgv5xmpBpN4h1DRb9ss3Zw9lHvXc\/zsARlFA3rTxVvmG8JuxQyZ11l2MiBj9O9PdNIgqmQ1X\/t8VvsmcP+oaVyL3Rye4vON7N9\/i3GQfK6jefXyT1F\/FReir67ocbsdrX4arGdGCd4Z7JejYiBJDSTjGNHiAnz7fAVLR2qqJL4\/Sd8X8dQV+r3yS+02htPEKHVN9cxfg\/OrSm57mPr52PrYaZ7ojRC3fnjoDXQu9PKKdBMNxw2ArNdoz0fpib6VWO\/EXu8gg09eqHwBEubXujZe+W8VKaLv\/4JLWNuhjLYaYTayQdmWDR\/ghya9BFOZMgbQTqjCeK5p0rW7VJ84jhVQ0JrJEtvM7SR3GN6Aksfur8vluQMNljEf0pe4ZXLIkwKxbUw2XInUe\/MrWGHIrq72jgjiaeuCLdP9pTVb23+PswDjwfr24AhxZxhkjRbp5SqjFwht1aWh0EXq3HsBzNii+irNEd6Pb7dvdE\/xlAVPTYMjZRBlTGv7elYyfGxw9YcKOu\/mcnyL2wusZdMc\/2lW0e\/\/s70KlhN4cSdg9+68j9qKCKCjrk5ts8OacUCq6sdwpP93U\/vaeEBHyR47Tzyfv1Jimai1ElwYHqr9C4C5ZMSfglAU97+eT9jCQG6NLM4gCbt+557epmUASqswbBeTk\/nN5weW6zTNPFW2iB9hYQxGa1WOY2dnVWQ06fxh08sjwfySpW5jTPNnpJa+ebIDJ1gmhlQom6TSavGEaLMnUlBSh40YzBoSITQ6\/hPa6QMANwcufrSnM9lfVHtQcxEQUmXywUAOQss+xImJic9lANftI7cg53ol9psrYwRvwIP6sJl9ct990QvLyQHF0+BGcKIQaVCLLS8z5Vq7PNqxYl0pZXe6VJ4fVCVoUBgYAs5oSxFmGHh5UnV7TXlPgZfuAWfZR70M3xVymqw6DLqU25r\/DNfjLFP37YjFuvJEGlAsHex+mfPYAR1UcKjdn3O1LchDrKOblh1YKg7ZVE7mAzkAi\/1nM3ZZfXZ7nGnqyWZEE6SeX9J8d557nRzBbgKQfX8b6QyIipZQHaKYLT1uCeQuHhoeOi9nka4DyXixxciPGXsP3CYn8rMacQg+2nCZtkAzyP643oGuCmv4OoP\/dPKqpk\/G67Lpw5G55kJ0UbCgi6jUrG7bVFWMuv8L\/JEjEuNlGyMphzfPfmlXefF647EGhTXLymFznu95xGlhre0omC5\/AvhztRX7vR8nN372CvUepGLo\/oMN5Jb6zz2V8i2oXn8NMp5kLbZxjRl0ZjFk3uRvayyWBSNvfY\/nxbVl9cjJOWlDhjRo0LH5FrIx+L08J\/U01uek5LCClDUdc9KzE1t7PZL1\/sNf+f1xp5CANozF\/uu+\/QNRdgulBTdfDW6IKj8XEvdzIHuOEs9UL2y8mbR7h1NTWsZfYTDiwy11ObRF6CUkaZP08bUDvAfGLcVYzBXFUCQZOJgAAAAg7rLYYXyWxwhDw="}
00592{"flow_id":72,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2784,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":713165,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"KDc3AG3IEBMx8Tl2CABFAACtVxwAAGwRBno0cvqJwKgBBg2Ww3QAmStwAQMAfSESpEKq36JSlpzO4UFUsSMADwAEcsZLxgANAAQAAAAAAAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHObHGnagqAUAAYmiULR7BQSjV7GJ7mOy6WXuQ5anUAAAAAgCIACTIuMC4xLjIxMQAIACBb+0dO7XG7sUjMCcGQZhDcW3hrI\/E2Bu3cGSpxYdsKow=="}
00594{"flow_id":73,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2785,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041697,"pkt_ts_usec":714311,"pkt_caplen":187,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":187,"pkt_l4_len":153,"pkt":"KDc3AG3IEBMx8Tl2CABFAACtVx0AAGwRBnk0cvqJwKgBBg2Ww3UAmdF8AQMAfSESpEJ\/K8mw63L1SVFc8SkADwAEcsZLxgANAAQAAAAAAAEACAABDZg0cvqJgAgABAAAAAaAIAAIAAHAaHGnagqAUAAYaOUMdiD0+ug9lexVR\/3YR6\/W6KUAAAAAgCIACTIuMC4xLjIxMQAIACDm9keelgh3gAU1t68wEkZCoxEf5LkRAoAG52M5NOQtKg=="}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":25,"flow_first_seen":1587041693828,"flow_last_seen":1587041694047,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6930,"flow_avg_l4_payload_len":277,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":33,"flow_first_seen":1587041693516,"flow_last_seen":1587041695435,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6838,"flow_avg_l4_payload_len":207,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50018,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":31,"flow_first_seen":1587041693582,"flow_last_seen":1587041694243,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":6838,"flow_avg_l4_payload_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50021,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":2,"flow_first_seen":1587041697660,"flow_last_seen":1587041697673,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","l4_proto":"icmp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":30,"flow_first_seen":1587041693849,"flow_last_seen":1587041697765,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":7358,"flow_avg_l4_payload_len":245,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":40,"flow_first_seen":1587041676435,"flow_last_seen":1587041676536,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":12621,"flow_avg_l4_payload_len":315,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1300,"flow_first_seen":1587041677243,"flow_last_seen":1587041697130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":750126,"flow_avg_l4_payload_len":577,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60536,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":37,"flow_first_seen":1587041682144,"flow_last_seen":1587041685098,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":9034,"flow_avg_l4_payload_len":244,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60542,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":52,"flow_first_seen":1587041685240,"flow_last_seen":1587041685471,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":30424,"flow_avg_l4_payload_len":585,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60554,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":25,"flow_first_seen":1587041685984,"flow_last_seen":1587041686156,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":8124,"flow_avg_l4_payload_len":324,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.113.194.132","src_port":60557,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":5,"flow_first_seen":1587041695278,"flow_last_seen":1587041696498,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":560,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50016,"dst_port":50005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":29,"flow_first_seen":1587041687745,"flow_last_seen":1587041687963,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":9450,"flow_avg_l4_payload_len":325,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.169.186.119","src_port":60563,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681744,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":161,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":107,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63106,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":5,"flow_first_seen":1587041695278,"flow_last_seen":1587041696498,"flow_min_l4_payload_len":112,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":560,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.0.4","src_port":50036,"dst_port":50020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":2,"flow_first_seen":1587041685092,"flow_last_seen":1587041685105,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":119,"flow_tot_l4_payload_len":180,"flow_avg_l4_payload_len":90,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65230,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1587041685090,"flow_last_seen":1587041685136,"flow_min_l4_payload_len":45,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":212,"flow_avg_l4_payload_len":106,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":61245,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681754,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":140,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":77,"flow_first_seen":1587041676362,"flow_last_seen":1587041677077,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":60045,"flow_avg_l4_payload_len":779,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60532,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":34,"flow_first_seen":1587041677042,"flow_last_seen":1587041677375,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":20082,"flow_avg_l4_payload_len":590,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60535,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":26,"flow_first_seen":1587041678029,"flow_last_seen":1587041678303,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":12049,"flow_avg_l4_payload_len":463,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60537,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":20,"flow_first_seen":1587041681745,"flow_last_seen":1587041681895,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":7654,"flow_avg_l4_payload_len":382,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60538,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":20,"flow_first_seen":1587041681755,"flow_last_seen":1587041681908,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":7598,"flow_avg_l4_payload_len":379,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":2,"flow_first_seen":1587041682355,"flow_last_seen":1587041682370,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":129,"flow_tot_l4_payload_len":180,"flow_avg_l4_payload_len":90,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":65387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":24,"flow_first_seen":1587041682076,"flow_last_seen":1587041682204,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":12188,"flow_avg_l4_payload_len":507,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60540,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":22,"flow_first_seen":1587041682077,"flow_last_seen":1587041682212,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":10552,"flow_avg_l4_payload_len":479,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":106,"flow_first_seen":1587041682420,"flow_last_seen":1587041683086,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":86354,"flow_avg_l4_payload_len":814,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.77.33","dst_ip":"192.168.1.6","src_port":443,"dst_port":60543,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":37,"flow_first_seen":1587041682423,"flow_last_seen":1587041692106,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":9736,"flow_avg_l4_payload_len":263,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.76.48","dst_ip":"192.168.1.6","src_port":443,"dst_port":60544,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":83,"flow_first_seen":1587041682698,"flow_last_seen":1587041691929,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":14416,"flow_avg_l4_payload_len":173,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.58","src_port":60545,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":35,"flow_first_seen":1587041683186,"flow_last_seen":1587041683511,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":10412,"flow_avg_l4_payload_len":297,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.88.59","src_port":60547,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":29,"flow_first_seen":1587041683333,"flow_last_seen":1587041683650,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":15546,"flow_avg_l4_payload_len":536,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60548,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":24,"flow_first_seen":1587041685106,"flow_last_seen":1587041685981,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":8860,"flow_avg_l4_payload_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.15.45","src_port":60551,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":25,"flow_first_seen":1587041685232,"flow_last_seen":1587041685890,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":9605,"flow_avg_l4_payload_len":384,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60552,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":31,"flow_first_seen":1587041685248,"flow_last_seen":1587041688035,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":11696,"flow_avg_l4_payload_len":377,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60555,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":33,"flow_first_seen":1587041686239,"flow_last_seen":1587041686589,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":18814,"flow_avg_l4_payload_len":570,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60559,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":37,"flow_first_seen":1587041687245,"flow_last_seen":1587041688061,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":22353,"flow_avg_l4_payload_len":604,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60561,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":33,"flow_first_seen":1587041691149,"flow_last_seen":1587041691582,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":10149,"flow_avg_l4_payload_len":307,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.108.8","src_port":60565,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":24,"flow_first_seen":1587041694219,"flow_last_seen":1587041695993,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":8320,"flow_avg_l4_payload_len":346,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":60567,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1587041672419,"flow_last_seen":1587041697427,"flow_min_l4_payload_len":279,"flow_max_l4_payload_len":279,"flow_tot_l4_payload_len":1674,"flow_avg_l4_payload_len":279,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.1","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1587041673094,"flow_last_seen":1587041677380,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"149.154.167.91","src_port":58533,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Telegram","breed":"Acceptable","category":"Chat"}}
00493{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":3,"flow_first_seen":1587041673094,"flow_last_seen":1587041677380,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"149.154.167.91","src_port":58533,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":2,"flow_first_seen":1587041684291,"flow_last_seen":1587041684304,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":172,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":59403,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":54,"flow_first_seen":1587041684306,"flow_last_seen":1587041685465,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1452,"flow_tot_l4_payload_len":14487,"flow_avg_l4_payload_len":268,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"13.107.18.11","src_port":60549,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":2,"flow_first_seen":1587041685243,"flow_last_seen":1587041685256,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":127,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51309,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":20,"flow_first_seen":1587041682809,"flow_last_seen":1587041688190,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1226,"flow_tot_l4_payload_len":2932,"flow_avg_l4_payload_len":146,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":17,"flow_first_seen":1587041692808,"flow_last_seen":1587041695538,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1225,"flow_tot_l4_payload_len":4100,"flow_avg_l4_payload_len":241,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1587041683142,"flow_last_seen":1587041683184,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":180,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1201,"flow_tot_l4_payload_len":12443,"flow_avg_l4_payload_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Skype_Teams","breed":"Acceptable","category":"VoIP"}}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1201,"flow_tot_l4_payload_len":12443,"flow_avg_l4_payload_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1587041682668,"flow_last_seen":1587041682697,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":197,"flow_avg_l4_payload_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00514{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":4,"flow_first_seen":1587041692528,"flow_last_seen":1587041692578,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":48,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}}
00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":4,"flow_first_seen":1587041692528,"flow_last_seen":1587041692578,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":48,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":2,"flow_first_seen":1587041682129,"flow_last_seen":1587041682143,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":162,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":103,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":37,"flow_first_seen":1587041695305,"flow_last_seen":1587041698021,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":1214,"flow_tot_l4_payload_len":7582,"flow_avg_l4_payload_len":204,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16332,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":8,"flow_first_seen":1587041695305,"flow_last_seen":1587041697619,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":712,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"93.71.110.205","dst_ip":"192.168.1.6","src_port":16333,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1587041685091,"flow_last_seen":1587041685104,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":131,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":53678,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1587041690880,"flow_last_seen":1587041690915,"flow_min_l4_payload_len":54,"flow_max_l4_payload_len":259,"flow_tot_l4_payload_len":313,"flow_avg_l4_payload_len":156,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":63930,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":1587041693517,"flow_last_seen":1587041693530,"flow_min_l4_payload_len":67,"flow_max_l4_payload_len":143,"flow_tot_l4_payload_len":210,"flow_avg_l4_payload_len":105,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":55765,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":16,"flow_first_seen":1587041682740,"flow_last_seen":1587041682856,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":9052,"flow_avg_l4_payload_len":565,"midstream":1,"l3_proto":"ip4","src_ip":"162.125.19.131","dst_ip":"192.168.1.6","src_port":443,"dst_port":60344,"l4_proto":"tcp","ndpi": {"proto":"TLS.Dropbox","breed":"Acceptable","category":"Cloud"}}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":16,"flow_first_seen":1587041682740,"flow_last_seen":1587041682856,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1428,"flow_tot_l4_payload_len":9052,"flow_avg_l4_payload_len":565,"midstream":1,"l3_proto":"ip4","src_ip":"162.125.19.131","dst_ip":"192.168.1.6","src_port":443,"dst_port":60344,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_first_seen":1587041679059,"flow_last_seen":1587041680074,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":94,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":64046,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":7,"flow_first_seen":1587041693597,"flow_last_seen":1587041695591,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":1414,"flow_avg_l4_payload_len":202,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":3,"flow_first_seen":1587041693515,"flow_last_seen":1587041693640,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":408,"flow_avg_l4_payload_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50016,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":2,"flow_first_seen":1587041695422,"flow_last_seen":1587041695432,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":224,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.8","dst_ip":"192.168.1.6","src_port":3479,"dst_port":50016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":6,"flow_first_seen":1587041693611,"flow_last_seen":1587041697663,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":953,"flow_avg_l4_payload_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.141","src_port":50017,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":9,"flow_first_seen":1587041693654,"flow_last_seen":1587041697713,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":272,"flow_tot_l4_payload_len":1745,"flow_avg_l4_payload_len":193,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":3,"flow_first_seen":1587041693582,"flow_last_seen":1587041693698,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":187,"flow_tot_l4_payload_len":408,"flow_avg_l4_payload_len":136,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.123","src_port":50036,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":6,"flow_first_seen":1587041693668,"flow_last_seen":1587041697714,"flow_min_l4_payload_len":68,"flow_max_l4_payload_len":214,"flow_tot_l4_payload_len":953,"flow_avg_l4_payload_len":158,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.137","src_port":50037,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00503{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":2,"flow_first_seen":1587041695421,"flow_last_seen":1587041695433,"flow_min_l4_payload_len":100,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":224,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"52.114.252.21","dst_ip":"192.168.1.6","src_port":3480,"dst_port":50036,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":2,"flow_first_seen":1587041687370,"flow_last_seen":1587041687435,"flow_min_l4_payload_len":41,"flow_max_l4_payload_len":222,"flow_tot_l4_payload_len":263,"flow_avg_l4_payload_len":131,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":54069,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":25,"flow_first_seen":1587041676612,"flow_last_seen":1587041676808,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":8429,"flow_avg_l4_payload_len":337,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.5","src_port":60534,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":27,"flow_first_seen":1587041685251,"flow_last_seen":1587041685681,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":10159,"flow_avg_l4_payload_len":376,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.7","src_port":60556,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":26,"flow_first_seen":1587041686889,"flow_last_seen":1587041687253,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":10175,"flow_avg_l4_payload_len":391,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.126.9.67","src_port":60560,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1587041680294,"flow_last_seen":1587041680294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1090,"flow_tot_l4_payload_len":1126,"flow_avg_l4_payload_len":281,"midstream":1,"l3_proto":"ip4","src_ip":"93.62.150.157","dst_ip":"192.168.1.6","src_port":443,"dst_port":60512,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1587041680294,"flow_last_seen":1587041680294,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1090,"flow_tot_l4_payload_len":1126,"flow_avg_l4_payload_len":281,"midstream":1,"l3_proto":"ip4","src_ip":"93.62.150.157","dst_ip":"192.168.1.6","src_port":443,"dst_port":60512,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":2,"flow_first_seen":1587041685171,"flow_last_seen":1587041685185,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":194,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":58457,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":21,"flow_first_seen":1587041690916,"flow_last_seen":1587041691089,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":8952,"flow_avg_l4_payload_len":426,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60564,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":21,"flow_first_seen":1587041697061,"flow_last_seen":1587041697244,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":8968,"flow_avg_l4_payload_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"40.79.138.41","src_port":60568,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":2,"flow_first_seen":1587041687731,"flow_last_seen":1587041687745,"flow_min_l4_payload_len":48,"flow_max_l4_payload_len":183,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62735,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":2,"flow_first_seen":1587041681218,"flow_last_seen":1587041681248,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":147,"flow_avg_l4_payload_len":73,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":56634,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":2,"flow_first_seen":1587041675997,"flow_last_seen":1587041676010,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":67,"flow_tot_l4_payload_len":118,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60813,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":2,"flow_first_seen":1587041691075,"flow_last_seen":1587041691148,"flow_min_l4_payload_len":61,"flow_max_l4_payload_len":116,"flow_tot_l4_payload_len":177,"flow_avg_l4_payload_len":88,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":62863,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":2,"flow_first_seen":1587041694221,"flow_last_seen":1587041694234,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":134,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":96,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":60837,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00504{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":32,"flow_first_seen":1587041687436,"flow_last_seen":1587041687725,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":9349,"flow_avg_l4_payload_len":292,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"104.40.187.151","src_port":60562,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":2,"flow_first_seen":1587041685093,"flow_last_seen":1587041685127,"flow_min_l4_payload_len":53,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":113,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":50653,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00127{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 2817/2775
~~ skipped flows.............: 0
~~ total layer4 data length..: 1392023 bytes
~~ total detected protocols..: 78
~~ total active/idle flows...: 85/85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 6908722 bytes
~~ total memory freed........: 6908722 bytes
~~ total allocations/frees...: 61882/61882
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~