1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
00394{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1595697574192,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":192522,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"LLBdqyO5+P\/CRWqLCABFAABAAABAAEAGYZTAqAEVaBGvVdjMAbsVnUj1AAAAALAC\/\/+ITAAAAgQFtAEDAwYBAQgKRX5W8wAAAAAEAgAA"}
00435{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":222665,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"+P\/CRWqLLLBdqyO5CABFAAA0AABAADkGaKBoEa9VwKgBFQG72MxjNlEZFZ1I9oAS\/\/+oqwAAAgQFeAEBBAIBAwMK"}
00417{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":222752,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjMAbsVnUj2YzZRGlAQEADZRAAA"}
01279{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":223192,"pkt_caplen":688,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":688,"pkt_l4_len":654,"pkt":"LLBdqyO5+P\/CRWqLCABFAAKiAABAAEAGXzLAqAEVaBGvVdjMAbsVnUj2YzZRGlAYEABWzQAAFgMBAnUBAAJxAwMGpWRlayh22tFtXEAzmjJevDFs1IWqC4u2bXbxwIE69xC3C2PdEU5UEeZFLwoPl1YAAAYTAxMBEwIBAAIyAAAAMwAxAAAudGhlc2UtYXJlLW5vdC10aGUtZHJvaWRzLXlvdXJlLWxvb2tpbmctZm9yLmNvbf\/OAW4TAQAdACDbPfgwm2DuUZA1nST0TTbZcl3w+W\/UxK+KeNTQ8XZoWAAgv3B+CGpVXz5mDsUtrAvL6LtcWXtckj8m0zxukSXGubwBJLiEXRo3Il0FXLcYe218vYUq39pSaQl2gMs4ivT8n1x7zgN3LVJZggr8LaXJSaZj+ZfScLvSUl0NfE2D5vqc+gOMHnjCyEe7IDOFOZjn05FzfBy7N5ap9\/JNXoj2xa+U6V2TwvihaOc\/GNCQ6radfGia+nrZvKr+\/PSWUJ3U3+s+ls4zTysApsA8H5wb9QQLoDHnidAxhd22vS0hBakUY1GaI8quApXj8Gi3AdmbGrSGWDxyVN2ge+mdUMI+RoHLYqX6pmmt\/vdmkxN3iLPApbDuw24AT4oR57WxTdN\/UMH28g1ogoYgvvt0YKXWkQJVwSb5If5rcPLpxymWg\/rm+dBosTm60e9wnaghZCsA+n\/Ru6RO9sPaxhBDxDQiTz5XD2LapL8ABQAFAQAAAAAACgAKAAgAHQAXABgAGQALAAIBAAANABgAFggEBAEEAwgFBQEFAwgGBgEGAwIBAgMAMgASABAEAQQDBQEFAwYBBgMCAQID\/wEAAQAAEgAAADMAJgAkAB0AIKwXrYJPOPenZGQf1a2Cz8a6UMLnBYZ9xGnya\/eMwngzACsAAwIDBA=="}
00872{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1595697574192,"flow_last_seen":1595697574223,"flow_tot_l4_data_len":750,"flow_min_l4_data_len":20,"flow_max_l4_data_len":654,"flow_avg_l4_data_len":187,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","21":"TLS Suspicious ESNI Usage"},"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"these-are-not-the-droids-youre-looking-for.com","ja3":"077d20c3f8c5a1f091dc937c515b69c1","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","tls_supported_versions":"TLSv1.3"}}
00417{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":265763,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAo1A9AADkGlJxoEa9VwKgBFQG72MxjNlEaFZ1LcFAQAELmiAAA"}
02403{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271419,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"+P\/CRWqLLLBdqyO5CABFAAXc1BFAADkGjuZoEa9VwKgBFQG72MxjNlEaFZ1LcFAQAEIx7gAAFgMDAGoCAABmAwNw+lc6r0tf3YdYfbWvsjq6lUYmX2lHn0WywBDUA8mO+BC3C2PdEU5UEeZFLwoPl1YAEwMAAC4AMwAkAB0AIEBba40GfrygMyeAtaoaApWLvD\/pYpMxaPlBkSn3R+V6ACsAAgMEFAMDAAEBFwMDDteWD7lzB+RguiGPJK4o8U\/3eSchjzjEO1ByvIgmphBIgJlGXyjPfHNj3sVwryZcorbjVq897pLlEJIAZrrTthlHpJHUlG05hAmbjJsZbjsB67us5cQpu4U1RSUTTswTHf4yHjhP3s5UXLXpyIUm+4nTIZ9TqJTDQGlZQyN2UGWrdCQBfdIhnCMgu\/2aXsQ5i6fZYeaTRhXjGDZtKlthS0BOXO81T49o8ccubMxteBGqFFf9vNmrALi2irDVJ3cVoe4DZQbfjAT9jWLPe53LJAR8N8XzJvdbkO7Aa\/SylZf1LkDBnjehDTxWaaR5Y8tUY0kUUdNrU0D6HeOjX5NFpmOrKHz21IhEVKmy+i50+gq6l27zZ5EYMJu3YM\/V9aylWqWbAq5yAvAGlhA6geYJZcZ7mejPiQyQo3ML\/QLj1SrFXg\/Wx99XPJGdpsx41f4Yjq6lTCV91GiE7zO83kwDs6Qz4i+DBZbOiAYTr3mVhpf9YbxZw4IG2lwjhSpgt+nfTBBfK27AdNvnUyes546Kopnx\/Ui1UpobuW5UwRuu9pQWissd2Hy+BdJ7laD\/iqxPTm+sfW+zY9xR+zynG3ylj5VT94FuQ4zqGrnFMnn5UEAEokqyWvCmDpMCTEcIsCQDEEQxPk3n7vpVAcapbO8VBnrmpgaylIUnkypZnlYg1QDn0IBMxbmQ52vIqYrUZ+IczH9g6i12ON4BgW1L92ZDz8zdAOX4Q\/3EanpP+heCjViSVOwhhuxcaIiQGbz\/0yOeJ6fEZ4EEHhODQT52phhiu+ZM2TBwx3eDjxR1xTQEEgoPZTDMDsxv9HKP\/dF47AYjZFB541mF7OEFDCbmlMRDOqjWAHWVaWgUkwuZA1KnHSdikmrvikihfaMaPDgMJdfsU4aTwT4bSRcoJcReLIY6eF6ZSCNsda3CRvCiYbr2sbG\/CFMzJNZ7pnPsrmRX4tsx1hw1O\/dvM7ykIC5Ym8eTPneFZSeAKSHplh6X0hqsha0mq5SqMHsfiUKyGZ7NQ6g7JsoAXleLiaFDkVJbffau5ztX\/yIiYkSq+OKvOGxaDTS+JEdUo5wUaqGU4qAWAk\/XGTR6s2UIDrTSpx2IskAq63dbThAl8mpWh+n6C2TrP\/H4yhXnRyZpVz+Ot7t5sx4wkCh90wiMR+rXkYef8bSetnAjz+5\/H76\/+CnEJKoi953vSh96Bz68OPmoLQ6AOT1z\/SBjt87JDuujmHVl9Ffp279aI+muMhIykgOOcAJludWp8v66HBIPG1X31Z8BdQs8lA25Tff4hqcQHpkU+CZh9aR+ap5G\/KZmOpUEJ4P5g61Ud8Rgiuh1H3z3G2iW\/ZUI93EltA19hKVbrXPwQDhdxZNtaurtRhiWwe3iR7mkRzTx+QwZAGN\/pr8HUkYFKa9\/xO42BN8EwrCFJ401qFbtYycwwQQPIyF9tFUxiYfL9APSjSAAiN8QsjaD8o600MHu3X+ZLe\/CPA3uKA1tAJJcu\/NY6\/oCSgznU+iUzxIqzo9lL8pyBVXOQLIksCdIEYwVTRAU6dWmLQwD06bNmUV\/\/xAj0jvu7cj2NcyuF+IBdMGR6lhHFisWJriPSo\/uukTaNKY8CWqBsAqIFTrJqdvV9GOZ1\/g0E44W77UDAcxX4FmlncGI6q9qW\/6c6Jt7WawSSNBEY3PMNmrkjP679DpG9U8whzqkpz061ZLNU+MdKTFOTBBMtw1qiG1Yi7bRwZJOgX7VLUhIw7CYKc+Uc8D5cajqldAtDGEGfJZ4muawOq3f+SLJctSHmnR4OnU="}
00919{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1595697574192,"flow_last_seen":1595697574271,"flow_tot_l4_data_len":2250,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":375,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","21":"TLS Suspicious ESNI Usage"},"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"these-are-not-the-droids-youre-looking-for.com","ja3":"077d20c3f8c5a1f091dc937c515b69c1","ja3s":"d75f9129bb5d05492a65ff78e081bcb2","unsafe_cipher":0,"cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_supported_versions":"TLSv1.3"}}
02397{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271426,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"+P\/CRWqLLLBdqyO5CABFAAXc1BJAADkGjuVoEa9VwKgBFQG72MxjNlbOFZ1LcFAQAELyRQAAFyqikxkqJVDWQ42HIFth8ZvD33\/+05z4sdxxp+xbJu8vuIM+Ao6gibWGn76tHzdlsOjFKoo\/SKq3AhXb90tqwKfi7WABZ5oX05X57OEtA9IAgp60m5qoS89IRiABt3DhIS9lyzQNaHEknGLbQ4NkQVqDe5eVJ3ixXy7VtF1K2Q3tj4yG1bHBL8O1scF1slahZqMtehgzlXbxaMHXtlOvlTeG1FJ2f4kl+C3hdUOTFi92fh9p19u8G3i+R6sSNx0UpnzPdxMVAMa5MckNTAgpRPLtogRikMHRV7ob+2EC3ej8VM0Iii3qzRnqasT9cmdngljjOqyM24SaFpDlicMM\/yLyUtIyCloxMbXpHau3ggY9ppcBeGcgN3p1OHs1\/zyQANjD9n0kkie\/5Dt4p7LohMSt1ruh7y8E7e3ll8ThOJ160MI7KMTx3Jsuwc3GC3MoiEVv5GclwIsIfdQmcmJVG43\/57DO0+tYbZ\/21HiUqSh2bpOWMiFyQP9FI4OUoKbEIfZVrujGWfNZcEJIZvTs1i5yG5js3yUEeoOKf38vyE81Cog3zFnw\/Lo5kOgRMG+lShd0jdY7MlzJhpYv2SKKeORG8oIY0Mqd6djT4\/lM+E8qLFNIGDvOIFa7Gj960ecLIXXg9ECJNbh2nWkoXSkdz6OxVjpYd+14Wm1QxiVn9vhhI7OLAHCZuvxIrx0M8HVlskS2QB1FEct4yhuktbvRHFMq8hsAKTU22Yv9nROmGUwAPZ+dQZNVOngdywxnTlqencx8HlJwSPbvas5FzQkQ0nnkM36B3mtgync5p2VWEf+KRbqM4IjPTMLcGK0ElPPbiM89d5Csa4LgTUjjb2rl8\/D+JLR2wQyjl7\/gcUX50z3KqIwmFgrK9o0ZVi5yhUqnfeejt9VBgYRvf3JKe92mZ+ZVkwFPFeSevIVcI1t3QswNcEBV2wQUSRWeUDfRe0n+IxzsRJsA56KNaiMvsuXduxE2EsuIY1ZVU7ZhbU9lkwRsOZhZHxsAExFu8enJ+byhOZujeQNzXmXzZOC2bS9qX67a0tnIPxRr3Mv04HTbIK1B7itczcqSB0zU4KeEv4LIVMRC\/mv4YMfGGzJIythskI\/r2I8rzH3WdDtEKL0KSmsaQsUUSCvRZkFLNSOWaZUD7tOM009AnP68Ffj723ifVu1SQanUu2H4j3iJffH+AG0gUEqhF2jYt\/cLDP7ZwWR9QxY3PZahoTuOUnflD7vrJJO5u5S2CWg65ceHz6F\/wayrIsrgJ3GF7T6gAFWsMobT1wRNnSfPj6SSuKxeTCQpI79gfhCOMEYg2UZFkoc509XEkA\/8AXagX3lEacvGoEczdVv7WucauL64EKV72yfYgP\/Riz\/XPls2AVvJ6FBrtPuRecnoC\/a7DgkcJfININqi9EEo16lVqt37mPsN56DyAvBkCCoGvqAYu1uu4Ot+z9dwwa7k0Qnx1Oli6XLpK6V99sXo0IzJ0nZXSAQFqnWCdhyWQ3hCHv9jO78\/5YG3U6\/uv6xHK1lDy4dQbcz62c3rU6MBK2rFggzwYpmQQbK7mAX7ZIEw9Ukz4XYO5oJ\/2HGduFmgBEqS3qY7x\/B3p4\/SvTqzDWULfeVHa5MWz6bY7cJ6FU3Ja4kF2iX+bzlDb34l2ZYkGCJGpwnyFoRCVIyEMzxLZD+vveW+HKfsSNBKASm2LjCWgeRXMKcrDy1vxPEnmAF0HS4qQBpF2rDZP8UXi1SDkixIoORkDK4EinMDgIIZwcT6pv7H+j9+enInC2maFE7Cg13qeVQvRZvL2QkrbyXo0KUJNZ\/M4DZlnvbT4TITLxy+CvB8Kwe7EluYje8SCkm9pVu6uQxEczWrApxwG5f7LsFamd\/NsgpP2bCRhNZ2kJbvilaoAm14FmmmwCgyZhMj3rP0PoWFp2+HJHwbLheNvovUHwdzRs8TUcKs2RRWLXs="}
01788{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271429,"pkt_caplen":1055,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1055,"pkt_l4_len":1021,"pkt":"+P\/CRWqLLLBdqyO5CABFAAQR1BNAADkGkK9oEa9VwKgBFQG72MxjNlyCFZ1LcFAYAELK6gAAT4ghP3hAvHSRvYPIW833T8rF0Vb7KH06FoewTAHZnqWdySNvGA1BxAjRnqSgkcaszyh2X1zXq8n1rU39mkjuPssXpNy0Yd8Ntqhr6IkjitlXdgtlJj7xhQ9UoIiZcvWuA9jvhC87nawMNDWfhT30qW75J6ZK9p0l2LAN3VHcyhihPuPbJfm\/hoEi\/ZSmP+iVcMdlFWkWGov\/4oIFO3D54v\/gDoDobZnoZeuKm6uP3MVRtY3shfZ\/6tU+n3cv1o2lLXa7HtFOHfLrQlsoEWF2lM0wW0SPZh9660o0z7UmRHP95Lt8306pkdwCmwWobpv3dGfSyzgFjC37mALM8FOGWtRHCQVxTK1bkVH24\/iO7tnwMiLfl8+PCfSEIcn4qZabVpC66oynF4PNse79A\/AE+MPWCgJNcoT\/6gnSaQv\/kt1G\/q5cglaY0Sldw7DZSvmK2mI0YORAsgbnwA\/PozxLNtIu1xIZi8eo0kzP9lh9WRd0HFfGTBfOC2kswb\/V\/oQvfBhvGGlie9PuybXz9t11+7ADCk5VShjvcWkFCuWaJlqksghDYgEje9YpFuzKEz6HrmEpRdMAipEQGzBUR7C9DraNH6ZW1Hm19SP3mrIcPZq\/c2znS5bfngweLUV2+pEoGq7zHM9g93bMoyxejtCRGQnj1ApcsicKQuMgFzTknAi51AHU3gNqaFQzxnWTO\/2IwhjtfnL8UV\/hmQwqj3z0VT14W6w14nO8\/Nt5SgRZPmUHmqYTno\/JUC97XXejTt65r\/2jugM4PUNLMBrvNciVpdEWv1EqcSKzp8lXlQIabRK3SWC4aGbqoCZDZ0hCIcacSlmeepx51erWBYsrY4ESdj0CiUQvXO0gkFZzeLr68KUFJfxUTfMyPZ9y5V0Tvmtp7Tc2NzqYj40LPLP+QansiTtpBxYCofIBujKLdlrZfUJq0jLu9YHZvJfi\/D5RKBu3O674y+CgVem6PWZvyamnLea5EZBDNHsJLWoEyY1bXRvDRMo9+lWHpo9MhMTyWAI3W7L+ub78UjSEJrmIy+Fu9c4TfagVYoMHaLErPhMpGinA7uA\/XqdtLkN5PFGr5Oh4y15ad61bKv9i0oYpqyrPiqwiqakOvHHOatdRayOfXKVxbaefKxL25FKFrwB\/TmHLYL1Lx+4Yj\/bwVcUMTK69GE0+ZJfkXRCaK6CX5QTG1YCk1dmU2nInmT3rTJiJTK\/i2AJVwkIu9HaQAkkrQuaY9RuYSAywJnJ+oIJQS+7cLIFV9U1ceZipL5\/XiRBi\/cDlf5cTH8Z0SQkIGiENPtgVVt6EUK\/c6dMFflSUh8S\/42FVl0Uk\/FJRkk8="}
00417{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271554,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjMAbsVnUtwYzZcglAQD9LLkAAA"}
00419{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271555,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjMAbsVnUtwYzZga1AQD8LHtwAA"}
00419{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":271869,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjMAbsVnUtwYzZga1AQEADHeQAA"}
00509{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":272557,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"LLBdqyO5+P\/CRWqLCABFAABoAABAAEAGYWzAqAEVaBGvVdjMAbsVnUtwYzZga1AYEABPqgAAFAMDAAEBFwMDADWnb9y0FjHkCYXa9Mv3oiIw58kpLHI9hbCkpYSKwjbT5tmhSsPBCdwAMupOODdmzMyN2MBnEA=="}
00588{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":272682,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"pkt":"LLBdqyO5+P\/CRWqLCABFAAChAABAAEAGYTPAqAEVaBGvVdjMAbsVnUuwYzZga1AYEACVEAAAFwMDAHTbGkXPhSFh2EtBT4Ucf2la9Me1Pr\/cnCufOWXr97iBYl2sFJjp6mds9gcEN0NbujkofpclXD\/7+RfwBuf00YU6dfzrsRTSZBOq190E19skhMEmjtDKcO4oViXiNfEnYtMrdsZgdVLAYKRQU4zDKuBqkYlDYQ=="}
00419{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":303215,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAo1BRAADkGlJdoEa9VwKgBFQG72MxjNmBrFZ1LsFAQAELW9wAA"}
00419{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697574,"pkt_ts_usec":303765,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAo1BVAADkGlJZoEa9VwKgBFQG72MxjNmBrFZ1MKVAQAELWfgAA"}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":21,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1595697597731,"flow_last_seen":0,"flow_tot_l4_data_len":44,"flow_min_l4_data_len":44,"flow_max_l4_data_len":44,"flow_avg_l4_data_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55514,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00452{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":731441,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"LLBdqyO5+P\/CRWqLCABFAABAAABAAEAGYZTAqAEVaBGvVdjaAbvycO9jAAAAALAC\/\/+plAAAAgQFtAEDAwYBAQgKRX6yWgAAAAAEAgAA"}
00436{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":760281,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"+P\/CRWqLLLBdqyO5CABFAAA0AABAADkGaKBoEa9VwKgBFQG72Npkmiax8nDvZIAS\/\/9OXwAAAgQFeAEBBAIBAwMK"}
00418{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":760372,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjaAbvycO9kZJomslAQEAB++AAA"}
01284{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":760792,"pkt_caplen":693,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":693,"pkt_l4_len":659,"pkt":"LLBdqyO5+P\/CRWqLCABFAAKnAABAAEAGXy3AqAEVaBGvVdjaAbvycO9kZJomslAYEAA4MwAAFgMBAnoBAAJ2AwNdJNFyReVirRSVojufnGMbeLCCSIfasM1ieW4FG8of3hAwM4m8b00Q9oV+Hc7T5oMLAAYTAxMBEwIBAAI3AAAAOAA2AAAzeW91LXRoaW5rLXRoYXRzLW5vcm1hbC10bHMtdHJhZmZpYy15b3VyZS1zZWVpbmcuY29t\/84BbhMBAB0AIJnVpjNl66MOXpvmx41gUQaYeiX7Z6hw7BwkUWzRGGpOACC\/cH4IalVfPmYOxS2sC8vou1xZe1ySPybTPG6RJca5vAEkS4DxHD4+QDhSKdiI9dtzmEYOX\/XsngPoMxgQvNMUwzIntV9PDa3UuBPJJ0uISr3A0kNEKeu1WYMqXVS11VsTg2a9oo\/43miikoJcoUUiy1+yOgTMZU6cbZxblnsgUg1\/xO\/snQQVSkBCjdT7iXQq+6rdARBQIPBbI8RPIWgC\/aX5zfvRKbqhzKSkI16fHp0WqW\/nLO8BrKQzxpfdSdI4nhqvgX9U6XHk8pDekey4Olh2o7N7l+ZuvLuQrv4785RVuirst7QWHRV2Bry+Hk0MA5HVdlJYWh5sSSkPTUD9beLuumP3bW19kkE0M1up6+gTpBl9qsjvZgOotscar2pvqtkrE0XfU6KUOEWnq2oJz8N4PI+8cq1Isu1cBJJOnfv1frzevwAFAAUBAAAAAAAKAAoACAAdABcAGAAZAAsAAgEAAA0AGAAWCAQEAQQDCAUFAQUDCAYGAQYDAgECAwAyABIAEAQBBAMFAQUDBgEGAwIBAgP\/AQABAAASAAAAMwAmACQAHQAgyNi4uav9JMuW\/0Qhwazj9bJ0hRmofP\/tRvglJ5t3J3AAKwADAgME"}
00878{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":24,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1595697597731,"flow_last_seen":1595697597760,"flow_tot_l4_data_len":755,"flow_min_l4_data_len":20,"flow_max_l4_data_len":659,"flow_avg_l4_data_len":188,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55514,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","21":"TLS Suspicious ESNI Usage"},"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"you-think-thats-normal-tls-traffic-youre-seeing.com","ja3":"077d20c3f8c5a1f091dc937c515b69c1","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","tls_supported_versions":"TLSv1.3"}}
00418{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":798677,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAok5FAADkG1RpoEa9VwKgBFQG72Npkmiay8nDx41AQAEKMNwAA"}
02396{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":802693,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"+P\/CRWqLLLBdqyO5CABFAAXck5JAADkGz2VoEa9VwKgBFQG72Npkmiay8nDx41AQAEJ+WgAAFgMDAGoCAABmAwMYnKu1Jz+6wQ82eQfnPz1iBy0pMTqXSLHRMgZJarxZjxAwM4m8b00Q9oV+Hc7T5oMLEwMAAC4AMwAkAB0AIGTvR4q7UNlprJwAqSF2GX0R3EKGN6QfuwZhqNEFK0pwACsAAgMEFAMDAAEBFwMDDteVaXbyXZkQ\/cI+WQumU1mC2rlwocG7oLUHshsoekS\/A79Zaxr1OjC4xM3FQR1R26sPv6u\/EqxA1VGswfTcKEt51IksXsMaVKbbPBlSkvXmJ0\/3wRTOY07XOx+r2fnL84lylZjbtoo8B9Y1dKEt8d9sAZlMjuLs9PoyYnwImlz+P2JRe1+Y\/tLNvcXMhdXI\/HZu\/yloKGvKvouMlVMA44FNj6ewgfbAUGFYdp4eSZu4t7JsUiUJkDRQrcVbYpf3mfJE5QpiV0mAgsU0rGsXrmKUDRhLm+2D9Re+PD8eBqQl8HDGOp\/ISiBuQT+yJSAH2DKOToTO88XAmej0oXmdQSiD74Mo+jePgUV0vOUyjM25DaEyyAVNzdHQXyOaFlsffCs2U2WBJU2boP9TYdzEEqdNuXr5NMfhKSIwO963a1PuzQ3hjyWcwsm8Bj8NUcgQ2vBmwrwvL5DhOz7pWqYERn+JR3AzJcSousSIne+GmBraIGCO9SispoCMfn6MGqtvr3gGefNz\/q+KP8Hn9w8YdCRqeHbXcTU7x1tSP6dO9YdxDvRrcjitaTdjJqnRd+ltSmQejZuHF0nxse3xOSnkUPk4hEqTX0nUKDJqDru2EO3EtG2EThZDiczX\/0sKwPmH+WLMEXYNz7rNUTJHvU\/nTwyGjXW69x\/x4DAVMDZPWavpi9a3WcS5uttBaPYPFTzqq9qjdv13KRLyjB+lBnRkVq850hgPvjRH+mid\/9XN2mELbCZqmMhC+qcDgVYcilQEO1b8VbBkEco9qFfZEL7nVzxKPP6rlUFF4z8PiVfHqmNIQ3eAIQSYhuGrbkPE2pOpPNiEnpU4bhVsfVuwq0s3ffLklW5WX7GYemfENVPGYG7HCA59klltW83a3qj3b6sgYhKN4OiP9jiHDdWe4HYQisWM4936AA1WLOm0wl5QjKazAOO7riO+\/bo\/o6HwWNKbgKQ6BJ8lCgU+inZfsifvF5ZGqLJg+sd0L3cWV5ZsZ63SHFLYvnWLUhJEUttvFVo5bXUBmruggUXtN3hYpKKLXqzOS+iy7XwmKSCW8lx2EI4LwGyhGvUgE86w0+Z5szxT0fqUvYmOjGkMnsXWkuLQQZiW7Lf4g2YqoE7KR2P9dUejo36\/OZzZ1oOwNLfavrChxcwQ1+xvl5\/hS8xrq5CnwmsTqf5padEsIB6yRk3d2smXhw6aMUPQ9ux7spoUrE++3j+P74C0Klu6t4nT9RY+na7P3kWRGAEenE5RgIenxd7FbhS9A0MpRwC+IH5tnhmKLZlnLQAbDB074\/MkOIhNkxkbHDIr90MydtSbR6P6ct3JLVmPViV2PHhgDOP0BDK39Tu8469StctyQcUSDnyWp43y\/+hOKcVNzTJtyDEH3Tx+20y5MLBb\/YjVz9DP60PbixpIeynBJN9BaSLuzdoLq33e1TreXUCbCQwebQOGPskm2exOa8LMXjcNkqL9yat+rJo3zURd5ampqiZtI3N7zqIivk1dlEaRKbdZZkZQ1wXFW6HJoFdjOs2WToXdi630rI\/dTBDSg\/HE2eqOSO9MYTmFbVG5Ti9P2EtnTtFugIj37y8HEILLYoLOilZntzHh0e5vXGFUYQ6wqxIVfiMrQ322GxPeSFLMCsZreWZGLgPPa+\/vJ7hHank2RtD+8\/4s98fq7fapNFv0wDdXBExSs71U90eBAgH1GwcCOoWe8Lh2JtmqAKMF+7WGls29e0eZdiGXuJ6ncrIDtbbEacfHP1zJnVDSjIoMzgUkT88soPNsNHJrKscyTzGQF3o="}
00925{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":26,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1595697597731,"flow_last_seen":1595697597802,"flow_tot_l4_data_len":2255,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":375,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55514,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS","21":"TLS Suspicious ESNI Usage"},"proto":"TLS.Cloudflare","breed":"Acceptable","category":"Web"},"tls": {"version":"TLSv1.3","client_requested_server_name":"you-think-thats-normal-tls-traffic-youre-seeing.com","ja3":"077d20c3f8c5a1f091dc937c515b69c1","ja3s":"d75f9129bb5d05492a65ff78e081bcb2","unsafe_cipher":0,"cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_supported_versions":"TLSv1.3"}}
02398{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":804171,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"+P\/CRWqLLLBdqyO5CABFAAXck5NAADkGz2RoEa9VwKgBFQG72Npkmixm8nDx41AQAEKPEwAAcS0g0F8MPSbyVgblbbvu6aMWx\/vmdy147oVtvsmmle7FFzAjy6q7XEHxhlCVy14thXmQuWJsh5I9OVhcyKMrVlBNHB2hL8uzTYwj+QmW3L\/wfqGcalT0XrIKmH+r+0zGr3CH057s0hOoLQJMTXBk2z9LT9dBM0yfsoGBkT+h9ErlxnayUC+\/IGfTvwXs0L4r2q9hbxlPb2N5I6HvSoF2w3h9maKFhSTXh3KSM4taVbzUh7Pc87y2CGZKQSHYVdby8swVwRW4kRG3FcvhfZUjqKur\/6WUGJKOzzum4czceRX4ApEbZiczBlzrmgGusnjuYjZ\/nv73rVl4S1Fu3754+ExT8L+ElssXxdzbktiTDM1pAG88NzvjJEjeh1MgtZpf2Q2OhlZM4apLSHQ4t2BjJIydHSxTairFchqp1lTH586jrmu5Ip1ePFtOc\/77vGAdgBQD9wrTBLtlCnYBEJPDZo7nfGY1Vc9mxS5h\/jSRqiOdfdy0HBozammN6+D6BUbb5qOZbgtL7NHViKd0rnS68GmgdAR+I7nc+2bpWDJOL9pO0vkm+xTE\/0gqZKu473BYBD2uKb2fqBNTF56c3pipjNVWOsmz5bCjU7mN23Cv31KxAeZqdnNBA+5\/lezEjaXt8mTpAKz1yhiXoKu399U2ZehQckUKK0KVwAlxXSHZG9JcOe6pk160aCH14Bz+hd3XGnubzMhrxSENohNQ+5XJ5yfh\/T1BYJqc\/HCaZBymoQX2+It+Di1e9j0uq4AbdXeA+rZBu9t1EfvLij\/0jhU7UePrwYWr8ek6TZdP7ebfHEy6BVNpPeLlr+llYDIe+AsDiqD\/3229jHYi+KLnQoZiZjF+k9qYlnwMY1ZuuL4OGEELPlFgz5+Llt\/Dg+O1mKpnc1qaB5fQKEp2c8A1JXUBoaW4p40D6w1SU9O5DML94Fuf+NWrmpm6vcPq1w6rXrEeTve\/5y7uO\/h74LeiOvWasJnbUePBYp4jMvIKoW2peiTz6bxnFiFQlePehhe3nKLR+hFiIyymS4MHmVlZvBds9xb8JRtlEsaQT4vz1LqpfL0ILLOob0ZzkcQFDjJlpe2HsbSalYISDUS90sDbT57r5ohZRH6+GV+lmSnJ0B2tSS175fj4fHzVWyXthVEbiEy8hXSlMf65NnX4SGPphG8xB7b49BoaeNvJLsutJlwlx5SrwyekCJwFv8BSiioFpAkEfoN1XjFGxaZ24oPVPsANsdNMjwe0grs6GWxrjBtbG44hMpg3dyQEjNDQjdH3fhN3\/F0nUIcRZGcu\/YREkBiUDX2F9PT32QyEbKQ\/3W5QRsB17GGdWt5Dt9NkEdE4+cAv44jPDfok7GV8uIcTLk0FmYXVY9ifq1itCTkVkpPgjOQQDZkDDVYMN2PrwbuzbefUlJVLar5amwhhuqxTvNyngX1Z8yBWsQThfQyQvHqqrvD7yvB40YHChnKi\/tCRbvYe3QUxIR4\/OL9OlIfqH2ohPqAbcmzPWjYrJf1tvlEm5gdEt3QgIksMJDlE24NhIdagUywnsFSitkdvJVqwJxXBrrInapI\/2XPCsfhD4zFmKGRXpaPMPWj\/Pdinxsf2QwGAPn\/2cpZ\/d3ICxY2TBZsCM2rOKJMEr6qY4ZUHfB4Qp\/QlNwmKfSwYbWPuVcw8YQ1pbWKV8CUIJo+DbWmw6a9+RqtTgiTc3rGSs6UZ0tLDOWDeg6vWqGU98ynRlOACZrOQ6wDGkVFh0NUfgKyvPm7Z2Pmieqenx45WsLVXW7fIloghReN0laudYfuWqFryJ34joxgR47QYAIwTPMhzOnxRfzGfrjs96cpta97KsibCQ1shPcl07mL8X9mFj+ypEdHHkZKxgctVIJ0Cj2MlNbHrrxY2ORAEtkmHmMI+NZGrIev0ZvJ8h1GgZzqrARuVzyOJ20Tr13HVFU8FFRFzzvajUCJbqG0="}
01778{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":804176,"pkt_caplen":1055,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1055,"pkt_l4_len":1021,"pkt":"+P\/CRWqLLLBdqyO5CABFAAQRk5RAADkG0S5oEa9VwKgBFQG72NpkmjIa8nDx41AYAEJrKwAANlaIPKqZfmwL6N1QJJGCIWYRIPt3urXE7Q7ayAmLBZsyAQCj5SQN8uw\/+3BXbnqRJgVvfkZaiahfccUgoO5sF39QkuzfLPVYwIO1U3g\/ZPFWt0GUer2ksvwRvMCaejOMH\/ePM+aH4IX4b+WhjvS+kt0k6WGLr1x31L9RIbka4q5FgdmJjrxW1MT8z85VBW6WuGpAqDgi5KQj83UrRX+hnrxZ51XD8nst\/oNpJwJAgGBFPOxWJpq1ruQT6zsChvqmjzaCu5YmKL82bzXIUNmFcfe+zxGFeYSHXWkI6SR1BKqkbio\/YdXzPi6ED9U3YIP2vCGAJVDlUUlXDNJvuQCtHMJXq+dAUg7sndO\/RrpL9MFrJAQMfcMk65ffrN5+TJeb16JlFjqkcepAe\/9MCiUJCTBeK6BqJ8ZrtzljcDt+a9vGj9H6p9put2f0O71cWCD+T9ZPlvDHC3CEZ4oPdVfXbDB9L5BTlnhSFpaO+Mp13uhVIWh29Ydpig3vaVjjGSm9\/ZE7E2YMLjDpan7SQ2zy43987HpcpcvY42MMWUjB08eIzJ2wghnZextd0JXczlfWdviXpV1NFgJPH5+SH8SLEFunCMX\/FWb4Ww2XshPRvParY32hYZ9QwzGDYIk5jpuAw2\/Gws2JNV8pggxRc30ecfhBPWkW5GNgGyJLXd3gdUv8kToUclYLWh9Fl1OUQ1vUAqTTgHdtxccQx3z9AmRxdk7s2RYbamZnY7eDjyGFrApN5WyLA10tNwift0ywIbLCEfwH4mriRMLsGkS+yIY5v0LyHAPZLDvma24k3Y10pcWlr+5EFHA6KEkGU7pAO\/xzBmMSxI4pHtplXhxsBewL0GnTOWG\/WSjNLKskp4B\/hWiOIgAM2kpooHFyzI0zJ06i4DizyzpeZw0eY+q6NS2CSfNkjVybHBeKQqka+0TNScdvt5W2RI\/SCdKnZygysYhajKxywAwmJyGPW71O\/q668WQhtG6CymZqiJC17RagLWkkHWLVVavvy4AdiVd3Vdz9HUWlgvwxuums7NmvJDzjs8tEFSJe9c+Lzux2k8Ypq1JuHRTzhVcK94gQJ1qHNvm3gn4ZLfXi7qzxPKWv5aMbRZHs12BMnhrpsOIfyRQp2N\/x1cW6zcBr4Mx4GQwvVTvxJHBktXR5LLWuZV29L91xIJJYsVtejg1\/v196kjx3M69qBVYmjBkk7sss5LtKVS0k9Ci+76hTJdm52fU4cmiDMC3USTV4udRKTx+XDDwCbCXRvOabP4kqlGXczLEFXzTtAgXq0x7k56Szmy6cAgWZnjhFZ\/CXQZJKw2U7NF2lR3JHw0ySphHuxPs="}
00418{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":804261,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjaAbvycPHjZJoyGlAQD+lxKAAA"}
00419{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":804261,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"LLBdqyO5+P\/CRWqLCABFAAAoAABAAEAGYazAqAEVaBGvVdjaAbvycPHjZJo2A1AQD9ltTwAA"}
00510{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":804886,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"LLBdqyO5+P\/CRWqLCABFAABoAABAAEAGYWzAqAEVaBGvVdjaAbvycPHjZJo2A1AYEADIrQAAFAMDAAEBFwMDADWIDEokt5taLIJzA5NMYG\/eYqA6KC2vSRqyaE484F3ECDnoz6ppoluplBDgdrgspboN28s30g=="}
00588{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":805003,"pkt_caplen":175,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":175,"pkt_l4_len":141,"pkt":"LLBdqyO5+P\/CRWqLCABFAAChAABAAEAGYTPAqAEVaBGvVdjaAbvycPIjZJo2A1AYEACakAAAFwMDAHQmqSO2Rj3PZrm5EQF\/q5U45+97psJI4MT1NwULeuI4yAkC+dXv1sSss7LXjO92DmlU7FNtd0zWJi49PyFyA35TSov3A2yWn2fF7Be\/bBx+Uh1139L3KVXSGKdgjuFKawrqJhVeEZ1RPzqhdht2NYYTL+zmRw=="}
00419{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":33,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":832925,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAok5VAADkG1RZoEa9VwKgBFQG72NpkmjYD8nDyI1AQAEJ8pgAA"}
00419{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":34,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":833514,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"+P\/CRWqLLLBdqyO5CABFAAAok5ZAADkG1RVoEa9VwKgBFQG72NpkmjYD8nDynFAQAEJ8LQAA"}
02313{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":35,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1595697597,"pkt_ts_usec":855003,"pkt_caplen":1445,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1445,"pkt_l4_len":1411,"pkt":"+P\/CRWqLLLBdqyO5CABFAAWXk5dAADkGz6VoEa9VwKgBFQG72NpkmjYD8nDynFAYAELIhwAAFwMDBWplzicVCZkneNntXmzlkgcFPUoR724b66\/4aFGXjza5mmC3zqfD8bM7gil7myUhARY2kw9OHvr9uwzPmTvBHjRsELIrWZwcLZLV99JfhGJTo2AoCcZCgLpYTIgfIUP5yU7xwkkVNn+vj1tSupzP0tmv56auqdA\/UR+KA1PORkvMHA3ya80UFD6NE5E0Bg7xxaZ6cP0Px7YhPWHKZn6s4KxtzuFOOydj9eGw5Kehc\/SnpSlwzmcxdp3iCWueCFDfp29IsYOBx\/gPDnQbEVHXpyd0ziy\/lVYJCR6VM9MRn8QvKeGW3AiZR4yFbraogEKpcTGTh1T55hGtYvibNUKrIBdcIwzGVctVJ9bIWJ8pypthvUjVxU7s9kaKdI+vH\/LIT1Nj\/kTSSAsltH2kDpRkeP78vWQVSTKSa\/NLd7OJuWWyHjfdMVIsulnSNLRm2mLF+DB\/2DgVryJ+Np2bhlT70OQRLbs5mXEare2aozleJtcUPNPTD8weucmD8+PVHdQUdlfUTt3zjzhdzsp82hjYg5yjrJpzTSonmIPTNwOpysWltsa6zXRjk++cCbFk6QUoiZ9+Dn3JJ4O5fc3K59ax2s6cgnpIvwqQkWpV4WdTqyWxjefa498GtVerV7PY\/XzcsCtBEWzDdjlLDmwBobWpGfk3s\/VszXVEAR4rwm7\/\/yu558oAFlDkTgiBSfzj7qp00\/kRFuxfc3L2G05sb7A5RRZ7sr3OJE0pckqzmYOP26SoI1UMKRR\/HW7PxUmEa+3WKEktQ3kYEFQrQwxdy70ku1m7PjlyidteV5MEOUoIILdx75zVIQaHbJcMNE78mY5kgGcqjPjHDKQSdksBlgoV025VzfLuNCoo8kMBGIGzuBryleLJHnPP29XCAqV6gYFw9PiLwC5V9dEcjAnkr4apoDL1NTRE+ca4io6PUqFcpjKEbz1X\/bNC2EPVLRfm9+BFFYjQpR7\/AeuLjJEyVnbvapEltGx1fTnDg5+p\/viBdp9FPrECd5xeMKznZ\/Z5uz7VTMjvpK5c\/6dtLQ6MzoNtDx6U5vKyu03ougGxsI67C96xoB8Ru9mrmEhNLGaZPMo\/MRHGcoWPWdMu4DD4nrPmUrq7hJMKsmFPV3tyhx\/ZUIqLpKeZdTP7ffnHf6G6BjvTfKoi8RXLa3S18CBhnC+bfrYD1d2teesludojFv\/XikOZSDkYBRSTeC1ECOOalXjjIkc2AZd1XaxX\/729CzpGwA0n3hvku6mS9RZ+KQhlhv\/dCRi45nUxoccgJQQaBNSCpC9jU3xQOF+ZEOweldBvTqKcPu+Q2DEH4H0dQIFQWnxk\/DhQY4Via144XNb4Bo+4k8s271yWtexNCD1KfV2TjPrCNb6XVaWfklvPy3BpTSHcfinyRMyVNzQam\/e\/vOZRMuTmWx\/HIjOVWq5Ipi+MMW5i8nd7G12OHiuFMIhjlyt5uSA5H8QXC0aY6O2firVleGCsdkSDTJ0qUe3PMMtHhXoMkY24TtILf\/hZk\/u5Bbn6h7m3wcle8fSJFRbjLGhRfoUeMBRG6KbjmEpDoeCvVvDn3MEI26y4dLEtY6O0uPHIP6TTYInmwFv51IzzmyLwQKuWJnZRAISY4Lq3SAOetGVLBgDL+tlvlCu6krmwzJzE1DgAjIjr4TjX9JKtMSJWDu9ecXMyAkU6c\/sSb9HZq4Loprj4HvS9SCMdbYMyQye3e4YdAWX+KS98qzGBclqf4EZV255jjHhTlQMCf8l4+bN5U8wSPZbVeatya7uJFa7OmqBgpuzwu4unc9EHFcOKqGY5ZFnBjvD449vjrPDMJ3GKlrwyQp4JU+DlPlxYM51pSY5AYewjIEAHGag="}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":20,"flow_first_seen":1595697574192,"flow_last_seen":1595697574326,"flow_tot_l4_data_len":8051,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":402,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55500,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":18,"flow_first_seen":1595697597731,"flow_last_seen":1595697597855,"flow_tot_l4_data_len":6556,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":364,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.21","dst_ip":"104.17.175.85","src_port":55514,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00137{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":38,"source":"tls_esni_sni_both.pcap","alias":"nDPId-test"}
|