1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
|
00383{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"wechat.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"max-idle-time":600000,"tcp-max-post-end-flow-time":60000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"wechat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1492167337792,"flow_last_seen":0,"flow_tot_l4_data_len":636,"flow_min_l4_data_len":636,"flow_max_l4_data_len":636,"flow_avg_l4_data_len":636,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54084,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
01239{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167337,"pkt_ts_usec":792745,"pkt_caplen":670,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":670,"pkt_l4_len":636,"pkt":"eJKcD6iO8IQvSpdgCABFoAKQLFpAACwG+e7LzZeiwKgBZwG700RsJQvmFiW5B4AYAQBhCAAAAQEICkXRlQMAMKrIjxNPGb1b2gIOFmmrodrIUGWpRD8pBe\/eyANOuHxnf1oEiCDKQxkU6yvgqiltC85O1YOlf4+boaZn\/v7U0TkR+lQ9a8XEdMtbUDNvRkN1lpLANNJe9T6WEXQRZhhQATyvHXIsPxznFQlv1ayF4fN0Lp1Tv+DnMtPovG4l64Fdnf94BKNh3wpUis\/1aaAJUl4N4QYAa2BN+MLHUIjBfzQomk58kbDVZlQvabo4eeiFrJQbG0CRtmIDLIV4UlMABwm2B+L0SD\/lX+vPdRjlbT0hOePKWkrPVp4oa0GnGMtovp\/3dKKj2adHC1yCvZqzc+T4heafDFJJDxNGnnTZtJeXWQW2\/Wn0xAXZa5xeVmiob7mVi7gQwqB4EyVdzoi+MdLqv1I0FdZ7WKuu9o+r6i7T5KxQ7NhUIRC9KEInuscbFfTp5tcTpkg81VRtJhveR07GYTrLSFchnUCEzbFpCOPEOlfHshGkgemcZqUW0JSeBZoVIhGHuP8IElk+zTdckKSFR7XZosRv+JZpXULghhsYEQIcWSnXEwiNwHqD7SkijDTYTSRARplFy3lQ+I9PYai9e3wxDdj38dt3ZjnYHW+Jgcvyxa81TfaFhCzMBo8JWYVcQLLQCzJJ7po8hcjxwSKSvs1BzLjoAmGIOQCY3cD2niwBo4mLwkfrwM7iYYbbTgCByxdl2XUzXKGTmMiV+yqiF1sadTUF0KDk8zQPlxqASeejWTULCaKDKO7zq0WMvrWWgtPS5+WycvqXy24tfwXRN6su4lzlC8cmzA\/wzbACdxOu6m0puRk6CDMzrA=="}
00421{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167337,"pkt_ts_usec":792797,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0B7NAAEAGDZLAqAFny82XotNEAbsWJbkHbCUOQoAQAk6qQAAAAQEICgAwqxZF0ZUD"}
00470{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3,"source":"wechat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1492167338426,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00445{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167338,"pkt_ts_usec":426301,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEuMlAAAERHdXAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"wechat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1492167338426,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"wechat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1492167338426,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00475{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167338,"pkt_ts_usec":426352,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00555{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"wechat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1492167338426,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00445{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167338,"pkt_ts_usec":426605,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEuMpAAAERHdTAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00475{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167338,"pkt_ts_usec":426637,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00445{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167339,"pkt_ts_usec":426956,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEuN1AAAERHcHAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00475{"flow_id":3,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167339,"pkt_ts_usec":427069,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00445{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167341,"pkt_ts_usec":427326,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEuPZAAAERHajAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00476{"flow_id":3,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167341,"pkt_ts_usec":427438,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"wechat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1492167342857,"flow_last_seen":0,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53734,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":857618,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"8IQvSpdgeJKcD6iOCABFAABQ0QRAAEAR5OLAqAFnwKgB\/tHmADUAPEQCPBkBAAABAAAAAAAADHNhZmVicm93c2luZxFnb29nbGV1c2VyY29udGVudANjb20AAAEAAQ=="}
00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"wechat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1492167342857,"flow_last_seen":0,"flow_tot_l4_data_len":60,"flow_min_l4_data_len":60,"flow_max_l4_data_len":60,"flow_avg_l4_data_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53734,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"safebrowsing.googleusercontent.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00701{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":893346,"pkt_caplen":272,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":272,"pkt_l4_len":238,"pkt":"eJKcD6iO8IQvSpdgCABFoAECAABAAEARtJXAqAH+wKgBZwA10eYA7qtlPBmBgAABAAIABAAEDHNhZmVicm93c2luZxFnb29nbGV1c2VyY29udGVudANjb20AAAEAAcAMAAUAAQAANssADgJzYgFsBmdvb2dsZcArwEAAAQABAAAAxwAErNkWDsBDAAIAAQAACYwABgNuczHARcBDAAIAAQAACYwABgNuczTARcBDAAIAAQAACYwABgNuczLARcBDAAIAAQAACYwABgNuczPARcBqAAEAAQABNLQABNjvIArAjgABAAEAATS0AATY7yIKwKAAAQABAAE0tAAE2O8kCsB8AAEAAQABNLQABNjvJgo="}
00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":12,"source":"wechat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1492167342857,"flow_last_seen":1492167342893,"flow_tot_l4_data_len":298,"flow_min_l4_data_len":60,"flow_max_l4_data_len":238,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53734,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"safebrowsing.googleusercontent.com","num_queries":1,"num_answers":10,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"172.217.22.14"}}
00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"wechat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1492167342893,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.22.14","src_port":38657,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":893680,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8j4ZAAEAGJj\/AqAFnrNkWDpcBAbvnsj+XAAAAAKACchDgsAAAAgQFtAQCCAoAMLARAAAAAAEDAwc="}
00435{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":941852,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8xIIAADIGPqOs2RYOwKgBZwG7lwHnJuhS57I\/mKASpajHRwAAAgQFZAQCCApd2bi8ADCwEQEDAwc="}
00422{"flow_id":5,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":941899,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0j4dAAEAGJkbAqAFnrNkWDpcBAbvnsj+Y5yboU4AQAOWaewAAAQEICgAwsB1d2bi8"}
00722{"flow_id":5,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":942107,"pkt_caplen":288,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":288,"pkt_l4_len":254,"pkt":"8IQvSpdgeJKcD6iOCABFAAESj4hAAEAGJWfAqAFnrNkWDpcBAbvnsj+Y5yboU4AYAOXwqgAAAQEICgAwsB1d2bi8FgMBANkBAADVAwNGweD9NUKL5AVTYyYP+mu6+yZ5eVPxgI+DpY7zF4i1IwAAIEpKzKnMqMwUzBPAK8AvwCzAMMATwBQAnACdAC8ANQAKAQAAjOrqAAD\/AQABAAAAACcAJQAAInNhZmVicm93c2luZy5nb29nbGV1c2VyY29udGVudC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAjKygAdABcAGPr6AAEA"}
00746{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":16,"source":"wechat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_first_seen":1492167342893,"flow_last_seen":1492167342942,"flow_tot_l4_data_len":366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":254,"flow_avg_l4_data_len":91,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.22.14","src_port":38657,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"safebrowsing.googleusercontent.com","ja3":"d551fafc4f40f1dec2bb45980bfa9492","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00422{"flow_id":5,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":994339,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0xKkAADIGPoSs2RYOwKgBZwG7lwHnJuhT57JAdoAQAVSY+QAAAQEICl3ZuPEAMLAd"}
02326{"flow_id":5,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":995064,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"eJKcD6iO8IQvSpdgCABFoAW+xKoAADIGOPms2RYOwKgBZwG7lwHnJuhT57JAdoAQAVREYwAAAQEICl3ZuPEAMLAdFgMDAT4CAAE6AwNY8KquurQREh2KA56GFyNwM5NNQTAm\/6ElicqXKStoqADMqQABEv8BAAEAABcAAAAjAAAAEgDyAPAAdwCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAVs\/SFoKAAAEAwBIMEYCIQD6zHRrh9AcxzPMFYouW3wGAA5k400xB8JLp\/vnuoRXTQIhAJa\/qK2iQ4DYAdp5cF41mcMUKrtPMyaAB4jQJuhQ9yd\/AHUA3esdK3oNT6Ygi4GtgWhwfi6OnQHVXIiNPRHEzbbsvswAAAFbP0hagwAABAMARjBEAiApqxJ58Ienlh5fRXTZgXKhjqBeF9+AZpEZdiV6F4rGmwIgUSNGsv++wkBf75eOZfy2MnVNK8iuK65K9WF29UDC+DIAEAAFAAMCaDIACwACAQAWAwMOqwsADqcADqQAByYwggciMIIGCqADAgECAgg4NhvsMkLjzTANBgkqhkiG9w0BAQsFADBJMQswCQYDVQQGEwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVybmV0IEF1dGhvcml0eSBHMjAeFw0xNzA0MDUxNzE0NDZaFw0xNzA2MjgxNjU3MDBaMHExCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKDApHb29nbGUgSW5jMSAwHgYDVQQDDBcqLmdvb2dsZXVzZXJjb250ZW50LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAKrkboiiJDAZ7SAVzgulTL2i0xA34tqt\/GkkUNqbVAa39AygcAl8NIrqp02Ks65Dv1uPMcCUMhh36AWeZeXDlCjggSvMIIEqzAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMIIDbgYDVR0RBIIDZTCCA2GCFyouZ29vZ2xldXNlcmNvbnRlbnQuY29tghwqLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tgiQqLmFwcHNwb3QuY29tLnN0b3JhZ2UuZ29vZ2xlYXBpcy5jb22CDiouYmxvZ3Nwb3QuY29tghEqLmJwLmJsb2dzcG90LmNvbYIiKi5jb21tb25kYXRhc3RvcmFnZS5nb29nbGVhcGlzLmNvbYIpKi5jb250ZW50LXN0b3JhZ2UtZG93bmxvYWQuZ29vZ2xlYXBpcy5jb22CJyouY29udGVudC1zdG9yYWdlLXVwbG9hZC5nb29nbGVhcGlzLmNvbYIgKi5jb250ZW50LXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb22CHCouZG91YmxlY2xpY2t1c2VyY29udGVudC5jb22CCyouZ2dwaHQuY29tghEqLmdvb2dsZWRyaXZlLmNvbYIXKi5nb29nbGVzeW5kaWNhdGlvbi5jb22CFCouZ29vZ2xld2VibGlnaHQuY29tgh8qLnNhZmVudXAuZ29vZ2xldXNlcmNvbnRlbnQuY29tgh8qLnNhbmRib3guZ29vZ2xldXNlcmNvbnRlbnQuY29tgiEqLnN0b3JhZ2UtZG93bmxvYWQuZ29vZ2xlYXBpcy5jb22CHyouc3RvcmFnZS11cGxvYWQuZ29vZ2xlYXBpcy5jb22CGCouc3RvcmFnZS5nb29nbGVhcGlzLmNvbYIfKi5zdG9yYWdlLnNlbGVjdC5nb29nbGVhcGlzLmNvbYIMYmxvZ3Nwb3QuY29tgg9icC5ibG9nc3BvdC5jb22CIGNvbW1vbmRhdGFzdG9yYWdlLmdvb2dsZWFwaXMuY29tghpkb3VibGVjbGk="}
00811{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":18,"source":"wechat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":6,"flow_first_seen":1492167342893,"flow_last_seen":1492167342995,"flow_tot_l4_data_len":1848,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.22.14","src_port":38657,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"safebrowsing.googleusercontent.com","ja3":"d551fafc4f40f1dec2bb45980bfa9492","ja3s":"d655f7cd00e93ea8969c3c6e06f0156f","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","alpn":"h2,http\/1.1"}}
00422{"flow_id":5,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":995102,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0j4lAAEAGJkTAqAFnrNkWDpcBAbvnskB25ybt3YAQAPuTuwAAAQEICgAwsCpd2bjx"}
02336{"flow_id":5,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":997432,"pkt_caplen":1484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1484,"pkt_l4_len":1450,"pkt":"eJKcD6iO8IQvSpdgCABFoAW+xKsAADIGOPis2RYOwKgBZwG7lwHnJu3d57JAdoAQAVSEawAAAQEICl3ZuPEAMLAdY2t1c2VyY29udGVudC5jb22CCWdncGh0LmNvbYIPZ29vZ2xlZHJpdmUuY29tghVnb29nbGV1c2VyY29udGVudC5jb22CEmdvb2dsZXdlYmxpZ2h0LmNvbYIrc3RhdGljLnBhbm9yYW1pby5jb20uc3RvcmFnZS5nb29nbGVhcGlzLmNvbYIWc3RvcmFnZS5nb29nbGVhcGlzLmNvbYIdc3RvcmFnZS5zZWxlY3QuZ29vZ2xlYXBpcy5jb22CD3VuZmlsdGVyZWQubmV3czBoBggrBgEFBQcBAQRcMFowKwYIKwYBBQUHMAKGH2h0dHA6Ly9wa2kuZ29vZ2xlLmNvbS9HSUFHMi5jcnQwKwYIKwYBBQUHMAGGH2h0dHA6Ly9jbGllbnRzMS5nb29nbGUuY29tL29jc3AwHQYDVR0OBBYEFPZmMOxU8xwpydFww8MTbwRomwiqMAwGA1UdEwEB\/wQCMAAwHwYDVR0jBBgwFoAUSt0GFhu89mi1dvWBtrtiGrpagS8wIQYDVR0gBBowGDAMBgorBgEEAdZ5AgUBMAgGBmeBDAECAjAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAYiEQBl7yedUexGn6szb3MDK+IoIme10CDCNC8ql3aYKkvuR3AEvDcl87Ez5KuT0A\/6I9Jc\/8HV73OtPWhI1YE2m15XbZIjcu8Q4qo89fsjaJyJTa4PlIhyjTGCkuwiI3VInPzZ03gfuY2eOPAUJaYgYKqOMyEJpNoB5DxBGx5hm1KEUDlbBawaf1ntbTzowHgByJW+jYm4PvP6Oum12DCY0ztkjRpc8sllOzCXDFmUcsuqqS0osz3j2avh1dG\/xO4Z4LJMumlpAqqKqJLsHTPuINEPDQLwbweSYoMaFQTGpDXsWlvUVZnUp2VXTytCZCGWCOGQLMl0NzsNqBV1DSlAAP0MIID8DCCAtigAwIBAgIDAjqSMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTUwNDAxMDAwMDAwWhcNMTcxMjMxMjM1OTU5WjBJMQswCQYDVQQGEwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzElMCMGA1UEAxMcR29vZ2xlIEludGVybmV0IEF1dGhvcml0eSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJwqBHdc2FCROgajguDYUEi8iT\/xGXAaiEZ+4I\/F8YnOIe5a\/mENtzJEiaB0C1NPVaTOgmKV7utZX8bhBYASxF6UP7xbSDj0U\/ck5vuR6RXEz\/RTDfRK\/J9U3n2+oGtvh8DQUB8oMANA2ghzUWx\/\/zo8pzcGjr1LEQTrfSTe5vn8MXH7lNVg8y5Kr0LSy+rEahqyzFPdFUuLH8gZYR\/Nnag+YyuENWllhMgZxUYi+FOVvuOAShDGKuy6lyARxzmZEASg8GF6lSWMTlJ14rbtCMoU\/M4iarNOz0YDl5cDfsCx3nuvRTPPuj5xt970JSXCDTWJnZ37DhF5iR43xa+OcmkCAwEAAaOB5zCB5DAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1dvWBtrtiGrpagS8wDgYDVR0PAQH\/BAQDAgEGMC4GCCsGAQUFBwEBBCIwIDAeBggrBgEFBQcwAYYSaHR0cDovL2cuc3ltY2QuY29tMBIGA1UdEwEB\/wQIMAYBAf8CAQAwNQYDVR0fBC4="}
00422{"flow_id":5,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":997482,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0j4pAAEAGJkPAqAFnrNkWDpcBAbvnskB25ybzZ4AQARGOGgAAAQEICgAwsCtd2bjx"}
02275{"flow_id":5,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":997934,"pkt_caplen":1442,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1442,"pkt_l4_len":1408,"pkt":"eJKcD6iO8IQvSpdgCABFoAWUxKwAADIGOSGs2RYOwKgBZwG7lwHnJvNn57JAdoAYAVRFrwAAAQEICl3ZuPEAMLAdMCwwKqAooCaGJGh0dHA6Ly9nLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAXBgNVHSAEEDAOMAwGCisGAQQB1nkCBQEwDQYJKoZIhvcNAQELBQADggEBAAhOBKeAfxAWQ14CrddCgPSwjtKus+sRfZCEGH3nkBX7SX+omQWRu3rJ1jw3GAmatseSIAc1MwnkKGNyDbTgMpyHmMQbdolnwVBYsBOqExobMqW+6hGVTEhjSemZXSA3zP4qaVEWlUup3kmCwBBw9Czz7LwkJNBOrKXZXh5tksGnrEg1gfnl5Jxlac2HpEFQPy5XpZFRElgOjAmhrHqkEqUn85oQl31VAwb3ZlhfX2Thq11tpTlIdZhMKVo6jdMrypxVBL\/05hTVgKwm7ReJppNsXKTMuPBmjmTjfZriALNJx+QKqt1bg8dwkEZOvtDbWZZsLvUWNt5xzAHCEsEhxhYAA4EwggN9MIIC5qADAgECAgMSu+YwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVxdWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wMjA1MjEwNDAwMDBaFw0xODA4MjEwNDAwMDBaMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDazBhjMP30FyMaVn5b3zxsOORxt3iR1Lyh2Ez4qEO2A+lNIQcIiNpYL2Y5Kb0FeIudOOgFt2p+caTmxGCmsO+A5IkoD54l1u2D862mkceYyUIYNRSdrZhGki5PyvGHQ8EWlVctUO+JLYB6V63y7l9r0gCNuRT4FBU12cBGo3tyyJG\/yVUrzdCXPpwmZMzfzoMZccpO5tTVe6kZzVXeyOzSXjhT5VxPjC3+UCM2\/Gbmy46kORkAt5UCOZELDv44LtEdBZr2TT5vDwcdrywej2A54vo2UxM51F4mK9s9qBS9MusYAyhSBHHlqzM94Ti7BzaEYpx56hYw9F\/AK+hxa+T5AgMBAAGjgfAwge0wHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gjIBBPM5iQn9QwHQYDVR0OBBYEFMB6mGiNifurBWQMEX2qfWW4ysxOMA8GA1UdEwEB\/wQFMAMBAf8wDgYDVR0PAQH\/BAQDAgEGMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwuZ2VvdHJ1c3QuY29tL2NybHMvc2VjdXJlY2EuY3JsME4GA1UdIARHMEUwQwYEVR0gADA7MDkGCCsGAQUFBwIBFi1odHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkwDQYJKoZIhvcNAQEFBQADgYEAduESbk5LFhKGMAaygQjP8AjHx3F+Zu7C7dQ7H\/\/w8MhO1kM4sLkwfRjQVYOiass2EZzoSGajbX+4E9RH\/otaXHP8rtkbMhk4q5c0FKqW0uujHBQISba75ZHvgzbrHVZvytq8c2OQ5H97PiLLPQftXzh0nOMDUE6hr5juYfKEPxIWAwMAcwwAAG8DAB0gWdP3SuZNEbqAMhXJOSFDDnIjP8zVITtmWlwncBRgFB0EAwBHMEUCIQDiaflQYNp9p0QNfVSp7yJP9jXANWJWQjzQxJueE4o0KwIgfm9glWCV\/3bNKZwfhouBXCb+W7RlftGaaWwF2qKtvdQWAwMABA4AAAA="}
01895{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":22,"source":"wechat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":10,"flow_first_seen":1492167342893,"flow_last_seen":1492167342997,"flow_tot_l4_data_len":4770,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":477,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.22.14","src_port":38657,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"},"tls": {"version":"TLSv1.2","client_requested_server_name":"safebrowsing.googleusercontent.com","server_names":"*.googleusercontent.com,*.apps.googleusercontent.com,*.appspot.com.storage.googleapis.com,*.blogspot.com,*.bp.blogspot.com,*.commondatastorage.googleapis.com,*.content-storage-download.googleapis.com,*.content-storage-upload.googleapis.com,*.content-storage.googleapis.com,*.doubleclickusercontent.com,*.ggpht.com,*.googledrive.com,*.googlesyndication.com,*.googleweblight.com,*.safenup.googleusercontent.com,*.sandbox.googleusercontent.com,*.storage-download.googleapis.com,*.storage-upload.googleapis.com,*.storage.googleapis.com,*.storage.select.googleapis.com,blogspot.com,bp.blogspot.com,commondatastorage.googleapis.com,doubleclickusercontent.com,ggpht.com,googledrive.com,googleusercontent.com,googleweblight.com,static.panoramio.com.storage.googleapis.com,storage.googleapis.com,storage.select.googleapis.com,unfiltered.news","ja3":"d551fafc4f40f1dec2bb45980bfa9492","ja3s":"d655f7cd00e93ea8969c3c6e06f0156f","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","issuerDN":"C=US, O=Google Inc, CN=Google Internet Authority G2","issuerDN":"C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.googleusercontent.com","alpn":"h2,http\/1.1","fingerprint":"8B:36:AF:31:A2:4C:EE:50:CC:6F:34:F7:2C:A3:C5:B6:4B:02:AC:53"}}
00423{"flow_id":5,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167342,"pkt_ts_usec":997972,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0j4tAAEAGJkLAqAFnrNkWDpcBAbvnskB25yb4x4AQASeIpAAAAQEICgAwsCtd2bjx"}
00541{"flow_id":5,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167343,"pkt_ts_usec":2497,"pkt_caplen":151,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":151,"pkt_l4_len":117,"pkt":"8IQvSpdgeJKcD6iOCABFAACJj4xAAEAGJezAqAFnrNkWDpcBAbvnskB25yb4x4AYASdgEgAAAQEICgAwsCxd2bjxFgMDACUQAAAhIFTDoRfECA9UXSx3Sxxy0vP1nhY9Lq9\/lQFw4g+aqXgVFAMDAAEBFgMDACBkfneDcqzi2Nje8E1lOFDpdGYGDUwA+4+JYfiYxYvJ2g=="}
00486{"flow_id":5,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167343,"pkt_ts_usec":10381,"pkt_caplen":111,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":111,"pkt_l4_len":77,"pkt":"8IQvSpdgeJKcD6iOCABFAABhj41AAEAGJhPAqAFnrNkWDpcBAbvnskDL5yb4x4AYAScb2AAAAQEICgAwsC5d2bjxFwMDAChkJ2bB26To\/kNXsOt+kwWJVo63aXLzXxNrnD+7sGyFG3arYue2\/uLN"}
01550{"flow_id":5,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167343,"pkt_ts_usec":24015,"pkt_caplen":895,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":895,"pkt_l4_len":861,"pkt":"8IQvSpdgeJKcD6iOCABFAANxj45AAEAGIwLAqAFnrNkWDpcBAbvnskD45yb4x4AYASfzjAAAAQEICgAwsDFd2bjxFwMDACsKRf1Xn9C\/aN7xUxi\/hM3vpriNty220pLm3SKA6sQTzQkPhFRman1R9b1WFwMDAB2\/FtEjvwdnpqCBWKIVjQOr1SamY63g6hfvlLKyvxcDAwDvEmg0c49TYeFGiDSC8Ug7EUrkwpvKoATdTI0WVcOSo6j3WXQKaMo8dXOXNQtokZMmgPf4GWW9F4RvX\/eLyYbqEsM2wIANVox2KQlf8QRo\/ZlQVU1VJ0too287FPVcd\/cy2Tk8URodRHSYjx2ln+sI4KWbuJc2U0N3M0Ws87a32UepfTQ79dMubHWgYo1B4g1Vk71L8z0ABCpTCVk5RECoMVKk7S7xBTJC5Y10rZWbqztOkeqxXXoB1egNAD2iwbFgFt5YQlc0rqD7Iy2nfqrdcqQoqiGmPLiGzF5DnrMrQ4g1yo\/JlTRc8SW3i2Gx6hYXAwMB8oSpBkXpYiyTTI19E\/Rir3Ae9RYOoKo6eL1MLvfgueFrcfE7WH9Z+Ka3pu6l33YWG5oFJaMZr7ue\/K+vZn62ipqp8+uHaxrTsj5lvZ2QtBLMqyGY+h4t3Kzo0gnvmLLfRD7Auqscv6eGpyv8XU8dzCGyPKQTmLmPd4sAiOcuEVpsvTCE\/PGF1WSPTFgZyXELGL+7dzYZG2efio3hJdgnb6BTVBrGIhO1AWqG0tMmPJd6+WccbUPLZoIFmIHcc\/0icHyeW9DK\/PSe44vS3i++Wx4I9Xs1AEmR5Kt8MOan7mu7PCvtqf4IZk8nIGW8uIT7hPronBtgXrOhUO7q4+Mc3zXu7yrPrVCpPlhd+J+SUBLGd0bNQUbdxyO3NzXwsZr7tNpMpMh5PUvFiVz0GP\/dIdRyorbdzTHsm6XKqAUcK0W\/AGbuhVn\/OjNKzEG3dKiQ+vmbMLUG\/jmIZP2tC+OaZ9rmENqlml3lXoBsB6658Q5D6HY9utk4cxFC+mFEWroJ1AR+BqhGoRJG1jyPzyu\/6a0XGcWhjiaQNRkatx69FQO0+4vdXS7QslnfOGoaYTVTYXBDpRn7jk3ssj99216YUu+AHR7mIG78PypDmd9bZ5HFZBzLn2hjAthfr18exnWo0W2ygMI39O71XT7XhMdllfsKOw=="}
00793{"flow_id":5,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167343,"pkt_ts_usec":49183,"pkt_caplen":336,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":336,"pkt_l4_len":302,"pkt":"eJKcD6iO8IQvSpdgCABFoAFCxNQAADIGPUus2RYOwKgBZwG7lwHnJvjH57JAy4AYAVSbYAAAAQEICl3ZuSkAMLAsFgMDAN4EAADaAAGJvwDUbxVD5pY99MWMwsYGglFDLd4TKc7HNP9Bfj1katTLjm5MUPP4LGAl7joaiNojx2JHv8uDL7LwEDY\/sgs1caWZ0AdGsLQF22vwx9oOj51CHV764BY8TCvvNNG4WjMwNM4OXgNRdZaAvzn0Ebh6tcIV1u8PTBE91h\/fPr8PnkGCX2HG6DgLHozhlAX94ZaimBGpVK2aaCKZA9\/5bR4YZ76aPButHJXvuJ2SyFZ\/fgYpMMbpK\/eCI\/vFAIPzDVW6u\/2\/221xFzCrv5xx4hbqROjJKoMVoXwUAwMAAQEWAwMAIFp8LMo3+xtUYPU5i10hvoNCEPCwhUtawe84m0jq9OGa"}
00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":41,"source":"wechat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1492167345896,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.78","src_port":47627,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00422{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167345,"pkt_ts_usec":896252,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0u5hAAEAGF5PAqAFn2DrNTroLAbv4cm+uICz91YAQATUbzAAAAQEICgAwswD2qQZf"}
00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":42,"source":"wechat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1492167345896,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.78","src_port":53220,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00423{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167345,"pkt_ts_usec":896311,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ew1AAEAGOYDAqAFnrNkXTs\/kAbv7Pa3ZiiWYPIAQAT3Z6QAAAQEICgAwswB+x0ZO"}
00422{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167345,"pkt_ts_usec":935019,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0XCMAADcGv2jYOs1OwKgBZwG7ugsgLP3V+HJvr4AQAV1HoAAAAQEICvaptmIAL9cA"}
00422{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167345,"pkt_ts_usec":937743,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0vmsAADcGPoKs2RdOwKgBZwG7z+SKJZg8+z2t2oAQAVQFzwAAAQEICn7H9k8AL9cC"}
00423{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167347,"pkt_ts_usec":435725,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0LFtAACwG\/EnLzZeiwKgBZwG700RsJQ5CFiW5B4ARAQCiIgAAAQEICkXRnm4AMKsW"}
00422{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167347,"pkt_ts_usec":472253,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0B7RAAEAGDZHAqAFny82XotNEAbsWJbkHbCUOQ4AQAk6XYAAAAQEICgAwtIpF0Z5u"}
00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":47,"source":"wechat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1492167350333,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":46078,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":333752,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"8IQvSpdgeJKcD6iOCABFAAA92D9AAEAR3brAqAFnwKgB\/rP+ADUAKS5MZgIBAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQAAAQAB"}
00639{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":47,"source":"wechat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1492167350333,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":46078,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"ssl.gstatic.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00650{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":372335,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"eJKcD6iO8IQvSpdgCABFoADcAABAAEARtLvAqAH+wKgBZwA1s\/4AyDQ0ZgKBgAABAAEABAAEA3NzbAdnc3RhdGljA2NvbQAAAQABwAwAAQABAAAAHQAErNkXQ8AQAAIAAQACiyoADQNuczEGZ29vZ2xlwBjAEAACAAEAAosqAAYDbnMywEHAEAACAAEAAosqAAYDbnM0wEHAEAACAAEAAosqAAYDbnMzwEHAPQABAAEABThHAATY7yAKwFYAAQABAAUudQAE2O8iCsB6AAEAAQAFLnUABNjvJArAaAABAAEABS51AATY7yYK"}
00668{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":48,"source":"wechat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1492167350333,"flow_last_seen":1492167350372,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":41,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":46078,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"ssl.gstatic.com","num_queries":1,"num_answers":9,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"172.217.23.67"}}
00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":49,"source":"wechat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1492167350385,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":51507,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
02202{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":385726,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"8IQvSpdgeJKcD6iOCABFAAVivyhAAEAR8DbAqAFnrNkXQ8kzAbsFThBpDTHWY7YNkySLUTAzNQEAZRP82mbzhTNOuyagAQAEQ0hMTx0AAABQQUQAIgEAAFNOSQAxAQAAU1RLAGsBAABWRVIAbwEAAENDUwB\/AQAATk9OQ58BAABNU1BDowEAAEFFQUSnAQAAVUFJRMgBAABTQ0lE2AEAAFRDSUTcAQAAUERNROABAABTUkJG5AEAAFNNSEzoAQAASUNTTOwBAABDVElN9AEAAE5PTlAUAgAAUFVCUzQCAABNSURTOAIAAFNDTFM8AgAAS0VYU0ACAABYTENUSAIAAENTQ1RIAgAAQ09QVEgCAABDQ1JUYAIAAElSVFRkAgAAQ0VUVggDAABDRkNXDAMAAFNGQ1cQAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1zc2wuZ3N0YXRpYy5jb23DJ9pgKUoswhKlaAfLoi3sQZPhfUFgtpep51u0rkbBgx\/nebVFToqDPqkbsFtGn3MXCPqLWhc6j\/ixUTAzNQHogWCSkhrofu2AhqIVgpFY8Kq2MDAwMDAwMDC6zWefDMewsHm6e\/MeaJgBlt0fDWQAAABDQzIwQ2hyb21lLzU3LjAuMjk4Ny4xMzMgTGludXggeDg2XzY0Jc6XFWD7G7yXYXhVaoxdywAAAABYNTA5AAAQAAEAAAAeAAAAtqrwWAAAAAA5eOlJA3D70ONW2AJf\/ogbdqDz00OrZf\/OgXQcK6rvrAta8o74ustrYp5ItVHeFC1VJKErdNkin676crWgBJJhZAAAAAEAAABDMjU1wgnkHLidnM3CCeQcuJ2czT2t9HxBefiRQAt7kKmuees3ygAAW65hsjHRUCwmcSnHJYniTszHhABKgaojbj7US89crmIZu34dDjUIs9wDqj3f87VRLZoVe0zMx1t+ZFc1SOwYij5LWSM1YcolsQBx9V4iuTevcGsCo1kr3VNCHdz7PtfP9d6GZNrg2+YgXWbXAAnfNe23tKnBUPczWdseoa1PkV+7toc2QUBJDmQV3Doscx5oizBP3jmujZdyIIvaDPKntnnsjC8AAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00627{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":49,"source":"wechat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1492167350385,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":51507,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"ssl.gstatic.com","user_agent":"Chrome\/57.0.2987.133 Linux x86_64"}}
00877{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":386186,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"pkt":"8IQvSpdgeJKcD6iOCABFAAGCvylAAEAR9BXAqAFnrNkXQ8kzAbsBbud7DTHWY7YNkySLUTAzNQLvwr0xyGRZ7meDZlovLzVjAbbzC3jR2f2rSyaEQR29GdHUR3g0xdsFTdTip7X1Nnsf4tYU5MBGkSRYowzYqBAgeAEueiV49O5ngVqvp6AacuKzAzgJV3z622EcXJUEyhTJ+nOIANjFkaDTQTI+jdNEu4FfF\/TnyxM++AGJ3to5M6SWYBz2BeCP\/OGMSC7yUukPIe4sRQeIQcXq+IYSj3PAlHKxZT8HDRP7kjwgghqQy0grhbmgn+9HaZmoQLo9gu4ijkDWy6wUW+W8oMWbJ3Ky6wEFXzApvzV\/FZNjJh6PDtkHubM5JHhhh00iIakeLzopZrU7PnZst39suCb9JKpUYtFvmoJnG3+X2ld76667v+kx3ZpHcdgXPlvpm8rm+2k6Em\/vgF23i7kHM9aRW5K+1InNa4QsADwuokzDCUylLbXZYixDaZtGruoPUyaIkf6OjyLbS2SNBQ=="}
02203{"flow_id":9,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":462573,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"8IQvSpdgeJKcD6iOCABFAAVivzBAAEAR8C7AqAFnrNkXQ8kzAbsFTm8mDTHWY7YNkySLUTAzNQMCK\/NUmHquSjxA+X2gAQAEQ0hMTx0AAABQQUQAIgEAAFNOSQAxAQAAU1RLAGsBAABWRVIAbwEAAENDUwB\/AQAATk9OQ58BAABNU1BDowEAAEFFQUSnAQAAVUFJRMgBAABTQ0lE2AEAAFRDSUTcAQAAUERNROABAABTUkJG5AEAAFNNSEzoAQAASUNTTOwBAABDVElN9AEAAE5PTlAUAgAAUFVCUzQCAABNSURTOAIAAFNDTFM8AgAAS0VYU0ACAABYTENUSAIAAENTQ1RIAgAAQ09QVEgCAABDQ1JUYAIAAElSVFRkAgAAQ0VUVggDAABDRkNXDAMAAFNGQ1cQAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1zc2wuZ3N0YXRpYy5jb23DJ9pgKUoswhKlaAfLoi3sQZPhfUFgtpep51u0rkbBgx\/nebVFToqDPqkbsFtGn3MXCPqLWhc6j\/ixUTAzNQHogWCSkhrofu2AhqIVgpFY8Kq2MDAwMDAwMDC6zWefDMewsHm6e\/MeaJgBlt0fDWQAAABDQzIwQ2hyb21lLzU3LjAuMjk4Ny4xMzMgTGludXggeDg2XzY0Jc6XFWD7G7yXYXhVaoxdywAAAABYNTA5AAAQAAEAAAAeAAAAtqrwWAAAAAA5eOlJA3D70ONW2AJf\/ogbdqDz00OrZf\/OgXQcK6rvrAta8o74ustrYp5ItVHeFC1VJKErdNkin676crWgBJJhZAAAAAEAAABDMjU1wgnkHLidnM3CCeQcuJ2czT2t9HxBefiRQAt7kKmuees3ygAAW65hsjHRUCwmcSnHJYniTszHhABKgaojbj7US89crmIZu34dDjUIs9wDqj3f87VRLZoVe0zMx1t+ZFc1SOwYij5LWSM1YcolsQBx9V4iuTevcGsCo1kr3VNCHdz7PtfP9d6GZNrg2+YgXWbXAAnfNe23tKnBUPczWdseoa1PkV+7toc2QUBJDmQV3Doscx5oizBP3jmujZdyIIvaDPKntnnsjC8AAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
02228{"flow_id":9,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":488480,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"eJKcD6iO8IQvSpdgCABFoAViAABAADcRt7+s2RdDwKgBZwG7yTMFTuPKBNtpRNeisKdzzqqB80k\/RvEcLV+eNstooOP26jQwiV8kAUkwPIMgeBmjqFkk1eZa85ntkHHKG5sLS2nvF5TmkUr+if921Zg1I0\/4gCajXiftZ1cQ7HzDlknoAxBMi+AaCHBUPnPHivZkyl4iSGvXlnHgng3\/7naBjCDqlDK6F+CuxkK8R8D3zCSfpOaKQGBLlchz5S+hCTIwqEd99ts2qf\/5eNYdL5VkMpB5nPqZijuHeZKsbAA\/ctrAa2iT4JB48UuOXvpg5wOCy\/anBkev1fI+1TTLsBMyhp3HjpYh2aKJvkMCmiRctHYEQnmaEMBwOlLcCDMzXUr6cVbELb2ipeNilNIPUR6fbRTICFCh\/dLk8Z8s4+2+q+YRvL47cij8qjU\/MSP\/JdAcQdXgf4J1moMV\/HD76jtK\/q6K2AELbJTL7zlTXQDvl7lhybUqmS8n2wO6ChZ8mkKRPXTTl52a1+v\/t94S8AMxF3uAvJ9f0fJ\/ZMEI3IZ6O7qMEGehlJFUg6ku3WOM+3kE9ZCniZ1GxLmVMmc7+ELA+4BU071ElcmB0cNHc3igocgwlfnuRZX3+k22dSiwenP+A9\/TUyzBAHrcaRXwxtrkUB5nhrAwxJ7sXU8h0m3RmPoZeSXzzc9FxpQ5MJBVfPZ2nvgM8SZWj76Mbmfae4W0Y5pSAxeitiyz6e\/pvVhOlpfDYK7FaYxKn1bgfQne5NYXwxOjjO8qXjZbyhi6U1yf0AFPol4fV4k6ffTGHaG+993EhQAEInqFjs5KLpUuYY0UmCTl9cNR7U0ln37rA4ek3m2s0HjMh2LjsowbaeOmpJRUN6KZp0r5FoNKL2Rbyy6azhyGhinEk2F7Nx7T7OFc8qzh5U88cLdGwsiClMeV++e44EyVBwnyLUnGa79agiHRfcH8uQeFO2JdRvD8m0OGuY\/X4Xq2M9cudkHEZSL9Cvaxgr19m\/Ehm6WWrLrr5ou2qkcyHZ3odgdmbvlBOkYXAqUw1OB0DtQD3U6wTXoHGqO0PM1\/UtTkXAr1qpn86JcvZn\/ynpf2O5qdTtcOKebDq3DgNLkK0T9cm1y1rD4T88uFzlXeHlJh99mdpFsPJ+vFVCQJPwP7vqfT71mINa6\/Pb0Q7bplVWYi1b+UplNOm7yEjJaBRU8Bhv5Pxyh091JSaVecSM2kcDi5U\/hakzgazrriEloDM0v4i1dEuq0I7ZBLcjJFITvSi14YlRX8vKn4kLmPQ3\/oteLhKPRWjTUKm67b08p+Rv8wo6\/ZnvVJVK\/7YJnm2usF3Wz7NfPzR6ckRZ7uYkJZmfPh8\/VTMnabtN3diLkyqGe2ks0kfaaMAlrrWQhbKh5F1K\/LsLNpBub30iqBt5MUt5aEFkSBabvJWtjubQn6QyW8GVs2dFwnL\/CjJFVDk8+kRhzcqwTcIkUO4tw7WxxCUf0F3PNbBjXIBOJrChJ1p3uBHljOGy2Dh0DxDK+EyF7GTnybbIRpeK2oedkfCEnpPpUi7IlpneqyneEiPOyp2oNCjVACBgL5+pYyFsR5gW6VnysncwXQfH26UNpBXtf5HwJr+NOuLicMNTiFrLT4hNvlLhb3HdSm4\/kbBpXefbUT++QhHN5PIPKN2F75i0fG4B9SKWDSWSc\/XO7Nr\/jOHdYwW3e+5zfODYV5lIC5IJtaSio5iRwf\/LvS2RbglFn3Jj94DvsSRYClnbw0fes8mzb2I5dE9C5wElePnvErieuDHTJLAwGVHurqwdlhGSdQnFmnpIjvps8w458iyTv63wjC\/7VPejnxfmCEmz3XcXd1WkP82S2K"}
00446{"flow_id":9,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":489750,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"8IQvSpdgeJKcD6iOCABFAABFvzVAAEAR9UbAqAFnrNkXQ8kzAbsAMQogDDHWY7YNkySLBOrASIpV41hPskm0GMKG4qO9Zgt0H6YdoS0lP52KlgM="}
00435{"flow_id":9,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":492969,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"eJKcD6iO8IQvSpdgCABFoAA7AABAADcRvOas2RdDwKgBZwG7yTMAJzAnAAKyFCqrim3sDOQE\/XDJpR12pzfvYmnKHzCB9qcEGg=="}
00430{"flow_id":9,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":55,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":493002,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcRvOes2RdDwKgBZwG7yTMAJhITAAOOiWkWxkr2BoDxvqS3cLitwaYkv2m85is5NMlI"}
00443{"flow_id":9,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":56,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":493257,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCvzZAAEAR9UjAqAFnrNkXQ8kzAbsALqnmDDHWY7YNkySLBWKbf5etVeyiT33m0Z2Ue\/M3a2Vjw+Gv8zEJQBQ="}
00778{"flow_id":9,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":495330,"pkt_caplen":328,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":328,"pkt_l4_len":294,"pkt":"eJKcD6iO8IQvSpdgCABFoAE6AABAADcRu+es2RdDwKgBZwG7yTMBJlJfAAQqNhNwzYSAXgmLkJsHpaAzRcBJayS1EpBkIgCW6fSDanYiNcFDAyPxbhdyRJqZD812kkSsRg+WUvT2KLaAyICsFWnAnwk25HPdQVI0wTzVQyDtCqN3YJqvfGHNzs+iLVfPp633VV0GJn4ObnKaYxfsnXCcrr\/IPqTYnLCfzUCGvEjuI6q6FQVoVp9FcQHRTXKqHrZAi0qjsHco6cUwphiazOWMSRF55gV3avowYEEq4lB2TRknAueP8WFqaF4hLEqRRUI2CbDnbPXy7uPzDzqE00ePIM5ECbqBFllGv264I2q2dptJEcfnN5ks5RU+6VVOddalILKch814mN3H5TVjmomuT2C55qzhNAuB1epiyEtycgjMOuSgdAc8HQ=="}
00443{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":521605,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCvzpAAEAR9UTAqAFnrNkXQ8kzAbsALrPCDDHWY7YNkySLBmo4YJbUlXxqD2ZC063Gtj+1aqDqaJQXEvzUnwc="}
02226{"flow_id":9,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":536493,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"eJKcD6iO8IQvSpdgCABFoAViAABAADcRt7+s2RdDwKgBZwG7yTMFTm9MBNtpRNeisKdzzqqB80k\/RvEcLV+eNstooOP26jQwiV8kBblm3dTMANuspYc920Vx0oYIXBW0KuZ1vWoVnPSdPJ4UKJkf+FbmFOlk6SH8fRKFWFgYfZiOUUynAbxB3AJqplwmIHbobO7Z5tANMt7h7SxgWl44rImFSxqlDUEOCOBDmTMxMOEJhfDHaN7m6wQ1FMHS0Puwf1sjt7ZzGjL3ZPNckvOikzN2EUckFK\/lA1c672vmfe02ziUZ\/pY6YHiAbOQiGdRZMVAqXj6M22QamZxxwrXlFgVnaLXfLCPV2IYY4nU5YeNmSIRXKeiAw1x0sFuYSR8YcwwFWTHb3rmXTjtXaUa4tBug7rZuTXqSQxl\/ZdCnCBfz2JOMsix14LXJbTudLd7yYB7GeOxvBZvWoRlWFUSslm0uO1YA0Jh8tDD7iRCoR8p+qnt3ZGI+YIA4d1UgFizePuIPAYGWL+yWxpMDGg0OPOBHtkSVSwv1FCykzDwoyOXUXGcyj0MMrEbIMSUB2dJfjeTJnd\/+oiXplYyIcKiGSZhtN9CRM0lDUhq7UJasOIO1JObHpDpLCzL1reHq9or+CxHXdIk+oCMBfj32KolZWZ\/xzNJQvCEOMYT\/1VDd3tPGrrPSfeX87BQ3FDxI8ooUeghZ5YF1zbyhyDpcnzcOG3E7msqoi+Qmq\/W5JsXnQqHvdZt1XIYWICyJk6\/8T\/olEowQ76IeaFHY3n+lZOONMuyB5dtFQJTC5uhsElrydOQ75UeYWA4JJHZsrGc3xbaFnjVyU6OC1Ll7T0\/34JtFo8rmhCgBt9jeDYQOUI8QjrkMNvcLWVvpBZDq+PRKtCsmRfOVWmlbySzkIuSIc5uBb3OcYUx8S5ZcFBiiAYan12ayOFxHgo6O4VgVmdPvJQpE5pMn0SrFLLOQfO2l7S0lNmzTTcZrrRRRbow2OZdcHqLYbmdvMsGXQf1fvaX\/fnUKgUM78T3vdi04V7XSgHgo\/evARwLSRQswYtXqIdcY6r4vK\/NB+Mx9LO6W0g+0lPtM1ZJpmNbLEoSMPRRheWF\/OmwnW9+tH18eHRaIB7DjgP7lMlKQaXDZyJWTje6zVnOhNKBSp+23Oy8mfQUXnAkif9qR9DJfqb\/5ir3PHVtA95FGTW7Ldm+IAaiZRGNj2SNM4BCk71zqHmm44SGomUN3mRz8cuXTHp6SX5ipopQ3zde5ohPbnL\/vjWT1j\/m3XpFelbz3CL5qip13H5H7s65gHQ0Dz\/PkyrRSi5K1NwDiX6fWXe\/HHVu6Bd0oLYAsE5tHPE2IGZK\/\/HWEbqEAkdw\/oLC49T\/sONdPiBRIpouggFT3FlKx\/fDgLnCGULTxVovjFOkyFtmxZr7Uria+NX8HGmqInZyOoCaUzJkmyOErr85oNLIkfmZhBVoz3dOZqRkh1r2D5cA+7lniVSrGmNhJDjSx\/MnmPenG2zlhwhohPZOmw8x3iil0fFfRhLfL4skO5+F9cWr2ubyIsDVHr50DYUB2KRS2DkKuQCeE8+q9qacLxXdA5dNSxaECKQicceGe1STkkllK8uqQF3YNkJ1ItkvU+SpoQdvRp2Aq4GDq62WMiMTorwWI8WZppBrszr5u+K9bYtGCM7adBAyCy\/eTCKdS81r1saR0nyIbzspG8eOQ1CW2GQocZf86PIA1GwDS6hB07xgELPp\/gqvACA2ZtdqvN++gZtxWCuksO1ijxpronOQLGvH69vAQRIYWg0FF0rARniBS86bidtnxx7DTUGChUcb0q6suXX6bOg3eq6qKexSyYa0fKIBIokFyJP\/+"}
00432{"flow_id":9,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":60,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":539231,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcRvOes2RdDwKgBZwG7yTMAJnCsAAYr4opWZHoPXiPXDtetp+RWij5Bf+N3uVPD\/CKR"}
00444{"flow_id":9,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":61,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167350,"pkt_ts_usec":562751,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCvztAAEAR9UPAqAFnrNkXQ8kzAbsALs6hDDHWY7YNkySLB82utXxuM1jeW4I\/i0nY4r7ntsp3eUSD88EIprU="}
00473{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":62,"source":"wechat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1492167351026,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":55862,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":62,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":26518,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"8IQvSpdgeJKcD6iOCABFAAA92FdAAEAR3aLAqAFnwKgB\/to2ADUAKSL33acBAAABAAAAAAAABGRvY3MGZ29vZ2xlA2NvbQAAAQAB"}
00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":62,"source":"wechat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1492167351026,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":55862,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleDocs","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"docs.google.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00641{"flow_id":10,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":61131,"pkt_caplen":227,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":227,"pkt_l4_len":193,"pkt":"eJKcD6iO8IQvSpdgCABFoADVAABAAEARtMLAqAH+wKgBZwA12jYAwUoh3aeBgAABAAEABAAEBGRvY3MGZ29vZ2xlA2NvbQAAAQABwAwAAQABAAAA2QAE2DrGLsARAAIAAQACiyoABgNuczLAEcARAAIAAQACiyoABgNuczHAEcARAAIAAQACiyoABgNuczPAEcARAAIAAQACiyoABgNuczTAEcBPAAEAAQAFOEYABNjvIArAPQABAAEABS50AATY7yIKwGEAAQABAAUudAAE2O8kCsBzAAEAAQAFLnQABNjvJgo="}
00681{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":63,"source":"wechat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1492167351026,"flow_last_seen":1492167351061,"flow_tot_l4_data_len":234,"flow_min_l4_data_len":41,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":55862,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.GoogleDocs","breed":"Acceptable","category":"Collaborative"},"dns": {"query":"docs.google.com","num_queries":1,"num_answers":9,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"216.58.198.46"}}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":64,"source":"wechat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1492167351067,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.198.46","src_port":57591,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
02206{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":67458,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"8IQvSpdgeJKcD6iOCABFAAVibQVAAEARaA3AqAFn2DrGLuD3AbsFTsxKDU3ZCrKMtFhpUTAzNQFnbJE8FVI6Xr9TUAWgAQAEQ0hMTx0AAABQQUQAIgEAAFNOSQAxAQAAU1RLAGsBAABWRVIAbwEAAENDUwB\/AQAATk9OQ58BAABNU1BDowEAAEFFQUSnAQAAVUFJRMgBAABTQ0lE2AEAAFRDSUTcAQAAUERNROABAABTUkJG5AEAAFNNSEzoAQAASUNTTOwBAABDVElN9AEAAE5PTlAUAgAAUFVCUzQCAABNSURTOAIAAFNDTFM8AgAAS0VYU0ACAABYTENUSAIAAENTQ1RIAgAAQ09QVEgCAABDQ1JUYAIAAElSVFRkAgAAQ0VUVggDAABDRkNXDAMAAFNGQ1cQAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1kb2NzLmdvb2dsZS5jb21yl6H2wP73bUTm\/HO\/L6W7bp3Xhczs9ysCSmeki\/j96A7sEoRFEAE+SB65YLwp5s+42jMDuJu4lkMvUTAzNQHogWCSkhrofu2AhqIVgpFY8Kq3MDAwMDAwMDCSV1vE+gNbm7+W8XblWvpmJ\/49qGQAAABDQzIwQ2hyb21lLzU3LjAuMjk4Ny4xMzMgTGludXggeDg2XzY0Jc6XFWD7G7yXYXhVaoxdywAAAABYNTA5AAAQAAEAAAAeAAAAt6rwWAAAAADtcasM4uYqOdGcPkgWTuPinp6tSgmHbpcCw+LDtPZmZuBaJu0QIw4bgS6gnY4km2fVf4E4bxQZEQJVfGW2\/zkLZAAAAAEAAABDMjU1wgnkHLidnM3CCeQcuJ2czT2t9HxBefiRQAt7kKmueetXmAEAL+XPr519ndPJ3mPFBWs\/DigCPL0uG+UOo9PlVynP5lP7SYDz1bkGMXY1YNt3+9e\/xaovsHZwZUHeJNaLtZCflec\/IAM0fVlrvjwb6nbNCsXZz6\/cPg4kuVRS2mBg046WN6uU3IIy4QYEX9WeFcdSLySSFcZAp9Y92PScUgAJmXEYeE91IXZUb3jX3RMxTRdpIGidUSIrQaDk8neMszYOzIv3i7wAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00640{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":64,"source":"wechat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1492167351067,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.198.46","src_port":57591,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.GoogleDocs","breed":"Acceptable","category":"Collaborative"},"quic": {"client_requested_server_name":"docs.google.com","user_agent":"Chrome\/57.0.2987.133 Linux x86_64"}}
01651{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":67660,"pkt_caplen":969,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":969,"pkt_l4_len":935,"pkt":"8IQvSpdgeJKcD6iOCABFAAO7bQZAAEARabPAqAFn2DrGLuD3AbsDp2YqDU3ZCrKMtFhpUTAzNQJxZNfHCC8u2f35luXQX7wk8+5+gy499Uo4Fg20rRdDDy5CsdXoRXrF+phU81nis1nRDRx09GXiKDxOppPR5wHoCPv6GGJ1a2aSeKMbWb+zwKTlNc+IgrbKFFqH047ViEQZsFLjifeqmjWw3kLjF9wuTO5xmTDc8NygVX92ZUjcWiRsZklVVPx3NbEThZxDUrne5HeS9hEKQhiWqsRNFsJ5ZewxcV+5cYvvBeYiQR+kS3f\/LZqZAjI6Q5gDCFVg4IVHBTbsdm3CNW6MkXX6Z21DpqBMIia1Z2wV8I9lmIjOLOKjoJcu+pem0sj3G6u1FBaJ6UzuToaeQVFoQV1B7THlLpcbWhfyxWuv5Vq5Nhbvz\/hy9e3GvHaPkX2Ap3unG8P22QcYcGd\/BWZtvoWlpacJDV2epOkkS7tt5wlFKOWfO8\/5Yu\/gJ5xuBFw7XGdmQknr+9LaS3e8wZiMR1ZfimH2Wrss8HcQEl9TcUi0OPt7hg4vPxA1umUMgAjxmP3GICQIJ8v3MSyfSe36zfbmMnzMFR+cZ4RVKOKFuZsig3U7Qla3oB3K2bziFfb7gRL+hERHc4YgKgGNFngj+oqw2jdkj\/RqXvOIZPBl74wKoDpJdAAu0pwpTpg0OYCvwu\/ep3j0WkfwnzYcwnEEOfrkyBT8sslKLByrPD6217xh62Bp0UxecAcjRSXYnXrLG4gF\/OklBRUl9MWf17862YoGJ6mbQ8Q1BCG\/ur1PzAt2\/FqJ05MHkwrkRVSHl4pDeBaR66Du4ZmV0GBx989HTukTQy\/3OGUKXjAXhJdjcsLd1jo\/K0yDhk26WE7HHoqWgHvMgQjGE2RFzuX36OVzPCIEOwd9oe0YVvAfM\/rVc9genM5Hy7Sv8mutamuMH7bROMktPGAdZ\/IFx5w4VWad64HIS2eSUBLGRLvosHNSRrNdfupAMBGIyjJeytCFI+Ljtgl1sqegx6JwAaGxpjS+ZJjXdtHKXMd1GSxa\/aZjv\/gLSgGEeQHgpM0w997OPOSc\/oXhrMG2H9dPnVY0gxfZjD+EVSDAUqgCePMf4Xk+wruAsQ37\/lHXudBmH90ljRj8ye51wbrJXjVUKo39iLcU6hZ05\/StCBdO\/xPb895mMSP5JnWfCWFSaYGQN4FQQYatRm1PasNLHcHWO0PLezKCDM2gsmrDE3X\/KwGBhJhce2KxIu1Tjfe9ZeVoyy0Oxy0Bb7O\/93ta"}
02229{"flow_id":11,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":66,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":121999,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"eJKcD6iO8IQvSpdgCABFoAViAABAADcR3XLYOsYuwKgBZwG74PcFTmzaBOou0Nigzud3ZaOudETm8GBczN7q3HxIUIOzVIoPsD73AQkDw5o48VPCPgxwE9bagOsfguW4BXFTqIT1IIV5ThjijbPacPMIeuYY+tLcR\/SESotUnfD6k31MBpngxATfGEoS3TSTc9aVt2BKPUkJNXTxIqajXh4z+2CjCT16kZiox8Qmel6o7NAeDdJDfOL+51L\/G92mnF40IupMo8kyn6Yeya9Ad1Q2D\/p2FAN4KbvETwnyCCrN\/3BzK6jhLgRMRUMpD76aZzYbZwTnnjn5cPWJgIaiNlEoyxA7CP6REtuotFUshn\/4\/Je7Jbm8GzbVpuThmCVdHsCKO9eQafmXETXyGPOX37U\/+RYvpidmrbPADR3IJ0YyPcE55eQPeQ3SLMLpJR+N0H26d91w3L3p89mtepH0NeIecXxbZcygXiO3ouImKiBH5Sols1nP6qAehqtyidEipR4ZPAV4Xw0h5rAYVjkhxL41hJnSJmoocaWAxV46W2QvJzsrabDi5M9SzvhRJAsPZZY4K6G5dvQpS2uzTzQOzxWkGBlQl7RRRgKZIcNK4yIcQD0yIGCwwoktA2Ld1Idk2Cu5os+Y7KXAeUWL4EghycwrRGckuLuUQjKt2wiWE8fO7O4\/Lv2VZCpq74PXu3G5CCkcU65VQJeeZrPt8UoeqowDQ+esOAIZ137WnNojv8+UsGDeg+xMKBRUrYaoT8ER8YifN6riDqUjipfNYkbEn8ucoDGqAIlyleAS5\/XHM13il1iRyxEOLilein7LTbUQNfwFOf8EzXgCnR+IpNR4wHUKNWXhmNPOYokIP23Sl\/FaC5yeTIvYRTQb\/x8mhYj\/WIs05PouLe9Pt+TRR3N2YyYcD4kqZDJk1bVFKuF7bqCGCM51z3lvURyUWHByifpl1Q0srxqBnb92qDujj+Ug5Hs9Ty\/kFB8qHvx1Dfq78jAeHz0fzz7AMlq+79RPkRIGLCbIkRGUTiiYKOqV8DW1cQsg\/KZWg+kdRSdfwb30mOCaUqILvOyhuHsdt\/VlQOncdoNcoPzCka952teJvpu3kHP0JF00GT6\/QgvMxqqvMT68gpqKr7VNH2JM4rMWfmQe7d70oO4rLXnu5+c5UkqU4+\/yoY+zdy1UMw3UYnE\/RB4x5v7QiQt4jRnCl6tLIdDw9lQg9IzEnVZzw2lt7lY+\/FC4dmux3GBahkU7C9wFjO9v95glXVXJsAYEhvS3wJvsdmH9ydK\/F3zD4bHe6QH8wln\/KtF+\/2hcmCsTO+QWhFCYnQytBu\/Dd7UqbnYMeu6CvYKHngUiBNqyzWOGJEUUIwiWru1HLQ+oi18IFAgJS2Pl99aG5LYQ83XtdOxJ4pO0nKlJ0xc1wx6vqc9D94XgPsJhPmRnKuyWzZTwOjFjJ4fG3PqBIeO52giJ97T6kI1ufnseC2DoOQ7mgmmkhk1xFPh\/iCEO2sH8\/yvC3ciJ3q1jHvS6trEx0psWwZhrcKMoj6uJQAqWOx\/4VMZblPtRO0JRK2sKrnR0AuXFvTgyJJXrSQnKCt4f0Ie08Z0FhokeNmZugGY11eoMg2b0Ohw1Gcl+Nco\/Mm0dOR0d0ZzowYYFQVn8Z1G5U0v2I0P+bjqBg\/Oft0VL\/uESmpcBS8+q9YYq03mdZfyrm0Wll6v2MrVZ+luVDiDPf+2zCNGMeJyqwXqCBY\/GUBtV\/ORVHwTg4O9+bDUiGoGMfoIrfv0WX52viV1sxsvodgKw\/K7R89paaPWnO6gRTKekrbX0nVKtcWseMnbmEds6efJmpuqUD3hZqUyUuRhdxz6a7pUXagTh"}
00448{"flow_id":11,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":67,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":122989,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"8IQvSpdgeJKcD6iOCABFAABFbRRAAEARbRvAqAFn2DrGLuD3AbsAMQ6vDE3ZCrKMtFhpA7Y9jgNT0qCEjni6SuPZWM+AykfeqYgCOx\/sRFcfvEI="}
00435{"flow_id":11,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":123228,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"eJKcD6iO8IQvSpdgCABFoAA7AABAADcR4pnYOsYuwKgBZwG74PcAJ50WAALZroC++876tEf+28S7j2Ttku9RiL8OOFC5+3RXgA=="}
00445{"flow_id":11,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":69,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":123407,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCbRVAAEARbR3AqAFn2DrGLuD3AbsALv6EDE3ZCrKMtFhpBK1o18SKo\/qbz8U825\/VzcbL6V6+eFmxogbDKI4="}
00431{"flow_id":11,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":70,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":126049,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcR4prYOsYuwKgBZwG74PcAJs97AANw4OTyouUplCAQlCxyR5wFQ8L97KXJUGT9o9Kf"}
00431{"flow_id":11,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":71,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167351,"pkt_ts_usec":187679,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcR4prYOsYuwKgBZwG74PcAJmLSAAThnIEPyE2iTeMUNqIIGc3pgi1qVvKpqLMzF+Gl"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":72,"source":"wechat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1492167352068,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":36017,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00422{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":72,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":68255,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePFAAEAGFx7AqAFnQOmnvIyxFGy60MyoSq1b+oAQAO38PQAAAQEICgAwuQeFnMDK"}
00423{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":73,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":122932,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0OfYAACsGqnlA6ae8wKgBZxRsjLFKrVv6utDMqYAQAWVTqwAAAQEICoWdcMgAL7Ej"}
00821{"flow_id":11,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":74,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":366369,"pkt_caplen":359,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":359,"pkt_l4_len":325,"pkt":"eJKcD6iO8IQvSpdgCABFoAFZAABAADcR4XvYOsYuwKgBZwG74PcBRQmsAAXfXTfs4CpU4zZDcNemGq3fAZVjuSRdySjI0P8ou9U96Fb95XNHQ5Ea8U4ZSmuUymwNiTNbhXsmzwKmBCuRJ4sBmMwptJChUKY0ESXRFy40FVrhyqSFvWzWYlYtv\/hZ43FRhBB9ZsIjDChwOu75W8VxLyhAf4IMvy51o+tsW0yS9eMLTBfOiyqz4NxBP0TuIqIFZQaIOrtR8uF6bo6A5KPpKxsXrQj5MdwsmOS+8COp2q0MzYzIgwFRgg62y0C\/lgco8tigwv3TFtazcfjpsxdmRBSghhQv+39dr+pAFDPhHgHiBhY9k3C6ydjauV5uApNmXzE1nG6gwZfdO2nzy3QDybZ6zVepjUf5UgvoZw3\/cp8oXD+UVRyQRlUziULxsVtRwqeiTfuyA5SFGNz7lnlALVNnIyGt8JlNqjk="}
00453{"flow_id":11,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":75,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":366998,"pkt_caplen":87,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":87,"pkt_l4_len":53,"pkt":"eJKcD6iO8IQvSpdgCABFoABJAABAADcR4ovYOsYuwKgBZwG74PcANSDZAAauBtGOwFjLL1Lk85SZ2kaRRdWlzbgwiQR4YswhN4p3ezcTMujbIkqf\/FW9"}
00452{"flow_id":11,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":76,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":367864,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIbddAAEARbFXAqAFn2DrGLuD3AbsANL1NDE3ZCrKMtFhpBQoBtYakBkLfRax+TOi6IfaF3077Z7hpEcpobbJ7derDkLk="}
00432{"flow_id":11,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":77,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":371962,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"eJKcD6iO8IQvSpdgCABFoAA4AABAADcR4pzYOsYuwKgBZwG74PcAJIY2AAeeeUXUuwqERc9o6KyNGYuNKj080+Ib8mkGTA=="}
00442{"flow_id":11,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":78,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167352,"pkt_ts_usec":398283,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"8IQvSpdgeJKcD6iOCABFAAA\/bd1AAEARbFjAqAFn2DrGLuD3AbsAK7F2DE3ZCrKMtFhpBm7kl79oV\/7DDgt7GHK2JHDMxM8dDtJ486Q="}
00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":79,"source":"wechat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1492167353674,"flow_last_seen":0,"flow_tot_l4_data_len":230,"flow_min_l4_data_len":230,"flow_max_l4_data_len":230,"flow_avg_l4_data_len":230,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00695{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":79,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":674975,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"eJKcD6iO8IQvSpdgCABFoAD6dwRAACwGsNrLzZeiwKgBZwG70ypPgUs4IVggsIAYAQuBHwAAAQEICkXRpIYAMKn\/FwMDAMGOrZUQQd+ekzcfermPixMN7baWMlCLOjLGRLUay7A9ywN4ZUGmiUXDO1gdTDC98QU1t8eAbnyMFUBj5qM3d0y5XCUUPMCeBhhxcxN\/8G4Ch12FyipeyhGtwqgzXcsPc5ZQsJ\/Yfu\/XdVaAYYDYsfkQdrrVo9IGd6i0jIOj1GEXv+MuFcw5UP8MbQ5QLfOihRir7leYEOxmHGeDrisZkZBhOzKLL2Q5myihhKQJ9yeXWCsp\/s4j9ebB8kfX1kVSE8Aa"}
00424{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":80,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":675042,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0n8JAAEAGdYLAqAFny82XotMqAbshWCCwT4FL\/oAQAcj35wAAAQEICgAwuphF0aSG"}
00422{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":81,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":687334,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0B7VAAEAGDZDAqAFny82XotNEAbsWJbkHbCUOQ4ARAk6RTgAAAQEICgAwuptF0Z5u"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":82,"source":"wechat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1492167353687,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40741,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00408{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":687484,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoXgBAAEAGtx\/AqAFny82X058lAbtnDvSGeC5ApFARAOXT9QAA"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":83,"source":"wechat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1492167353687,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54085,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00423{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":687522,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0QwNAAEAG0kHAqAFny82XotNFAbtA8usy6z8oEoARAOWo0QAAAQEICgAwuptF0ZJx"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":84,"source":"wechat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1492167353687,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54089,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":687624,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8ZmlAAEAGrtPAqAFny82XotNJAbvI4NzyAAAAAKACchB6zAAAAgQFtAQCCAoAMLqbAAAAAAEDAwc="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":85,"source":"wechat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1492167353937,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54090,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":937975,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8a3xAAEAGqcDAqAFny82XotNKAbuhD9GmAAAAAKACchCtqQAAAgQFtAQCCAoAMLraAAAAAAEDAwc="}
00422{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":86,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167353,"pkt_ts_usec":998138,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0bFFAACwGvFPLzZeiwKgBZwG700RsJQ5DFiW5CIAQAQCMMwAAAQEICkXRpNcAMLqb"}
00422{"flow_id":15,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":15537,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0vARAACwGbKDLzZeiwKgBZwG700XrPygSQPLrM4ARAHCW2wAAAQEICkXRpNsAMLqb"}
00422{"flow_id":15,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":15579,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0QwRAAEAG0kDAqAFny82XotNFAbtA8usz6z8oE4AQAOWWFAAAAQEICgAwuu1F0aTb"}
00406{"flow_id":14,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":89,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":46391,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAoK49AAC4G+vDLzZfTwKgBZwG7nyV4LkCkZw70h1AQAHPUZwAA"}
00407{"flow_id":14,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":90,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":49162,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAoK5BAAC4G+u\/LzZfTwKgBZwG7nyV4LkCkZw70h1ARAHPUZgAA"}
00406{"flow_id":14,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":49202,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoev1AAEAGmiLAqAFny82X058lAbtnDvSHeC5ApVAQAOXT9AAA"}
00434{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":92,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":49234,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG700mLgJvryODc86ASN8g1VAAAAgQFoAQCCApF8RJmADC6mwEDAwc="}
00422{"flow_id":16,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":49274,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZmpAAEAGrtrAqAFny82XotNJAbvI4Nzzi4Cb7IAQAOWalAAAAQEICgAwuvZF8RJm"}
00747{"flow_id":16,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":49650,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiZmtAAEAGrevAqAFny82XotNJAbvI4Nzzi4Cb7IAYAOVDAAAAAQEICgAwuvZF8RJmFgMBAOkBAADlAwMg8ecmhVvNIGBKxVKhOhJWIrAbXQB1XAVkfDWfr1I96iDQqVQUi2ekdsYx76vXfMv4reYubqyVUBJq1nTozJ\/kzAAgKirMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB86uoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI+voAHQAXABgqKgABAA=="}
00721{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":94,"source":"wechat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":4,"flow_first_seen":1492167353687,"flow_last_seen":1492167354049,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54089,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00436{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":296899,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG700oogx9AoQ\/Rp6ASN8hHnAAAAgQFoAQCCApF8RKkADC62gEDAwc="}
00423{"flow_id":17,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":96,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":296948,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a31AAEAGqcfAqAFny82XotNKAbuhD9GnKIMfQYAQAOWs3QAAAQEICgAwuzRF8RKk"}
00423{"flow_id":16,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":97,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":427364,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0iSlAAC0GnnvLzZeiwKgBZwG700mLgJvsyODd4YAQAHiZtAAAAQEICkXxEsUAMLr2"}
02343{"flow_id":16,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":430928,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIiSpAAC0GmObLzZeiwKgBZwG700mLgJvsyODd4YAQAHju1AAAAQEICkXxEsYAMLr2FgMDAF0CAABZAwM1kPQW92cguevuQqDaCbRcD\/G+X6zRfbURm97Uu0BVKCA3foG4i9pV6QeN41xMuSS6TypXmVvnRL5nSZVX0j3qosAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00778{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":98,"source":"wechat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":6,"flow_first_seen":1492167353687,"flow_last_seen":1492167354430,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54089,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00423{"flow_id":16,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":99,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":430957,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZmxAAEAGrtjAqAFny82XotNJAbvI4N3hi4ChgIAQAPuTPQAAAQEICgAwu1VF8RLG"}
02349{"flow_id":16,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":487785,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIiStAAC0GmOXLzZeiwKgBZwG700mLgKGAyODd4YAQAHgCbAAAAQEICkXxEsYAMLr2i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQSA+yeJtoQdKqu9TBTMq7boQ71hzXg4fvG\/uJ7nOZNJ\/ry0fvYdJJiIEOdEQ\/tGrfV1K3288dfFzu010\/GMEJVUBgEBABSNSFxa"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":100,"source":"wechat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":8,"flow_first_seen":1492167353687,"flow_last_seen":1492167354487,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54089,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":16,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":101,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":487813,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Zm1AAEAGrtfAqAFny82XotNJAbvI4N3hi4CnFIAQARGNhQAAAQEICgAwu2NF8RLG"}
00780{"flow_id":16,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":102,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":488072,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4iSxAAC0GnXTLzZeiwKgBZwG700mLgKcUyODd4YAYAHgviAAAAQEICkXxEsYAMLr2fTScOdm56ml7v1ofTVAkfVhd3wcrzURPmgmRKtBv2u80x9TnTxKtBnp2tzJvxT7yoK7qis+ID2ApL4Bg1FSshJivuWkb9x\/9I4xx7OzQ29cEdb4Qd8G3dnaBoRFgtpqrZd2VBPSjYjYstYO0oDVVYHM8jQlx9PCqFzGdHuRBpnuVBhSZsWykeif6s2sxXA7+43gpYo8JwIoAcuk5uZKdqLLaMhSPOw7XEhl4OLVKkcg6YAFkzpUfZkfB+G1B9nCg5GnUrcb8dtjLw77P\/8DIKbUlq2Li322jlWf9tleQaJX3Pcg3aj1TcUjxdk2Jw\/0XY2Rlsl5ThM\/ogtUWAwMABA4AAAA="}
00425{"flow_id":16,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":103,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":488100,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Zm5AAEAGrtbAqAFny82XotNJAbvI4N3hi4CoGIAQASiMagAAAQEICgAwu2NF8RLG"}
00597{"flow_id":16,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":104,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":490757,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyZm9AAEAGrlfAqAFny82XotNJAbvI4N3hi4CoGIAYASgXIAAAAQEICgAwu2RF8RLGFgMDAEYQAABCQQRBUqcOr\/Fo9LfujpCB1YIK12c6eVV75kVsU8e5xArVru79k3ajtqlrZp0McDR+8QZPDpNm6ocQtMz6EuG9VJxYFAMDAAEBFgMDACgAAAAAAAAAAB9QQJRpQW0QXzIXXukwJtDqaRVZoRNnEF6LSTogjsgs"}
00495{"flow_id":16,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":105,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":864678,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABniS1AAC0GnkTLzZeiwKgBZwG700mLgKgYyODeX4AYAHiZewAAAQEICkXxEzMAMLtkFAMDAAEBFgMDACjTZNtyCweq2cjQQzxGpVecoDk5dDO33TmzV16l2q5lvjybNw5JFWfK"}
02106{"flow_id":16,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":106,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":865785,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMZnBAAEAGqfzAqAFny82XotNJAbvI4N5fi4CoS4AYASiogAAAAQEICgAwu8JF8RMzFwMDBNMAAAAAAAAAAXVl2bEdSzpiU7Zyml3Li4A3tlDKuAIvlkudhWTUDandLFjvn6EokoSHVGijId5XO2gIA8Dr3kw0zJXPsULIhjdf27AC7hXM2QVIo2q91mvMP6SDhnj0dHL2XdevzIpxgcbaGE6Fw\/tOfCoK6W+qYtoCrpvUpf0v2LielE0HreHGuKAUr7RVh1MB0aeH+eZsr8M3qE9XFw5+fSu197vqnGenxERoRBjkNgG0jMyhPt86wa9PZXOZazWBc3RXhEf1r2daNsTrEBuF\/wgc9BX33oMyfDRIy7LNrz2eTZAJJ14kYUnUmDzVvxDUr+rhd8Gi3UTElW0shvGwvnuPvW7UUJIrGt7R+Q+KPxvSUE4YN6MrsdFI8y9uDs8uCQ9bAEeggduQAhQAkVZupsZY8I2D6XY03NeScMCLyPrJNzA9ZjKIzFgJhXfdRoborQA9JFUUAIsY0cjrevUfjL8tci0GL2WtfMDZl+8+9q7KFMH1wkegoH0eeYNW68wj+0TO5f8GuRwWfITiQkJm5eA\/xnnVIWW0cJLp557+6CAbIqYRG4EWvQ1jvR4mV6cxWNMHYD\/dubHBxhnT9OsZ6W1l1b38k2PJPYnTBZEpF+Dn0uole7CcbN08nLAB9xXPiBLvd3c27wC14jx0J1dVhI3Cend13\/nNTSpOydcfoN9A34xjqZSQWBX1eskDE6wZvM0TPA2V5\/iI7vdqlmSoX4B0fAHxcSunCrdAsMkzPZ+qzeSt9+WWVmOQ530zwM\/lSoe3hYDLcfhXsZezJHqSlgxMTmm9ApkjwdJMcG31FY42h5fnXmf19X1VGD3eqIrIRRBTfoXSJPcizxMCODczeDYk1njqSn+QhmPKI8DdGhV0K02ngpSrq0xFKOJluYb\/l6+h8GNnoMhksPF1Q+67Dnavznsk5PqC7Uw63bMybUnZ\/uMHNyTD7XgbyMxSPpbzClG6Njl6bqziGH7e4\/a9bGkE6K+hmMPfrsmIUOQTFEHWpgwEZ+AYycJbx5V0HW\/nKD+K9w3wfFQHSv1kpTD5aqa7hkoPXuhZoSgPYtmdm9uRmqMW+1wnUXrMeJy4BlfCHc+O83GptB6O2TqLh9yz5rbAaD1lM6UkW8g\/cb54XxvpQF9+Ty9UDT2pOmakMrsxiQEuPlUDT\/AOZwZDC3lnOIg1GxUyKZtfUN0L99VzZ4PRmxgYK0ovlZWH6rBozuaC+7WOd\/lfvo2\/8BUuGZidl98QV6mOjzZYg6RFpR4dHgiptsLAc91Hv29NoHaXH\/g\/+KmosnifMTjDOkXpvajbvTJYkuRByIwPyxrj3UlRRVEHlpaEFF7LRXFNLZKDU5teK+T4JrLS46g3kPd3V+WYvlxipr+g4177KabX0Ss9w3oDKyUL59w6KzpSm+yJvVpHmFL7Tr3P9UP2o5Y+gK4iJN0dW2TLqnAU\/1pBRRcn1fGvGFhjGzQFKtCcsis7PwleHyYYPNMarowz2kFJ3hyr2KnAqO1V\/Ug3MMOtzc30Kfj07I2CbahIY2MEQTudeo8LoBd0P9Oz3iQ5D0ZlvtX4TZrCOJXrsfH44fNyd5QE2itUZ9rH0YRmUBuQIDpHtn31Dm7ln0jLBlMgXTLUVIZVs9JISL9aiJ8IqOfZfOsPnoPi2A=="}
01072{"flow_id":16,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":107,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167354,"pkt_ts_usec":869112,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPZnFAAEAGrPjAqAFny82XotNJAbvI4OM3i4CoS4AYASioUwAAAQEICgAwu8NF8RMzFwMDAdYAAAAAAAAAAjjUh2xk8jMDiJIIdB2uw0YRbrot6hyg2Ttc1pVL9SA+EePoW1Xi9q65OFYKUVmOdM9bvvhzr1jPW4uO8eW0yljFtcGTKBMKM8PpEsLIO7+1P8T1S63WKFRgJ5Ka0U2UxSuj2RhoQVzNwPvsauVzDjyZtoHippSFMzFBloHSN5psPlJSHd7Uu9qVWCUeo5+9KrO0RMCOcA+DkBqb63GqOoJWnGo5AjdniweZggXmSVpy1OSwODnKosv5dSyLSatxMGRNALnEWUjzDDXqkPfuHyVIvXgFldqRCT8dkcRp4R0sGeWklsq6dbuaZAWIhMTI7a4U\/BEdVJhEvRKB+Pai2gfc\/d87kAzs5lG4F3E\/wWPuxkhAoBKj\/wvhjvSzSYHHexmdptDu90ZrsfapCJ4dQbkS2uiAbtOUcFPMoNi78oday4kMZ7peUUHzFLGDgpCVd4yl7PJiZJj9fZXgH\/1xcANHZSihoJVg1fqkOLQsYVE2FYbfRxXihyW5N4aNGHjwkRCyrxCl17\/6oHX6vJvi9\/XWVPnoRt7PRuuqm\/WkUKPB7QwhIwIkwlGBHmRylwZrLKqThL3EnpMGIH+i0+7OtXMtPpsYZQpgPuyWmYRRtQ=="}
00749{"flow_id":17,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":114,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":372539,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEia35AAEAGqNjAqAFny82XotNKAbuhD9GnKIMfQYAYAOWR5gAAAQEICgAwvEFF8RKkFgMBAOkBAADlAwPQGPUQ73ic+7iVIAjQSjq5W05BxFF6D6kJRu\/s5h+d6yA3foG4i9pV6QeN41xMuSS6TypXmVvnRL5nSZVX0j3qogAg2trMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8+voAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIGhoAHQAXABgaGgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":114,"source":"wechat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":4,"flow_first_seen":1492167353937,"flow_last_seen":1492167355372,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54090,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02037{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":388384,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYn8NAAEAGcN3AqAFny82XotMqAbshWCCwT4FL\/oAYAchBqgAAAQEICgAwvEVF0aSGFwMDBJ8AAAAAAAAACSCXh69SRVNj7LxTHyTa29lyIMx5rUn\/Kbsx2RSLcx6h5Rof7MvhSBslxiMA7RM+grN19AFhFkb86ybE4QzYLqZogvxRJjzavJpiSw0h2JHTRLw5hxkIJT93\/hBnX4KXAJggRKu+zDGdqHHdv4fTutm2SVgm7d7YrX77rNoEa49Z7tjdE+lO2DuQkrDWrkIcPj0eYPzI9xDvhacp1zu+uHhR194mvhqvVQzKnG9JQA7M8yc34zhOP58E3OjjXwz3ELzMbE8lsUYni0FdVDzD5AHz2ZXkJTACi6epY43d8swMwJs750LtRYiDdf+30r4284+LeVd8LVUpJU\/rrav+ZKJhyQ9sw9XMWliErx\/Hsl\/5h3MZRKZeqbDE6P8CmhyiQOuweltYgaOp1rsNtfHpo493xewTpz5snn5PbRcKUqFF5M4r7lhwPPhIeVK4WOUH\/33+Sq98q7EPLrHMUFohSF90hiJaXtAj+rHVK1gMf9oOJW2ySdU7MX2DS86yuQ6kfFtJuGuxo1Cz6PJoomwid9YpsbBbTMx6m4z9l\/ny1t10Pd97BylHaTo6YBGXBgtaz8dbyFkkD5Nbk5dwtmaGlM9uIlF\/rv5c1A55dbIdj8naBbyQ7fTwTJFbjISBkJmpaQoU2kc\/zziP44xaoDUxaRt9Ry\/806C0HPovj+JC6hKAJhd7IU3lz1cd2EcOR09Ulbh6GcnGtGoIEgMSnOqlHSHFOvhwMJOgqMdjV4Ts3j6kz4nuUL7P9W38WCZ6Et6v6MCfJC1NHlb+BiknubpqgZZ7mM9\/dQzJwaHAVm1pExnTA0Qtn9u2w0Ob0wTvtwWHLqB8+w1X5lLgz+g0\/KazNnFwZsVC8NJt7gXfJimXlNiQyyoVZPRU5TsryE76p7eJsfK2K3vD+oV2xOy0odJivKdVU9d\/b0lN4vXAAJXGR8apbNgPqwivAZHIvQdWqFgNwio4MLv0L8zBSqiIiaIpEMDbJPlGf3NTa8KHL9KuF0\/XkvPuIqyQ1vikTJWv3M0PfnYGX\/91JwgIycN3X4tfAJPTYU1bJR8H9lqbTS68wW7e8n7Z9kn4BsSK8WdGfSG\/BGchlsNazeLO6dljFOzNH1Nb0yqv79UpRl3Kr1HkZo+mQcyTmdDq73MBTVTodPICJb5JR1YLjVlWLyhlubA3PMAZhd7v493hq7IuxuvrhHldQDGHsYcPZ0+ZYWLqkDletWw1l3zV0GxsjRhJ3s3iffY9XBpGE8EG39zicWNmnu8THVvBYw\/7ASp9iDFLWiJkigPswdmPFhkbbEWproj9M3h6bBS7Z9ohy6yUXPGG6RKTKX45Eg\/Pm2f3Y3bPQ15p4S5E260\/wYzmk6Pco8MZXXOtCrfsbgBU3U\/QFaYJziOi8kV14C9ocoOj7UNbOPlK4JGIThUQC22wBIoO4QcICqfGi12dFi3\/dZawWcVCDgNfdmaRqjA7vn2Ew3dMX8AfiCfUGFCye6yKRfSC\/KcvJGql1sIadq+izTaBp+jfWADKBhJTOB7x6VUd2Bs6qIc6mkvKSj4SxqM+NPNL5GVHDR9qjJ4H5zSi"}
00425{"flow_id":13,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":119,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":708813,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0dwVAACwGsZ\/LzZeiwKgBZwG70ypPgUv+IVglVIAQAR3wRAAAAQEICkXRpoMAMLxF"}
00694{"flow_id":13,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":120,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":714716,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"eJKcD6iO8IQvSpdgCABFoAD6dwZAACwGsNjLzZeiwKgBZwG70ypPgUv+IVglVIAYAR1S1AAAAQEICkXRpoQAMLxFFwMDAMGOrZUQQd+elO6yUWZaxB1XMRBaU5iIrSWBDYFMTBklza86ZAJ6mlfc+fSz1nangNwW6dDHehHKK9aovFSe8h\/p4B1XlNKo6T5XxbmSKu1Sbxvxyur1MrHjSISlyLPclpL0f6AhZsZEEcReSmOdovjdyShnPTyu0ybkZB4WFJHVgACkcFaPkTxnnNq1rLUf91oPxf\/kt+Uc1aHDCkMk\/Kcb18Ipw1elIOYbN1xUGZ7sM+yxphWAWHZg+LCttdBqRoJi"}
00424{"flow_id":13,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":121,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":714740,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0n8RAAEAGdYDAqAFny82XotMqAbshWCVUT4FMxIAQAd7uawAAAQEICgAwvJZF0aaE"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":122,"source":"wechat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1492167355723,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54091,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":122,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":723894,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8P4ZAAEAG1bbAqAFny82XotNLAbtsCoMeAAAAAKACchAveAAAAgQFtAQCCAoAMLyYAAAAAAEDAwc="}
00425{"flow_id":17,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":123,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":738109,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0C01AAC4GG1jLzZeiwKgBZwG700oogx9BoQ\/SlYAQAHip5wAAAQEICkXxFAwAMLxB"}
02346{"flow_id":17,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":124,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":743680,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIC05AAC4GFcPLzZeiwKgBZwG700oogx9BoQ\/SlYAQAHg1LQAAAQEICkXxFA4AMLxBFgMDAF0CAABZAwOhsS53G0R6i7AXuwL+d6wg7LMuP9pVZ3zq3hDh3VdALyAu7u+IESMOXMTRIYoN\/ZwuWvg9\/+wNvYR8waFYhnvDhcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":124,"source":"wechat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":6,"flow_first_seen":1492167353937,"flow_last_seen":1492167355743,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54090,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":17,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":743715,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a39AAEAGqcXAqAFny82XotNKAbuhD9KVKIMk1YAQAPujcgAAAQEICgAwvJ1F8RQO"}
02348{"flow_id":17,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":744203,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIC09AAC4GFcLLzZeiwKgBZwG700oogyTVoQ\/SlYAQAHjYngAAAQEICkXxFA4AMLxBi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQ3uHpwef1MG+BNoRiDsPpSH5gW5GIz4uFejJInYWv7G+T9hMHk7Bq\/nr4Zhg6JNNyHsGHmEC5ci\/sFKwhYshZkBgEBADSEHffG"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":126,"source":"wechat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":8,"flow_first_seen":1492167353937,"flow_last_seen":1492167355744,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54090,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":17,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":127,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":744228,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a4BAAEAGqcTAqAFny82XotNKAbuhD9KVKIMqaYAQARGdxwAAAQEICgAwvJ5F8RQO"}
00781{"flow_id":17,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":128,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":744773,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4C1BAAC4GGlHLzZeiwKgBZwG700oogyppoQ\/SlYAYAHgcYwAAAQEICkXxFA4AMLxBrWqcYcmfgNeSEdnmJ5nyoHMAVeaBIcWYcz1pTCm2RGV7eUnYOO875YQ7xSqd2OzVA8qQXCPv27uKii008HP8GoLtpFGi0DAXndkfaNsefxALbcNqDrb\/EWVo7Od6q+is7u5kx8PwNSqcxfsH91yNQcsoNLmMNFHkzBwRHwtGsIcfF28w+wIumV\/7PrhP\/kvYEvyt+LEaddd+XZ2KB7za+Pe\/6Zq6By2Tb5BP2VLakhk+dc+A47b3kd8v58hS77Lns3WXAriAzfOs52nM8qdtSkZFmISUhdKxui67nouiSz0WuB8H5xQdMkNKMvhWjR5J3Apj3uim9AQtresWAwMABA4AAAA="}
00425{"flow_id":17,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":129,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":744804,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a4FAAEAGqcPAqAFny82XotNKAbuhD9KVKIMrbYAQASicrAAAAQEICgAwvJ5F8RQO"}
00599{"flow_id":17,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":130,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167355,"pkt_ts_usec":745932,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACya4JAAEAGqUTAqAFny82XotNKAbuhD9KVKIMrbYAYASgmpQAAAQEICgAwvJ5F8RQOFgMDAEYQAABCQQTW54G5ygZMFzJMA3QBRi+4YfZQ+vrY+14xhh043NTgIW2nN5Djq6OJrGE\/Q5SMlEm02FDXSZWOKU4JGAF0RPduFAMDAAEBFgMDACgAAAAAAAAAACGgOeAaPsug5OT\/xG+f46v\/aO1Xc8JTQ0kZfPBt8fdC"}
00435{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":131,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":77508,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG700uz8YPYbAqDH6ASN8iq2QAAAgQFoAQCCApFrUFyADC8mAEDAwc="}
00424{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":132,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":77551,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P4dAAEAG1b3AqAFny82XotNLAbtsCoMfs\/GD2YAQAOUQHAAAAQEICgAwvPFFrUFy"}
00750{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":133,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":77750,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiP4hAAEAG1M7AqAFny82XotNLAbtsCoMfs\/GD2YAYAOVYrwAAAQEICgAwvPFFrUFyFgMBAOkBAADlAwPrb22xHnXa3171HQ\/x0N7leORqlrAubtrqrBze9\/ohpiA3foG4i9pV6QeN41xMuSS6TypXmVvnRL5nSZVX0j3qogAg6urMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8amoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIamoAHQAXABi6ugABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":133,"source":"wechat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1492167355723,"flow_last_seen":1492167356077,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54091,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00497{"flow_id":17,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":144,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":105935,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnC1FAAC4GGyHLzZeiwKgBZwG700oogyttoQ\/TE4AYAHitFQAAAQEICkXxFGkAMLyeFAMDAAEBFgMDACi\/lY9ttWYgixpZVnLivPTiYtg2AlyBjdFSnoTBoX1jmkDYSHWa6jpY"}
00447{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":145,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":114749,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEvOpAAAERGbTAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":3,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":146,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":114803,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00447{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":147,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":115073,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEvOtAAAERGbPAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":148,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":115101,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00425{"flow_id":17,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":149,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":144235,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a4NAAEAGqcHAqAFny82XotNKAbuhD9MTKIMroIAQASibPAAAAQEICgAwvQJF8RRp"}
00425{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":150,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":487983,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0whVAAC0GZY\/LzZeiwKgBZwG700uz8YPZbAqEDYAQAHgPQQAAAQEICkWtQcwAMLzx"}
02344{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":151,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":488969,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIwhZAAC0GX\/rLzZeiwKgBZwG700uz8YPZbAqEDYAQAHgQdAAAAQEICkWtQcwAMLzxFgMDAF0CAABZAwOe8QHokcOaEsejRhiKIOT+eneKPUPW6CxSRu3PtDSDICAw4BRL3PXeGMjW+qUk6QYvRqoU0TSzHBocUA21W5zrfsAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":151,"source":"wechat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":6,"flow_first_seen":1492167355723,"flow_last_seen":1492167356488,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54091,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":18,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":152,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":489000,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P4lAAEAG1bvAqAFny82XotNLAbtsCoQNs\/GJbYAQAPsIwwAAAQEICgAwvVhFrUHM"}
02699{"flow_id":18,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":153,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":489253,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMwhdAAC0GXvXLzZeiwKgBZwG700uz8YltbAqEDYAYAHgsPgAAAQEICkWtQcwAMLzxi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQ2x7XwiLdRbJe2ezzNqHZjd3m3ALtNJQlRJbXIqzTvDx5RppGiVwkllQUqIzEhC49B+KNSBDH019juum8PyR1nBgEBAKbOhpuiGA4sSKAcNwn1neg4GKEo9Wq0PnmYO\/WyA1EYjJ20yU\/kxoaKpaedC1gKNBYCsReuxUZ4+hxxLMXCimatIFs33lSUKoo+QhETf0Vgz0zpbdMzqStD1QwytsLCfP\/RP4ehRyoS5HMxeDCnHoGuZ8VEZf4VoAKRl\/VNrj9XAJg3UVUbkG2fLYMkecjDzpo9LRbCvbax6D6Wr2Ovjl1bXtxALUeNjxEYRoq+Dvpm600AgSzq1Z5DeRUL2DG8Gpi2C58Oazm7q3FRHSMkboSTRCJ8gTLt\/Kef2YLQ6m\/LSv3mIsdqbfOVYIl8ngbEr3Qxf0pPoa5mhgSRz1VDBvoWAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":153,"source":"wechat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":8,"flow_first_seen":1492167355723,"flow_last_seen":1492167356489,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54091,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":18,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":154,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":489289,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P4pAAEAG1brAqAFny82XotNLAbtsCoQNs\/GQBYAQARUCEQAAAQEICgAwvVhFrUHM"}
00599{"flow_id":18,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":156,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":492166,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyP4tAAEAG1TvAqAFny82XotNLAbtsCoQNs\/GQBYAYARXmRwAAAQEICgAwvVhFrUHMFgMDAEYQAABCQQSK1xuoI\/EoM9LICk0fk\/dqoOaDBID8gzK5B4fzI1nC7bPJSViPhx8rygylgSJtQ08wpWYxrO6Tiw+b1qSjy8ZQFAMDAAEBFgMDACgAAAAAAAAAAFWZZ4LhzH+dBrtI+pdWhmOWc4CJbHUk7r6Bu7ogdr6t"}
02037{"flow_id":13,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":158,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":520275,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYn8VAAEAGcNvAqAFny82XotMqAbshWCVUT4FMxIAYAd7CfgAAAQEICgAwvWBF0aaEFwMDBJ8AAAAAAAAACj7kGaxvPW1llgrPExXCFY+iK2k9UMlQIUE6PT\/jpyin18E8U+KIyO580A4r2l\/E6SdyNU52BlBa4+lMqpa90zCjDm5155DkgPBMxbUZragdvw8rKup9juv9cjjqZRE1b93ECKgpO7QlawALzkxAtB5wkebFmMLrXPNSzvj+GyXM7xUzF+xmFySulQiMdhr3fk8fScbdJOtIiZ4Rw5BzdzTrNZ55Na8Pe5GwjTLnHAmG3ozlpI37OrIO+pb9yoy5kJCkPWkBko\/wjM9BcLZvqeqNV2fdxSFXPwFvld\/HsntOPojrLzos97mq7BdkZJhJbMBZVdM7BvRPBA9Ep6JR3kmm49nVKQlJ8kxIx2df0k2Kj9uNT1fizDgGhzCffg+KGt27J4zB8MIrxuovjHWELoY8SNgYI6ohKjBoG33m9XG5ytbQ6RSahAPPuCc0iCINY9qRSKRRxsZ2MFDdCLJyzwp6ksaCcXDspFkFsut4tjPmhT1hUlMezWI+x+\/JYTlKNQ2iDZKOaJ4ooToIGg6\/svW7AWAEdlQ6WSgJ03eOUV8wt+9+PyGLH8kHXLtJNGhOeUdTJ\/PNyCisywwMA1BtYSqOcugP9NSgkyBqstG\/0YqOfVm\/JhSFtlNQtn++H5+VqhurBCPsE4Jp3GbYmEtnNYNuitPV12KbiPBBiP6atAc5JOGKcjU5JTiGmuPyY+jjxAt5QiElDMZDMRVGnIU41X6Pkefb85H0ALNDmRM+Qkv1Zkmph7ycMMJRI5UEnyZrX0Z1N4G6VsRHSpQU6lORIwLak5pAhkZw1AOizvL1ilISi1KhRhGXWULUZWST\/2V8LY8WZfFSKe8+jbCSFQv3LUfndPY9m1ozVMefBIb2L3q44PvleU6ALxbPho1wHR8A9GQR9AoOGvGk8ewKWXaAZAFv7RZ2Nhdpl3W8uCr48K2A1yF1v0MQhMtRJQk9V1khU\/4293n\/+GvZRqJ91JerRBsq5wVLzUiW8NxR3mmt7OSaMYsvgrPwItDG8Qgicq4qQ6f7bpYNEKxtXBhzygAdPtGq2xyYpKuHxuk+TwcDinj4EZl9wIBRVg2A6Oy20CTXlrOgMelOLA9FhK7fy5LJ+pP+qHrUjZB7muBVjX0pdaotzd1JrYGuVhZkvMFTZlJ8ojjK+U3AzaZAKISH7rzHGtSUgj\/W03+Kd6crV14Hx21CjirxIdckCpWzQk4myX33NE\/tTaRaJss\/fGiyIodgyAlrjx\/4YdwAGku6gNxNRBwvesPHuC2RFF26C8BKdFc5mNYQA7atVsfmp9ce8\/dB95qtuZUOOgzW6W1aVKjNr6PN4bCZJI+kSrbdlbHMmxplh1xfuVW2uOasnTaRrgmyiC26u\/qO2QKJ8JwASeF1U\/p61qacFon3hNfDk1M\/Unwp3KelUx+LpJy1DN8soQZmF2LTvOec7r6AwQcD6vRjG+L+E7AV99pWWU8++ouJUS\/b1OWMKnh8uJh3\/8nMHRgulOqJw\/D8kiYdcShztHgfqu7waukjvPag6nGZiZXJ8nbb1HZZThD4ZmGmvVIDd84kH9R2spUZ4EvP"}
00495{"flow_id":18,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":160,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":846364,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnwhlAAC0GZVjLzZeiwKgBZwG700uz8ZAFbAqEi4AYAHhE5wAAAQEICkWtQjMAML1YFAMDAAEBFgMDACgnBMv9ASURh8KYAMFphlTJKv7mOV6REhDxcVQav2y2QTSJZzWIeLbA"}
00424{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":161,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":880092,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0dwdAACwGsZ3LzZeiwKgBZwG70ypPgUzEIVgp+IAQATDohwAAAQEICkXRp6gAML1g"}
00426{"flow_id":18,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":162,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167356,"pkt_ts_usec":884259,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P4xAAEAG1bjAqAFny82XotNLAbtsCoSLs\/GQOIAQARUAlgAAAQEICgAwvbtFrUIz"}
00447{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":163,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167357,"pkt_ts_usec":115280,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEvRNAAAERGYvAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":164,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167357,"pkt_ts_usec":115407,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00447{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":165,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167359,"pkt_ts_usec":115713,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEvmhAAAERGDbAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":3,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":166,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167359,"pkt_ts_usec":115806,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00502{"flow_id":6,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":167,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":622900,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"eJKcD6iO8IQvSpdgCABFoABrfSgAADcGnizYOs1OwKgBZwG7ugsgLP3V+HJvr4AYAV2wggAAAQEICvap78EAL9cAFwMDADI7\/WDixcApjMc4oo49oFJiwuyoshtW5rSqz9ahoHcSOkzcmjO3CkNO6pgK6XLAf2uLNg=="}
00424{"flow_id":6,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":168,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":622960,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0u5lAAEAGF5LAqAFn2DrNTroLAbv4cm+vICz+DIAQATUj0AAAAQEICgAwwWH2qe\/B"}
00423{"flow_id":6,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":169,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":623266,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0fSkAADcGnmLYOs1OwKgBZwG7ugsgLP4M+HJvr4ARAV0OCQAAAQEICvap78EAL9cA"}
00424{"flow_id":6,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":170,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":623340,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0u5pAAEAGF5HAqAFn2DrNTroLAbv4cm+vICz+DYARATUjzgAAAQEICgAwwWH2qe\/B"}
00502{"flow_id":7,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":171,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":626390,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"eJKcD6iO8IQvSpdgCABFoABr4O8AADcGG8es2RdOwKgBZwG7z+SKJZg8+z2t2oAYAVTREQAAAQEICn7IL7IAL9cCFwMDADL\/QQeiav2tbjoNjgJzOU4UPNZPR4RzRuOQ+h3eXjLhIIWjbE1Sb3YuyocNPQRCTo9EPA=="}
00425{"flow_id":7,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":172,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":626423,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ew5AAEAGOX\/AqAFnrNkXTs\/kAbv7Pa3aiiWYc4AQAT3h6gAAAQEICgAwwWJ+yC+y"}
00424{"flow_id":7,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":173,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":626706,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ew9AAEAGOX7AqAFnrNkXTs\/kAbv7Pa3aiiWYc4ARAT3h6QAAAQEICgAwwWJ+yC+y"}
00424{"flow_id":7,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":174,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":626707,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA04PAAADcGG\/2s2RdOwKgBZwG7z+SKJZhz+z2t2oARAVTMMwAAAQEICn7IL7IAL9cC"}
00424{"flow_id":7,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":175,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":626750,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0exBAAEAGOX3AqAFnrNkXTs\/kAbv7Pa3biiWYdIAQAT3h6AAAAQEICgAwwWJ+yC+y"}
00423{"flow_id":6,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":176,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":663573,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0fUYAADcGnkXYOs1OwKgBZwG7ugsgLP4N+HJvsIAQAV0jgAAAAQEICvap7+cAMMFh"}
00423{"flow_id":7,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":177,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167360,"pkt_ts_usec":666322,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA04RQAADcGG9ms2RdOwKgBZwG7z+SKJZh0+z2t24AQAVThqwAAAQEICn7IL9gAMMFi"}
00425{"flow_id":17,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":180,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167366,"pkt_ts_usec":907680,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0a4RAAEAGqcDAqAFny82XotNKAbuhD9MTKIMroIARASiQuQAAAQEICgAwx4RF8RRp"}
00426{"flow_id":18,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":182,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167366,"pkt_ts_usec":908222,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P41AAEAG1bfAqAFny82XotNLAbtsCoSLs\/GQOIARARX2ygAAAQEICgAwx4VFrUIz"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":183,"source":"wechat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1492167366908,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54092,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":183,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167366,"pkt_ts_usec":908400,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8lZ5AAEAGf57AqAFny82XotNMAbt+X1IbAAAAAKACchBDOAAAAgQFtAQCCAoAMMeFAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":184,"source":"wechat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1492167367159,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54093,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":184,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":159051,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8UGVAAEAGxNfAqAFny82XotNNAbtphJemAAAAAKACchASSQAAAgQFtAQCCAoAMMfDAAAAAAEDAwc="}
00436{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":185,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":227479,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG700zSrc67fl9SHKASN8jkhQAAAgQFoAQCCApF0bHCADDHhQEDAwc="}
00424{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":186,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":227571,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0lZ9AAEAGf6XAqAFny82XotNMAbt+X1Ic0q3OvIAQAOVJ0gAAAQEICgAwx9RF0bHC"}
00748{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":187,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":228238,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEilaBAAEAGfrbAqAFny82XotNMAbt+X1Ic0q3OvIAYAOWQkQAAAQEICgAwx9VF0bHCFgMBAOkBAADlAwMIMAddqPI8parJRh1yfNKrDdpzlU1BZ7DFnpjp1nvcByAw4BRL3PXeGMjW+qUk6QYvRqoU0TSzHBocUA21W5zrfgAgCgrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8CgoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIOjoAHQAXABhaWgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":187,"source":"wechat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1492167366908,"flow_last_seen":1492167367228,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54092,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00425{"flow_id":18,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":188,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":264059,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0whpAAC0GZYrLzZeiwKgBZwG700uz8ZA4bAqEjIARAHjtOgAAAQEICkWtTF8AMMeF"}
00426{"flow_id":18,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":189,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":264118,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0P45AAEAG1bbAqAFny82XotNLAbtsCoSMs\/GQOYAQARXsRQAAAQEICgAwx91FrUxf"}
00436{"flow_id":20,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":193,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":489344,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG7002nXL3IaYSXp6ASN8hVJQAAAgQFoAQCCApFrUycADDHwwEDAwc="}
00424{"flow_id":20,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":194,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":489409,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0UGZAAEAGxN7AqAFny82XotNNAbtphJenp1y9yYAQAOW6bQAAAQEICgAwyBZFrUyc"}
00426{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":195,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":549012,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0fK9AACwGq\/XLzZeiwKgBZwG700zSrc68fl9TCoAQAHhI\/wAAAQEICkXRshMAMMfV"}
02345{"flow_id":19,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":196,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":549744,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIfLBAACwGpmDLzZeiwKgBZwG700zSrc68fl9TCoAQAHjqewAAAQEICkXRshMAMMfVFgMDAF0CAABZAwODHFehjzW0hk5sWu5Ge8mFKciWQxbsw86zd9rLy\/qzTiB+R4AGaiYYG\/eTLeHwwqwepnXhm94m+8GpHgG9docrHMAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":196,"source":"wechat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":6,"flow_first_seen":1492167366908,"flow_last_seen":1492167367549,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54092,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":19,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":197,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":549800,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0laFAAEAGf6PAqAFny82XotNMAbt+X1MK0q3UUIAQAPtCmAAAAQEICgAwyCVF0bIT"}
02346{"flow_id":19,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":198,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":550195,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIfLFAACwGpl\/LzZeiwKgBZwG700zSrdRQfl9TCoAQAHicWQAAAQEICkXRshMAMMfVi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQP9onIxoqLlfKiUkbNgc+7yiRr7efVCxTibCqk9XQPMVvI9Aoe7O3LDaU6dLhOg8DRChtxEwJtY+NElt6TxP6+BgEBAL68Lae5"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":198,"source":"wechat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":8,"flow_first_seen":1492167366908,"flow_last_seen":1492167367550,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54092,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":19,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":199,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":550229,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0laJAAEAGf6LAqAFny82XotNMAbt+X1MK0q3Z5IAQARE87gAAAQEICgAwyCVF0bIT"}
00781{"flow_id":19,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":200,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":551584,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4fLJAACwGqu7LzZeiwKgBZwG700zSrdnkfl9TCoAYAHiNUgAAAQEICkXRshMAMMfV\/wUPj3J3gO0mKBbdMGG\/+oXHBAxnimdIiFbV5u3a8dOOCJ1fcmGnWeedg7V43T21vlini6SKaOHKuodqV+w9ljmEmp0jLlHMp+UH+4V8hIbgmPMk90l+vzhTNLfNph5Xv\/QVOsM2OTjI1rxhiQsLx1zzPlyStw5nZt7Ztpqi170qLzM3nZy2FH1ADBNtxpHLBUm59b+kWdwy2OjeYEQGB3Of58swX+iQSmZo2yxFIaV6Ib\/bWBqr59jlr2DeGQ8ZpdLz6ZfTi3O8GzeLU0IgCgTPvD1UwjI8NUD\/xpAsvNZWIYmahxWM4i7xxZVVCvD5mTDGY3Fj81uJL24WAwMABA4AAAA="}
00425{"flow_id":19,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":201,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":551616,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0laNAAEAGf6HAqAFny82XotNMAbt+X1MK0q3a6IAQASg70wAAAQEICgAwyCVF0bIT"}
00598{"flow_id":19,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":202,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":554171,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACylaRAAEAGfyLAqAFny82XotNMAbt+X1MK0q3a6IAYASgkIgAAAQEICgAwyCZF0bITFgMDAEYQAABCQQTveG3rIh3CStSj2Ej8oZKjD6fPv4Zm5j73uoUBJkEyDJR7JI\/xTp+IXOX0cQ517HOU0AOEM8PYVZX16C+XbL0SFAMDAAEBFgMDACgAAAAAAAAAAI3j+oZoCVoti\/yJohzvO7U6mfithyrObgOOY0osFUwd"}
00496{"flow_id":19,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":203,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":873085,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnfLNAACwGq77LzZeiwKgBZwG700zSrdrofl9TiIAYAHiR6wAAAQEICkXRsmQAMMgmFAMDAAEBFgMDACigH1Pqvpx6glAchlJIiCYaZgsWq\/SuI4OIVAnKw7sHl6dm9A7srZiY"}
02016{"flow_id":19,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":204,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":874002,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATElaVAAEAGew\/AqAFny82XotNMAbt+X1OI0q3bG4AYAShqWgAAAQEICgAwyHZF0bJkFwMDBIsAAAAAAAAAAceFKJNYR\/rmQi\/agcnoM\/bkApVvRn7hyCNTSCOR76AcLe++ymlk3LtdDN5nDc8flw9xQZXgzfVWmbF9opjLcMeRjcrk47qKyqI7gRYGNsEM\/7q0AfjB9Z9Afr+sMLWmYJx1JAVUQ7aWPI40RLXOe9jH70m4Gi8RoKU31pzGyFqbhUQPbD0tyB9CrYjtav0\/JbV5GpsSHSn6UN6NtWdMxxBFbnvz8L4bh6HYJU58Gg8JvudLXbOzrCRHzdI92Vvq\/AtuCjL2y5dz\/rNePX+ziHqVZfh4VxnDUkISCEObykXfmZqv5qULUHuSsjhzL7+TC\/74pvheU+c7Tsa3NhjGxQx+d+MjTGCnqDZWVE43OEt\/0I2\/g9vwPiIOuwRgARzwAtgEgN0GYLGjAwiuE7tIGhY5hZSVYXErSZMAXpx6JWXn2C5OWliSLNcPL\/nkxFWYOy1Wg3E0V1mMeEddDmUVyJIyTw+WwVy7VCnH0t1RKTHr\/DdgauqkdyD7J6cZWRgN9j2TdM\/ndUkBSYio1ghXuwv4\/D7Ir0aH8pkM48Osnv3+FTuVAevWSbVXrXRkUnRYexOiJcVuLBdct0zEpPBKPLiSt5MrVG2h7BVDNeaXOvLa57+KrNYQr4O7A9YZVh9eAttQ\/IpWGTVhPRb++mBK+o3CBAu9oorM9cT3v\/k5w5fmVRGZUn2AeDNFYepDibuaEVujyqcvKPZXtqw6uFwAc9hkWdIGaS8imCr\/o5esTvZ7tsQnbP8R7Q+9KIRySv5Wjl4SQQMsuv+qwmUM7\/I0mN4nSs61CU1HQjkPbbi5\/dEZ3q6wacp3mlY\/n9UZtXxHFhqw9z3NNcK2w6qaUYdjF9wrN98ZjEH+QTUzI5Tbscer+rbgKYrBKgqlrsH4rlju8Lx8RfWn1G0n3aRVR3lve0tAlKV4exqjrBzfYKv7OZj3Gr1l+0nct6IsVu1Xjs9kFXbBDqnosTO46RwW1Q\/vtW7WLeKFuQX\/Eq9TRQuzE9kASCBV+AXxu4+5FpIDBVOPTYG3OZT4x02MFJuDRVlT29hFb1QfvwMINfunQX5GIMfUJ9WWSKNQ8RpLCxMxBodJ9b4u1mAJPtyUmppqbWQa1AsvVe369L8uuAmoOE5BdD3ZzKTHOlTfLT24NFg4guj8NSmKU4ywDkXA06S6ceqgHFDzWPXOSmXimqVOsezt3PkKHigQvG1Tk1CLzDdEIhBnznqHgazetkT\/DbhAXbyX4sfbfgtV8132z48JPpavu6Jp3nvYWS0qNllBFhw98bVOvzjLL1xW7TSKRwbkPQAzVEGl9KbZhC09SPjLOVmaKPUtffTkpNywQk+XzwK+k0nb7LK3xTGKFEvYEoj8+hyOkZQOHL8z3gKAGO+Izq13XzsnoWlkCd1tzYI36C8R1sp48yuw8cnzJh53wnYbxpJeWH4AESLU1joNT\/0mNEy01fNPqSFnPvCVCDKAfLq8WLYGxGO2RUhvcSINWzk25MIZAQImIa5MZvZocb6iV9h1jCYlfZoWG9B2ezwXLUlgIu0V7Gc3Fw=="}
01083{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":205,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167367,"pkt_ts_usec":878543,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"8IQvSpdgeJKcD6iOCABFAAISlaZAAEAGfcDAqAFny82XotNMAbt+X1gY0q3bG4AYASg3jgAAAQEICgAwyHdF0bJkFwMDAdkAAAAAAAAAAojyPjpXV\/2UBvjTQJxY4YMybtKB28wRxSPhXnLGR8aEZAmF1bv3ZiZYULibSqYSVfiOJgBQktgTfMaZnIYbe51hCcEteiJZm+Kvx1T3FQiNKPTPj2bILBkxmQIu8GOXjOrncFJTn3TwQwpFNjtQRvTsMVmU\/0JIVdcSF6YojYqH\/piRs6LECooi1lPpc4hLY7X43Ofw9dhpeOZ6R\/NqPuk1fbbrf\/fcuVmcfNfJVxAq9pW\/aXCNb1YvNC\/z4D6n3IfCLIPJR+MrYO14nEgcpWZeuuxndGHfxjbSb3dvXdDBw04XS\/RqH92vhM7axin5OpL2H4aB8B05r9LF8894RFbpmUY2No9PtPtCY\/0pFnpjEAjxr\/8GK5bD1azYUDBXXz9HxYMx9e0oJIQG5KIg9WxgCFRog9TqFrfoDs4qCHnLMzgAoe365GR9YDVqWtnO15ihN8\/NDuleU1swWwM\/IU1X7MQc2pOJb53fEulYov+ukJ063cjWG5TCE+x85qq0fsoXdbxw5qETxe+pu\/nugVkaOn+toWMH6YNI9Gdw0Wmy+nb\/tOtGEvOUiNDoLJCSi5TfuUXDpz\/tXLUOsPObR+jt0YcRDInUAtdrTj8rYdsvUw=="}
00699{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":207,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167368,"pkt_ts_usec":294639,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"eJKcD6iO8IQvSpdgCABFoAD6dwhAACwGsNbLzZeiwKgBZwG70ypPgUzEIVgp+IAYATAEDwAAAQEICkXRss0AML1gFwMDAMGOrZUQQd+elU\/DgUOG7rXEfGlXnP3f\/qtwD0QWH9JQRgh3eLUoz0vysMOcJ7f\/q3bTGvZaljp1pa5aJOMWJzcLrndD5iwSOOk0dA\/\/aK1o5TSkWOSY1xYuU54JF\/7z89qcINevWo4jgaZZcb36Pc81OKbU6rr1kptdMEF5wXI6Kq+BtztlYTWzcEEsUegeCVWkzvsSZ3wYYsu4Y3AWkZWXeWmB1k3Cf5\/z3\/eg4WyzTWXQoAtCqwCDVM1ZhxZcg2G4"}
00425{"flow_id":13,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":208,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167368,"pkt_ts_usec":294704,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0n8ZAAEAGdX7AqAFny82XotMqAbshWCn4T4FNioAQAfTQWQAAAQEICgAwyN9F0bLN"}
02049{"flow_id":13,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":214,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167368,"pkt_ts_usec":688353,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYn8dAAEAGcNnAqAFny82XotMqAbshWCn4T4FNioAYAfTs8wAAAQEICgAwyUJF0bLNFwMDBJ8AAAAAAAAAC6rxf+p+Q7SiYqgOA2WkIDyA3DeCVy9li74il9a\/WPKeqVumZsvFc8WFH2bMuqKDBkv8QR\/pNqidEZ\/XD6DO93jbU7U5eU9dcK6VDnBSALJQ7z9YiD8EVZ8YSDFBntZG8vWaGRIoKrfLc5X9L29QpMsrDAsouhwWe0SYzuYpTTZY1jP0Skhw8U\/p589sYz7MS3l9T3YQNJtDz6CUQUTgpHNYsj0\/qOLIiBUYtFC\/7JJMPb1nAFBbxHsSju1JwkpxMSHUaq3wjsRD51beuC1xyL67Jo+1cAYjwoMUGrcgCz89FY3IEo5HFQIOO78TWylDbgusUM7ccUTNFo4BXpBUtzOPWNefghzu5OsZY6zo8gKX3cAqRYjn7dT+D\/OwZOJwCqmjbjwwFV\/Dr5DFVBtc+RdbVOIOdgPI0SAuoq\/m3FDyxCFwJlx0E6YInMXhMUoYm+NUAIKaRbF\/3iBpWAf9HGikX2UZfchZysLAh0Pc09hDhtu1KPntmyDLdxhMD73H+K0QF\/kXRg0Mfjn7XZBPGoqQi7a0WWmFxjIwhOka4KkTD4DXmPNVn576p2h7lo\/y5qjyjVUsnP5772MeSSrJXiL9k8i7p4JooCRx70RfmqXV\/Ut7KNUv03ek+3V7yHhHPBc2djZdb0ZneOwSvCq2rCIDJwUOEAeR9mtNb2Udbt8JaUQf8st0iM+jFt\/S4CzPd9tZkH3ix2yjm9BicLbJ1AiI7MvcV7cY85Dt3SzzW\/MPIS\/dGorJTLzOy4JmVL+t\/CMhNEbLP4ARR2KvBpjmzvfAbp93xHe\/d0QqkVc7ciSSCTBKhvbeiKXA43mfKZtk343l7cvjr8BXWaYAO6foMagd0eRhDpCBD30rAew9mkUWqTAe1LGxZN3FAOHo\/RdEm8\/v2if9q9LxmPkwBvV99nd7hmUELm9k378g5wC+pIuGPIjtH\/qwzdw6rimWqdv+0Sr6Pk+8\/heBMVpuXguU\/L9YSBiqRm6dJBiO5exPmN2dhYYpNTCY3\/pLsdIGfmj20hkC+u\/qdG2BV7fufVSphKO9Z0LrLlMuZlkWCy6Zi2VbXfpRYSphIT4p07JqEoVXWRnKt9BT4RPd3O87JiHreCj317hMSagFwTJTjDaqsaWOj83WThkqZ2DyeGghIsOJUQUpDaiMSaBt02sDN6D6HOmunqjh\/F4MWhLCuyZPvu\/GeYxZHqUWS\/3ANKpagIrB1G\/wVHmgwDAktWUeeLc0DEatfi+lyKmn7GRw1ZT\/upa1yiEnKWF2nnH6Y4DhMiujU31SHwneuUX0zhjoTGQQ3kGbNtuvwQJ\/cQzGgVWik2fYnMdFm5yOnmELgrbVT41zVtquz55iollmB+qAHQl3sExL5aLymmhJHJt0N\/H8+tPYx3vruRZ4AzsNbnxCmUao2ggxzBKclSOkE2SxssZXoWI8dcDTXZELDQmdTeAIs1y9suPygydmB7a2Wur5JoBjQe+QJIroeUx1sZQYnyJbVHAmCHObUEa7BP2KnYki6gAXo\/d9k+WB\/7olsPGfwOvlPhNgz24NfjSXolexUQklBQAR2Kdbkva4"}
00436{"flow_id":20,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":216,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167368,"pkt_ts_usec":738739,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG7002nXL3IaYSXp6ASN8hTlgAAAgQFoAQCCApFrU3YADDIFgEDAwc="}
00424{"flow_id":20,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":217,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167368,"pkt_ts_usec":738777,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0UGdAAEAGxN3AqAFny82XotNNAbtphJenp1y9yYAQAOW5NQAAAQEICgAwyU5FrUyc"}
00424{"flow_id":13,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":218,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167369,"pkt_ts_usec":11230,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0dwlAACwGsZvLzZeiwKgBZwG70ypPgU2KIVgunIAQAUPLUAAAAQEICkXRs4AAMMlC"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":219,"source":"wechat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1492167377896,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.142","src_port":49787,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00424{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":219,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167377,"pkt_ts_usec":896227,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0KM9AAEAGqhzAqAFn2DrNjsJ7AbvMOVSD1yvysIAQAT1vHQAAAQEICgAw0kAycerX"}
00426{"flow_id":21,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":220,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167377,"pkt_ts_usec":936495,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0Fj0AADQGCA\/YOs2OwKgBZwG7wnvXK\/KwzDlUhIAQAVQWugAAAQEICjJymzYAMHos"}
00698{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":221,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167378,"pkt_ts_usec":336252,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"eJKcD6iO8IQvSpdgCABFoAD6dwpAACwGsNTLzZeiwKgBZwG70ypPgU2KIVgunIAYAUO4gwAAAQEICkXRvJsAMMlCFwMDAMGOrZUQQd+elpC6jXhQN0+OxKQcXsPaqnj+1ENZvcp3idjqige3Sp9lPHY+uJ33v64WfeuccJb2L+GFejBrHAWHVOhnbSAio2DFRSfAwDsFczqmZec8k66\/IRNX2\/z\/5YWZCT3eOmwSfnOC\/\/ADwJooRdfKE1JqLKXihpm3LUObOHaO66Lyygop\/1BlV5aspusDNcuRRtxWYmgN4FP8dI0tJbYetqwRirIWR9ioMQDFa6HRsijSdDMzvTAkfIMOaFem"}
00425{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":222,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167378,"pkt_ts_usec":336319,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0n8hAAEAGdXzAqAFny82XotMqAbshWC6cT4FOUIAQAgu3OwAAAQEICgAw0q5F0byb"}
00424{"flow_id":20,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":227,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167378,"pkt_ts_usec":674623,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0UGhAAEAGxNzAqAFny82XotNNAbtphJenp1y9yYARAOWvgAAAAQEICgAw0wJFrUyc"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":228,"source":"wechat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1492167378674,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54094,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":228,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167378,"pkt_ts_usec":674770,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8mSRAAEAGfBjAqAFny82XotNOAbtKc0omAAAAAKACchBzmgAAAgQFtAQCCAoAMNMCAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":229,"source":"wechat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":1,"flow_first_seen":1492167378926,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54095,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":23,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":229,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167378,"pkt_ts_usec":926091,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8cOpAAEAGpFLAqAFny82XotNPAbtxraOrAAAAAKACchDymgAAAgQFtAQCCAoAMNNBAAAAAAEDAwc="}
00421{"flow_id":20,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":230,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":259,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA08+5AACwGNLbLzZeiwKgBZwG7002nXL3JaYSXqIARAHCktAAAAQEICkWtV9wAMNMC"}
00421{"flow_id":20,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":231,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":321,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0UGlAAEAGxNvAqAFny82XotNNAbtphJeop1y9yoAQAOWj7QAAAQEICgAw01RFrVfc"}
00435{"flow_id":22,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":232,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":33998,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG7005qx4IjSnNKJ6ASN8i96gAAAgQFoAQCCApF0b0+ADDTAgEDAwc="}
00424{"flow_id":22,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":233,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":34085,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0mSVAAEAGfB\/AqAFny82XotNOAbtKc0onaseCJIAQAOUjLAAAAQEICgAw01xF0b0+"}
00748{"flow_id":22,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":234,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":34520,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEimSZAAEAGezDAqAFny82XotNOAbtKc0onaseCJIAYAOUQ7wAAAQEICgAw01xF0b0+FgMBAOkBAADlAwOGOumiw0u0u0I6gmpzIGxnGk0VZSO+6aIdnNrT8rHiHCB+R4AGaiYYG\/eTLeHwwqwepnXhm94m+8GpHgG9docrHAAgiorMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB86uoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIOjoAHQAXABiqqgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":234,"source":"wechat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":4,"flow_first_seen":1492167378674,"flow_last_seen":1492167379034,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54094,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00436{"flow_id":23,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":235,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":279841,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG7009k83t+ca2jrKASN8iurAAAAgQFoAQCCApFrVgaADDTQQEDAwc="}
00424{"flow_id":23,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":236,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":279928,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cOtAAEAGpFnAqAFny82XotNPAbtxraOsZPN7f4AQAOUT8AAAAQEICgAw05lFrVga"}
00424{"flow_id":22,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":237,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":394583,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0P71AAC0G5+fLzZeiwKgBZwG7005qx4IkSnNLFYAQAHgiUAAAAQEICkXRvZkAMNNc"}
02343{"flow_id":22,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":238,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":396531,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIP75AAC0G4lLLzZeiwKgBZwG7005qx4IkSnNLFYAQAHjUhQAAAQEICkXRvZoAMNNcFgMDAF0CAABZAwP2cjKwLiUUHBPfMsc2itTJJSkFWQr9crF5wSNcPq+FziCc+qdX8GXELVfQ5N806uYJcFsoXMTX+cAyXbg9n1utjcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":238,"source":"wechat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":6,"flow_first_seen":1492167378674,"flow_last_seen":1492167379396,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54094,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":22,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":239,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":396586,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0mSdAAEAGfB3AqAFny82XotNOAbtKc0sVaseHuIAQAPsb3QAAAQEICgAw07dF0b2a"}
02695{"flow_id":22,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":240,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":397022,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMP79AAC0G4U3LzZeiwKgBZwG7005qx4e4SnNLFYAYAHgsPgAAAQEICkXRvZoAMNNci6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQSQKp51JuXPAhGfTXtbVBzWGCw+khkAuEoljsqTixbQ3MD2wv+poLjnkTVqvAyzVTsUAWoSBKdYk7rkC0BncsZxBgEBADrEUjGwJTQH\/3utg2jIgJfmRkSvcBM0nmPqGn2EQCMqIlKTQMwEPTbap39FdNIXj7WnyULGI0mijdVCYxDBGb1E7ekdapWy4ImeBIecAWZPTeQv6TP5cwWhxtR2bocV7XNUk1WNPx+ZR22LO4VCeRYGhB5fXkBorUDkv7iNXodjEl5OGKB+knwJaCiegC5nbaibgU5tUZ5gzvPpt4vM\/iY5bnzbccPVq25b7aQc11FfxDe2XY3LTqxtdXha+sWQ63tNKyZpJGhVcIc53lm4xkDaOx7CmNlh0mQZqDilx8vr0kKWKnJpIzDFg44CNyyM6IbcAALi8XRABFV10FpSEWIWAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":240,"source":"wechat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":8,"flow_first_seen":1492167378674,"flow_last_seen":1492167379397,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54094,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":22,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":241,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":397054,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0mShAAEAGfBzAqAFny82XotNOAbtKc0sVaseOUIAQARUVKwAAAQEICgAw07dF0b2a"}
00596{"flow_id":22,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":242,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":400634,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACymSlAAEAGe53AqAFny82XotNOAbtKc0sVaseOUIAYARXHHQAAAQEICgAw07hF0b2aFgMDAEYQAABCQQQDGk5eUBtKpsuLsWox1TrmdQjPGpitnO2j07CAKLAS9gK8+k0MWvCOzEv3KKallXpE2DShuJG56zcCZdCOOMJWFAMDAAEBFgMDACgAAAAAAAAAAJ2Non8CnOdee+SRAiPzB6j6y9fjWuZ0WgelacS8R+j5"}
00495{"flow_id":22,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":243,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":756739,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnP8FAAC0G57DLzZeiwKgBZwG7005qx45QSnNLk4AYAHgb+QAAAQEICkXRvfQAMNO4FAMDAAEBFgMDAChHOK6vDZXWbpq+G499J6WMaHFpG+2cm4rM3CIy5gGcC08FRdTkYbul"}
02110{"flow_id":22,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":244,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":757762,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMmSpAAEAGd0LAqAFny82XotNOAbtKc0uTaseOg4AYARVxFgAAAQEICgAw1BFF0b30FwMDBNMAAAAAAAAAAbOVPHTbKfBFwkP9mv6hoolvveFHHrJwEieblRW5\/NpJYOOiqgMCz4wfm4BoKm1X9Yo3PUVFeJGcKRp9to8\/42HTS74evwyzxvKD+Wks+2Qqxg4XTxD6efK3FvsEypGixafgUS13pMMshs2G5r\/QH2g89cqHO3p+KPAxZWDuN9b\/6ycW2U0uitBc5wTwO6XcpqMHIKaLEZEoSQYnXxWUwkF0TcuOxxaZ72TCEP6BQQDxiFmE08ZXv05zDwMCKi2hjQd3Hi3muU9Av922RYmGWDlGiR1I557m+uFapiv0uRp\/Ct3J4rqMjr8FRnUGLSdmIS+ZnsksStFwzvAL\/IPQtzUmVvCfO5wdjFHvhv39mZq6gkpgIwmMt1ylsnqjGuMLS1HwjOPabUsr3HtgTIrwSeM9qOaJPxH3cPBdTyfOyq5JSVWTrvdizWnkAUmljGamSmkmKY9eOMaQ651cY51TFsH7gM2Okzz1pDMs5FlZeJ6fU9jrwrDTjgjYqgfv2xOyEahIMIYGB5lgxPVRR0z6eTHMH5zXQw5E35eGTxTCjQzUUi3TUDtredbmpk53KdRNVQMzaRAq1UyUs5DIJPGbiQWuWQ4E75fqO5k7vaEhmd0KTj\/YsORgSD32oFgJsKNrBMFzYq7rKREjPXkvWrmgjY1Wd44FdfY+c7dw3NP3Tda0N+rMNhQIR1TxLOBzMTnqiEXs0E\/6oLgKCaQPVT\/yK4zGAjndvL056z4cFdtA6FlpqxbPDOrGORF3mgeRsNtc+oeBS+AVKkb5wogst2MCgd8agPnChNyV6TWoB5E+s5QjXWvehR75PS8NVFlnSzVHs7aZJj9FI4Rr1YWLWP41KezwtI20PTzSSb2VwbvatrTk+3l9TwYma88RBaRbhlowgXPWb3fnG0+ouex1L37kw474WeZ5mcznc7D9HbZvHOqvz1uSTxmyCfIXlncOw5ZHbdnRW\/C1z9bkKRJa0cWm0Yu0d\/DJDRc8SwCtRrOE1dfphQ2ioMqj9ZGcYKhya6pfv6Jj9Rfk2YakP\/bVKDPb7FrnfBoyAY51z+QTf7j63mYOLgLyC685+RWpDoKxuJO2MrLcQFvyzNYVA\/K2gvt\/1ky5Ac47Q0aQXoXDGfTBupL0bT\/1itrPpeJfqM2jbCjvMXyWsZZi7wpVgvkshJpjz0O35MtwgpJWtHfu+mSGl4Ex1cG7NYBhV1ylEjdyT\/aT8wOA2Rnf2cN96YLpfFvSX6QwUwFMUnKhXQkENEyh+oT+7P\/aUdlWnF9OwXUMk045UHlDssLU+FXfJV5svalHx12HmPwd2rDL0cue2RD4uALVpa\/\/bLya4QF8i\/AHjsFOPBOzd6DZ6u\/kgpjsM+2xIseZMUMnwu4o5cqR2Z\/+PchX8wIcyUGzej8OXyamCaWBCGTCwVdpgUKG5WN806BeExfr0cL8\/3pRIihQBckaUymUriaZJaOTO7s3BMuawnuZtZn+37DsN4HGLaD1c52GMswfX0VatbFz3S08A81S43V9mkSYQ9TM5cfenzbb9CeBPJnO3WABGF9BecC7us3Y6oMOQpz1J+1MTX6502sdoxVrTy9zasToEtUYaIBMv96CYNfhzC+5vPbbQQooNubIf7QKESc+dSvQXe3J5Q=="}
01078{"flow_id":22,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":245,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167379,"pkt_ts_usec":761080,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPmStAAEAGej7AqAFny82XotNOAbtKc1BraseOg4AYARUVRwAAAQEICgAw1BJF0b30FwMDAdYAAAAAAAAAAgvQxrO+ZPZfAevCit6q8lmlKyBo5OLchMh197Ri9U9omGGQ+AbwtMAnGYoCS6r72RF4SO\/Cb+pl0Pl42minq\/Iq+KGDXLBIOn5u66EvWZ+qVRRXuPnFD37XQ8rIochmuJc+8K54dPOInM6t1C1O1IdnCGDXX5nYCs63VIOeQgdzjH93\/nHV13t3EEXQ2hBeYfeg\/qr77sq26y759FYaw8LhhVF730YC5wDNS8rlAW1cF6p0mDloM\/Smnlwz56GlgAy3SVNAf4p13dfpgChhIE7hZ\/iMzDX2etMN\/Yy8jAf2YduKrtulCaBqCqbHsG7Rb9czFAb2ITkmxs4eWJg5buAW8EWMz9y27Sx\/TLTHwGR2JmoaekDMQX8JHaLD1rtC\/6NxwFY8o87fzXjtQLbGLfRcI4boD0FNtv2i\/cFz+5ht6uUgbdfGadJxAg79K+y7bN2G8+XLcTNO6\/izm4YB8\/6gDVpZ+r4dT5McnN\/bLM8SekcLrkE8gmcnFnhtiBbUjZDXpKmU0AzPTnpbLryENLyfbQdIP67R4jQED+bSJ1UdYoIFDxUvMXS\/jiKvpCUuodTe7wtJM5flbN0GhQTvlI1yzccjfziKMUILiE5Uwg=="}
00425{"flow_id":22,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":246,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":125953,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0P8JAAC0G5+LLzZeiwKgBZwG7005qx46DSnNSRoAQAJ8NLQAAAQEICkXRvlAAMNQR"}
02362{"flow_id":22,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":247,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":158785,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIP8NAAC0G4k3LzZeiwKgBZwG7005qx46DSnNSRoAQAJ+3HAAAAQEICkXRvlkAMNQRFwMDBjhHOK6vDZXWb8K9uQJpNnm7MY9fWKyx9uA2e2tIKxuPK49b6XnrqL45BR3BcpWqbMCLvAHyedWAoGn4dk2TmK2ATQVsGiXT28fifp8v+RJEOO1QdyHs42f5UmnUvNYrefcHcCjpTB7VI4FwAA8yaw\/5b4E91lHuNv5Di720fCarTra6zDaet7FYt6jsjY1Lk\/G3yR5yW88lJzG\/g9powclcVkQFhHhSeN+rkbyNSLvGxTKbUFT\/CMAql+HX+sTlMRhtVZVNKv\/IqgtrruUyjXx4riz6zvLCS7UVgyhZHMHS\/7pAXoYme3EYd4\/vcswItkvfGSDLsen0IojoOGRI4xbSpLz6XYDk97lTlzJ0M91gB4\/o2YZpEdhnVMroP3JcVfdn53AY9CdZtYDmlsXbZv5LGClSfkhm\/bwTCshn53B7tsA3m7061cPiOt2rMwQDqlwob5v6xAeZZup3tBO+5bqoJXd2vv8kRsXMHpU7l3ZKIqYZ5J9iysRNmkNYbmmtPR6vmiO2yVSAB\/LexXuztbTXE4r5WvUD1wuypAiXqICAbyqQT4mz5XvXMNxbutD9gp4kR12cRcg9D0pJ8OYr3HqeCWomvT3B9TXiHoPKnV+YzNr64gYGtlmwui1YvUmWSq5sJAs4Lg7dz1KjORI1v7ukfJjD0sGdC72JUL33KRjbYV4p3rVhLwKYVmH7fcSH3KZH4LEbYHSeeDscsXlqiBU\/Y6ZTriy8M1AYFe6bQBmyiX2fcXy3Dj5VXPHdnVkXnTwSuo+eN\/fSlVEHCpcmpzWiOXovtUpyWBAYOKGnVQw3iYt9xiXxBYsdv2U3dkZxYDQU\/Vt6bbNAP5wzjoOso2NY3owQ+uXXzqt6HleYG6Bi+n7sJVC0Qz4JCBF0UvmbqZMHK8mmR5CYhvMD0UvXG5e+gQ1\/KPUjkEbxhPoIRuoCw\/fh9bK1kbXojwMsY3Iv6G7bGmPdyMhfY2KsEm8STsDPPVAwtAUig0lRcgs7mOmGOLk\/+L5JVhUKx6LEc\/kQ8w6GwgRiYLh75hMY7Buwz35OlsPvj1iCKS1QBNVJVnQlJ3QiARzCFqWSIUXbdiQZh0QkX2EEq4SmaZJxbDF04QsDXGkWjlegOqyLkZY\/5tD7TS9kc1YYT7Sx17qukq7DQBhP+nSeLybrcKoNdEJdDeng37EDRmmUieCxflso0YL42v24AFXi0vFFKxKB\/nbW8oIXgH1kuQawITOjoB5T1e7fP24Tqeplq50rwAy0yeH02anLOHZVljt2BaTEC3XU8cFcwS6mikLToBcxNRXsOoDedG\/zRwcw5o8xC2JkkHYMCb7W2qKLwrWmgOIvhKRdEwIRV8WN9zWWvCHBYBvnwoqy22CkqIYo3E0C04Uw7RBLeH4o0fuOCYrp9zgjWCs3wo2jAxTe3WwQOxP4Jc43KOrBbzVagVcg1HFAcwtt6b6yIhAkQTsIFTafiH\/w9bpvu2TmmL5LaYgAwkGmjpGI6g4YqpRwunT5BTZzB0pJ2gklU0nc\/2RFXhPZ5n01Wu\/q88HWWLT1D6rInP3ZKksOts9Xk9NG7ujgmIM8Na3mb99aLx\/oO3hYpSvZi0EBdAu4YjMNtQBLkxW+GqppGuOUeIFXjZlC5+yXTxgeF8XUP6vstyg00mTrLNnXLqq+oLqBnzO97Te+5M2U2XDCoXLJPuK5KCyjNaOn7rah454xLSnX01svTtoIItEGJ3nfEQiVm965X6hEDe6Bx0bL6NJo6frsYZzKDFsXJpwhHsAHmDoe+MSgtPK0fG\/u\/IBZvg0uKpK6sTyoTZ5n6Yw9jDkzb37rmEUVpQq9SeGih58vOLiIdCPMLBr9CdV44D4F\/41ZAtP7G8ysUVYmqWkQsg0DKEBQmWmfdTgiE11ZMwClTqwo"}
00750{"flow_id":23,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":252,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":233041,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEicOxAAEAGo2rAqAFny82XotNPAbtxraOsZPN7f4AYAOVbvgAAAQEICgAw1IhFrVgaFgMBAOkBAADlAwP\/XNiqxBer6CoBriARmvadzv\/U5kXIDNO5dJQ14ZPOdyCc+qdX8GXELVfQ5N806uYJcFsoXMTX+cAyXbg9n1utjQAg+vrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB82toAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIWloAHQAXABiqqgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":252,"source":"wechat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":4,"flow_first_seen":1492167378926,"flow_last_seen":1492167380233,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54095,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
02041{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":253,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":242615,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYn8lAAEAGcNfAqAFny82XotMqAbshWC6cT4FOUIAYAgvsgAAAAQEICgAw1IpF0bybFwMDBJ8AAAAAAAAADGqRIyt3e4c3YdVy0fwI5trea0bIMCV5scLGGeFVlbUEXq8UZGK3vmg+j1bpwjUvX9dp+MAKqlXZjnlhcinu3jFMwqYAB7Pgl\/RSX+LVs7iHm8UJOI+3cqGge3LlAwSlAwk0VUqouRNTtkbIatS9e+UrWOdyQBaGfM\/ktAEgkx0nB4IAolWMGhDvITwQyFxPi25sKlWlCuzJTUjphTJgxIImr16ATWiio0hNqhwxRvijJLt\/pGbykyhOr6l1b6ek007AggcYY8dE3mWWww+TlOXkRbrTkuspPTDH\/E0MQZqtUQdwtnJTiyLedVp6SB9oVZEHIi05+KIO\/HO9RrVUYj99bgr9\/eXI\/nrPTT10QiGnoMM6GbHS05yGOBuJJ3G7VLX+F6\/qDGqFsHFf1JbFFbonY5R3aLp6eDkG39gl5WFKLfMizWW7+xQ4MPPwnkqm0rE0OruF4UOrvisqhxjVnCUAmxR1PBziY2Dbv5pRqRH+xVeSFT5UVq34yPgx7kwLMIRbijEhdxgOZ1RUNVqLurf7LJCayW2rOBBP3eO6yzyKPug1QNPxkh5TlFVr9xzpAc5a9U\/xKxdpsm4T1FhokR9k5JPROpgqMOGjiMaxo3J6IBb3xm5hHuifDBKUP+m1p7Xn9RYV6wBOZ1HuK06XYjiwF7\/gDqO2Gg2JpkcTF8Xu6ih91uoiuyBAUXCLZbSFb6l38p1bLUv\/GKCoutrT8dLdnkJXmEtdi4t5Sc4CopO8oPeAeXuat0DU+6\/mPOZGaPNuxHbE4Lp0iWWGhJ5Q7d7qjdWlji5WwBr7L12HbgXRQ1eB7o7fNPOAF5UIu\/WM12Z6gW08FnIEe6OHNDxrtl25r490gwDPBQQaMsDSVZ0p6MfUmg\/TZcWaYEfSvxy3lSYaS524G7BU5HMwcDcTbKpF1dYz5VoEPPjYmWvhTv6XyRewzBqBEsDp5w0vIQ2ksvfQWwrlNvE2VBqTt4J2ocz0\/jj4FMJ6bkoEIBq7GGpv043bFVzUYG+raDHVPAmnQ5HuSB2FiGzyvp\/ynZ69TblsmWry95Bv2dMmlXDaFNcQn0w9Sc9lhHC8\/luMFe9R7PtxDPpPsYybbdvwYVVm7iix3lLcv4+pKO7wawUjQdt3fUs8iW69cyMT+1bhelqK6xx\/Bsk5P4B3n+QPBTbGGUEn7nMMpZaa51nh+wuOLRjsOhVIBkrf1y7sOdcAJSFzwIPNASwkRBO\/+QeCIx3\/kn1twlp7FG+KPLn6EvQLiMJ8F6bPcQoJt2UD\/YAB\/3zEI8EEoS2QdqIYAkGZiHS5bYaweMeM3ZJmu9r\/NEeAqBlaYLmNjwh9lDd+5NyP4VmNEe9lfO2rwAM\/qSiQ\/819ojb+tAjlO1LkBmUq0id8KoKZh6ptH7AoKvjiGyy89mVnivW7btYoo5QWJ\/BNV26OMCReMJTU317dcgylavX+3K1V6FhSggO44mWVD2N6tXzdgMwUbraGoqwGOF6maZ+n6NvW6+aQkF6M6RxeTsP5Nhow1MBIgJQ8Tb6TdLPguZDSXbOfMyhzuD3GycClAZBa5RuX5uBIIKdJ"}
00436{"flow_id":23,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":254,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":457988,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG7009k83t+ca2jrKASN8itLQAAAgQFoAQCCApFrVlBADDTmQEDAwc="}
00424{"flow_id":23,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":255,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":458046,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cO1AAEAGpFfAqAFny82XotNPAbtxraSaZPN7f4AQAOUR2wAAAQEICgAw1MBFrVga"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":261,"source":"wechat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1492167380581,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54096,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":261,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":581732,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8GvtAAEAG+kHAqAFny82XotNQAbtFV84kAAAAAKACchDy2AAAAgQFtAQCCAoAMNTfAAAAAAEDAwc="}
00425{"flow_id":23,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":264,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":585727,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0Ih5AAC4GBIfLzZeiwKgBZwG7009k83t\/ca2kmoAQAHgROQAAAQEICkWtWWEAMNSI"}
02347{"flow_id":23,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":265,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":590172,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIIh9AAC4G\/vHLzZeiwKgBZwG7009k83t\/ca2kmoAQAHi+xwAAAQEICkWtWWIAMNSIFgMDAF0CAABZAwMNrCSIDNOLvQwu+WC\/XbJdKP194hOWV0n1i\/00hc5t9yBcCmKlnX0+l8+VUFMMn312MkptWFpvDfV3jpkpWVkCt8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":265,"source":"wechat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":8,"flow_first_seen":1492167378926,"flow_last_seen":1492167380590,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54095,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":23,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":266,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":590211,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cO5AAEAGpFbAqAFny82XotNPAbtxraSaZPOBE4AQAPsKyAAAAQEICgAw1OFFrVli"}
02347{"flow_id":23,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":267,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":590625,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIIiBAAC4G\/vDLzZeiwKgBZwG7009k84ETca2kmoAQAHgahAAAAQEICkWtWWIAMNSIi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRuQZta7ETnvqFtrDw9Sift1iQXzYX72v26iTZCGzisTf7d+QKS2SpiQA5l8Dy7GgZRVhB+DXag5C8DSCCKjdDPBgEBABnKlY47"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":267,"source":"wechat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":10,"flow_first_seen":1492167378926,"flow_last_seen":1492167380590,"flow_tot_l4_data_len":3438,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":343,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54095,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":23,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":268,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":590649,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cO9AAEAGpFXAqAFny82XotNPAbtxraSaZPOGp4AQAREFHgAAAQEICgAw1OFFrVli"}
00780{"flow_id":23,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":269,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":591251,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4IiFAAC4GA4DLzZeiwKgBZwG7009k84anca2kmoAYAHjl+gAAAQEICkWtWWIAMNSIRkegUwvMxkxVvteWTRtsy7b6NWkuMrZF4TyVgb+E5NdsFtADy6H37iuqs2GVTfzS3XJPvLl3D+Ri0ojp6RMGjY8ZVkX\/k4QQz9yw\/Njz4veR\/gCMZ6Itbi6hRLL6p9wdeRluCe4af35kT2e2dsJAEwU69kODFYvUDnl2Dque6AtNTIPBK1zE6+TyM0srw6tg\/ElUwrAI8dqVU2p9s+1hIyhy1SQe8f5Mqi921MHuqt2hj4JtmhI3cs4h14ogHwkVPTXKJC+WLXY98QB5iWBEkL9a8b0BCtimgSnGXOR+Ay1FRh8sbaI6RImz4Wph0CkNS4OBDl1wg+lDBuoWAwMABA4AAAA="}
00425{"flow_id":23,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":270,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":591287,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cPBAAEAGpFTAqAFny82XotNPAbtxraSaZPOHq4AQASgEAwAAAQEICgAw1OFFrVli"}
00596{"flow_id":23,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":271,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":592818,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACycPFAAEAGo9XAqAFny82XotNPAbtxraSaZPOHq4AYASgsOgAAAQEICgAw1OJFrVliFgMDAEYQAABCQQReTD6wNH0MTu2Xeroepy4aexjx4e2n7L2funPy1zNlFaA2FAMr0v5a9I+LJMJgi2pPDvpuviDMGBI6Eh8HOwVTFAMDAAEBFgMDACgAAAAAAAAAADiARZ0NrkHoDDFlyO5g17UpugH+ytdavJRQF9b50Hax"}
00436{"flow_id":24,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":272,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":894348,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG701DDsQ6LRVfOJaASN8i7gwAAAgQFoAQCCApFrVm2ADDU3wEDAwc="}
00424{"flow_id":24,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":273,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":894386,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0GvxAAEAG+kjAqAFny82XotNQAbtFV84lw7EOjIAQAOUg0QAAAQEICgAw1S1FrVm2"}
00748{"flow_id":24,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":274,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":894610,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiGv1AAEAG+VnAqAFny82XotNQAbtFV84lw7EOjIAYAOWJCgAAAQEICgAw1S1FrVm2FgMBAOkBAADlAwPkquj1+KgT4KNlV8MaR+Hdvo3+qTOKljkN+dwtx1j15iCc+qdX8GXELVfQ5N806uYJcFsoXMTX+cAyXbg9n1utjQAg6urMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB86uoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIqqoAHQAXABj6+gABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":274,"source":"wechat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":4,"flow_first_seen":1492167380581,"flow_last_seen":1492167380894,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54096,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00447{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":275,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":947303,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABExrdAAAERD+fAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":3,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":276,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":947353,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00448{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":277,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":947734,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABExrhAAAERD+bAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":278,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":947762,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00495{"flow_id":23,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":280,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167380,"pkt_ts_usec":953431,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnIiJAAC4GBFDLzZeiwKgBZwG7009k84erca2lGIAYAHihjgAAAQEICkWtWbwAMNTiFAMDAAEBFgMDACh0+E7epZD9eVBRkwrRTXJ2FcCaScxzkJxpEodh7Yei1lVGF6yGLPn7"}
00424{"flow_id":24,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":285,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":211728,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0VIpAACwG1BrLzZeiwKgBZwG701DDsQ6MRVfPE4AQAHggAAAAAQEICkWtWgYAMNUt"}
02344{"flow_id":24,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":286,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":212485,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIVItAACwGzoXLzZeiwKgBZwG701DDsQ6MRVfPE4AQAHjgBAAAAQEICkWtWgYAMNUtFgMDAF0CAABZAwOeRml+UEXV\/c05TUmeBavqKEyDNwxx0uepvO9Vp653ByA3mLBCmIceJJgOxXyELRaSDZshWQNNLhQemCnnvWjec8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":286,"source":"wechat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":6,"flow_first_seen":1492167380581,"flow_last_seen":1492167381212,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54096,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":24,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":287,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":212528,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Gv5AAEAG+kbAqAFny82XotNQAbtFV88Tw7EUIIAQAPsZmQAAAQEICgAw1X1FrVoG"}
02346{"flow_id":24,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":288,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":212932,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIVIxAACwGzoTLzZeiwKgBZwG701DDsRQgRVfPE4AQAHjpiQAAAQEICkWtWgYAMNUti6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQSMuE4RsBoYpE292p5R+anu9ciUT\/Hc468n4OA5+NEg0+be4WfoFqBtj9V6cpBSJhCEsGS8qvF5xqCEo9MXukVtBgEBAF6VvgGy"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":288,"source":"wechat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":8,"flow_first_seen":1492167380581,"flow_last_seen":1492167381212,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54096,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":24,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":289,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":212968,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Gv9AAEAG+kXAqAFny82XotNQAbtFV88Tw7EZtIAQARET7wAAAQEICgAw1X1FrVoG"}
00781{"flow_id":24,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":290,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":214255,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4VI1AACwG0xPLzZeiwKgBZwG701DDsRm0RVfPE4AYAHjX4AAAAQEICkWtWgYAMNUtMtEcXJQP74kjXZiXpO26folEXtE\/5wUdXtwlTodUkQ4eQ0khK3WcW7Fn72amkTQ2YBqN\/S29luRw6pGj8WveriECv6W\/V1sKsSHWojIXmb1R24hbXhjVOMFpTnUO\/38G7ai5USiUxLHmi\/GUxg34DK0IjWMCRruY47ZZUxEQ5bWfimxb4PQTCdVAKgXnRr5qaieYoUmcSfKPzfueCVbS1BQ1EnbyxER3tYNfbGAPlZRoIN9MOSPtlPl6IcGZyV7Vywz8ButClD0PsxQZHJ0N1tFdSbN4K9pjdpD7gpkvEdUsVs4DNujVW8G7Vsm2sWuPrLSW7UN4uAhGzn4WAwMABA4AAAA="}
00425{"flow_id":24,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":291,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":214287,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0GwBAAEAG+kTAqAFny82XotNQAbtFV88Tw7EauIAQASgS1AAAAQEICgAw1X1FrVoG"}
00598{"flow_id":24,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":292,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":216865,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyGwFAAEAG+cXAqAFny82XotNQAbtFV88Tw7EauIAYASgL7wAAAQEICgAw1X5FrVoGFgMDAEYQAABCQQTNVYAcrmfQlaPl+lusSHKltZwaA1QUJnfmsHU\/5UeUi3qvOHyn7p6F40aqB52U8i2Jic+\/6sSY0eAJSOXrOL66FAMDAAEBFgMDACgAAAAAAAAAACRHf0nmIIQuWMwwMntQJ+Pk8tHsI88+iGkCABKxX+mC"}
00496{"flow_id":24,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":299,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":531445,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnVI5AACwG0+PLzZeiwKgBZwG701DDsRq4RVfPkYAYAHhqbgAAAQEICkWtWlUAMNV+FAMDAAEBFgMDAChlnbffjnU8cNa3QzQCV5upK\/xOXB0V5j+uFzM9zOv9dEoYHfMxgqIO"}
00425{"flow_id":24,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":300,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":568242,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0GwJAAEAG+kLAqAFny82XotNQAbtFV8+Rw7Ea64AQASgRewAAAQEICgAw1dZFrVpV"}
00448{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":301,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":948192,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABExsdAAAERD9fAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":302,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167381,"pkt_ts_usec":948330,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":303,"source":"wechat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1492167382020,"flow_last_seen":0,"flow_tot_l4_data_len":20,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40740,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00407{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":303,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167382,"pkt_ts_usec":20263,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAokulAAEAGgjbAqAFny82X058kAbutvz98aYB+jlAQAdESKQAA"}
00417{"flow_id":25,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":304,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167382,"pkt_ts_usec":374842,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAoL8xAAC4G9rPLzZfTwKgBZwG7nyRpgH6Orb8\/fVAQAIMTdgAAAADZK2u8"}
00448{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":305,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167383,"pkt_ts_usec":949003,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABEyKRAAAERDfrAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":306,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167383,"pkt_ts_usec":949103,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00424{"flow_id":12,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":345,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167397,"pkt_ts_usec":120263,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePJAAEAGFx3AqAFnQOmnvIyxFGy60MyoSq1b+oAQAO0gQAAAAQEICgAw5QaFnXDI"}
00424{"flow_id":12,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":346,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167397,"pkt_ts_usec":175313,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0qRsAACsGO1RA6ae8wKgBZxRsjLFKrVv6utDMqYAQAWWjrgAAAQEICoWeIMQAL7Ej"}
00425{"flow_id":24,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":351,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167400,"pkt_ts_usec":811884,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0GwNAAEAG+kHAqAFny82XotNQAbtFV8+Rw7Ea64ARASj+rwAAAQEICgAw6KBFrVpV"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":354,"source":"wechat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1492167400812,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54097,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":354,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167400,"pkt_ts_usec":812629,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8voBAAEAGVrzAqAFny82XotNRAbuSN1YhAAAAAKACchAKOQAAAgQFtAQCCAoAMOihAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":355,"source":"wechat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1492167401063,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54098,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":355,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":63693,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8\/z9AAEAGFf3AqAFny82XotNSAbu9GRfgAAAAAKACchAdWQAAAgQFtAQCCAoAMOjfAAAAAAEDAwc="}
00436{"flow_id":26,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":360,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":175317,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG701Ey6mUDkjdWIqASN8j5bgAAAgQFoAQCCApFrW16ADDooQEDAwc="}
00424{"flow_id":26,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":361,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":175359,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0voFAAEAGVsPAqAFny82XotNRAbuSN1YiMuplBIAQAOVesAAAAQEICgAw6PtFrW16"}
00750{"flow_id":26,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":362,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":176057,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEivoJAAEAGVdTAqAFny82XotNRAbuSN1YiMuplBIAYAOVZ9QAAAQEICgAw6PtFrW16FgMBAOkBAADlAwPYeeuaiTy\/tIyKXoKofIhRithfsRyeOK+DY3\/clVFvoSA3mLBCmIceJJgOxXyELRaSDZshWQNNLhQemCnnvWjecwAg2trMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB86uoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIenoAHQAXABiamgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":362,"source":"wechat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":4,"flow_first_seen":1492167400812,"flow_last_seen":1492167401176,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54097,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00436{"flow_id":27,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":363,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":410519,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG701JpITMTvRkX4aASN8iiggAAAgQFoAQCCApF0dMbADDo3wEDAwc="}
00425{"flow_id":27,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":364,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":410611,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/0BAAEAGFgTAqAFny82XotNSAbu9GRfhaSEzFIAQAOUHxwAAAQEICgAw6TZF0dMb"}
00424{"flow_id":26,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":365,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":535088,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0CNFAAC0GHtTLzZeiwKgBZwG701Ey6mUEkjdXEIAQAHhd1AAAAQEICkWtbdUAMOj7"}
02346{"flow_id":26,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":366,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":535740,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXICNJAAC0GGT\/LzZeiwKgBZwG701Ey6mUEkjdXEIAQAHjHlQAAAQEICkWtbdYAMOj7FgMDAF0CAABZAwN83+a2Me56fibXx78rUR363\/nTU2lB5WzIcz9sv1UMVyAaIhm+GrvSL4C3za8tBz\/r8L0Wzeb9BIm3rLTP4zTFlMAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":366,"source":"wechat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":6,"flow_first_seen":1492167400812,"flow_last_seen":1492167401535,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54097,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":26,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":367,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":535804,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0voNAAEAGVsHAqAFny82XotNRAbuSN1cQMupqmIAQAPtXYgAAAQEICgAw6VVFrW3W"}
02701{"flow_id":26,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":368,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":537513,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMCNNAAC0GGDrLzZeiwKgBZwG701Ey6mqYkjdXEIAYAHgsPgAAAQEICkWtbdYAMOj7i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQfn61MCOntjQBNjCmmmldM\/GDNnHO6scDwbjNlCfZN9uXmL0ohSb5bGJjCQtFyK1jVyQzz92e05XdNwElXrx4qBgEBALtnr\/UL\/ucyTI2a49U6884nZEhP7T9DIs6D45g4GtqwizfD6g4Veq\/aC6xxcrjSuOX4NNVam2QlYnlwR50m5UXhlmxaaiJiPZHUVm7MEJcLJqiad5sLjBnocfb1mOwxYjqrXK7xT\/D2Je1LvHEEDHQf46JWeA3FaZ+ikHxR3VKF3NZUUTEaficAIp+ghIEgWjLvH5y6ATevX69WFA\/PdFWfKlhZ\/jZ8nk+VwMr+TNUzYIVWEZLrAt0+nlGVg8o\/b91ffsnpJVM9o16770l55XNmTWnQx9vASLjp59vV9SIHYrbcHR3F1cz4rmK0sFY8WKVf3UPDc2hN6h0t2rBuA9wWAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":368,"source":"wechat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":8,"flow_first_seen":1492167400812,"flow_last_seen":1492167401537,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54097,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":26,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":369,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":537558,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0voRAAEAGVsDAqAFny82XotNRAbuSN1cQMupxMIAQARVQrwAAAQEICgAw6VZFrW3W"}
00598{"flow_id":26,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":370,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":540714,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyvoVAAEAGVkHAqAFny82XotNRAbuSN1cQMupxMIAYARXRzgAAAQEICgAw6VdFrW3WFgMDAEYQAABCQQR+Zzl6OF3mpBTuo1MHw06sa3HXCYdc2aan\/mlkbUAtlxEnFnijBED0VLBGpUi2PPuMFOYY4FqU2Kwbgr9KoNadFAMDAAEBFgMDACgAAAAAAAAAAPY\/RIx9sjpUCxjOK2FLU4x2pg76qmzxkX0LqNsEQp1b"}
00498{"flow_id":26,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":371,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":897493,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnCNVAAC0GHp3LzZeiwKgBZwG701Ey6nEwkjdXjoAYAHhVMwAAAQEICkWtbjAAMOlXFAMDAAEBFgMDACj\/FfgXKdx6o9tjixDT8r1LXUhCaN6fSWvolEpiQojx\/\/sEVcb95exU"}
02013{"flow_id":26,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":372,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":898785,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATEvoZAAEAGUi7AqAFny82XotNRAbuSN1eOMupxY4AYARUgVgAAAQEICgAw6bBFrW4wFwMDBIsAAAAAAAAAAUhA3Rzn3cn8QroJPh3uJK0RvC4RvPYg7CjUtj6oBNlXeexDCoL+DeLnyahyw95JVAv6lfpQgs9kAS0xuYnNYsoMDKeBA+OT64SrApgkgJFUXjCGa+gDUVkPWJdVy6fISbdkzigkeUH2l51oPW2TLD\/Ab0fqi7QNCd3huQxOZfvNe\/QpCl89Rw8nPHoej80kpFMugCLGHmYbBLpj20F\/lZzFU+yzw2iKWsYFxUypffNAIunv8aZVRk6lYll7I2VMVkVU3j2wZ2Y3s17rivQ1z2D3Uy1oBzHpkGWySL3UZQTRYmTZ0aS9UKEH3qPKzaZ6Tt01ykM7M\/sZNkM0UIuCVNsn6pn6yx8W64ssBq\/3Lcg0OwVK4tK4ttv5sN6OeY29W086nOqa7st\/AGlLbMlRhgiS2Q329qyXLAjQrax5Vwr11AU+\/OEHH4aoQT5dPPvMDT8Vwjt+38veGGUypHbF8eUgmSZHbMYZMHw8P3SijYwrfDoAlnvkwJHXExO56vWrdIIfWbk0VwkIJCRmnnJR+\/afcpiBOk7FF2bW\/0MmHWlV3d02TaRXjyDs2LKJqvI+GGqTb8YtX6AKb1C1RNNx+ci2vg\/3hd\/zg\/sE9zPZxwqK2Tx6zIztnf9nWXZXYTOrrDXK6mafPt2HvYKqzyE3yr8\/fK6gmb6Dh63\/IYjGDxol7K1+cgdI7EWC0SoJOJzvfJ06ybsqgiqAVqr96gptrvpNu\/f5T+aOvvKQXDwiTAGXWdvwiOgdSmmaZnMlrIzA8JDW3B53mBDe\/uslkXj2OUIJhVfYLQjuzqEJkessL51ihVGN8NbLR7nYksIQFPbRZJHBi1cOhuV+VPpQmh5PzGf4UPnN7GBOsuHPSFS5lktWsK1LEBAp4vSztD1EpcvGHCLh14QJ\/KlkSseLnQTYaEEFbth1KEUMUOFCqsZK3k5pPcIE4PAl5ukDLh3geGRTR8kIGLE5+ty1+HbLCjiYOOrSNF8rn9KbxSKd745Nm77DtQN6QVLvTshdqJNgUxvU0\/thG2YcwNHWoXSMWxi+uILOB7\/s2P4WdUq0cJMEvTBUB6h1CfYlHaI+M0clTBWWgNX3QzmulXk4rJyVBEDfr\/PBTMOsJ1gjT9VWo7cYDuYT4ipy8vSxDueYvqQNfAJcft2jHm1ealWiWmmdOBamgVRpBK7TFH1Ls1U++6h4rgx8rqr95cuuyUmgZ1D7H3J4aCzGxVfro4ZL5uLl\/r+9z06vnR8Z7xguvsR7iYDkq\/EI7hyGDUkrba3WNYjuNrjXHFprWKAntDWuXtpQthXyEwkM3Ex2dj9XMVYwU9uR51CRnUn9rtb7ERU7wch4kYBrlItm6UOb+3lYX9vHE+VN0edM5AvWFgnTme4Vc3b+02oLff53CahuxBVzDVu5K6CZ4Sdxo6GavMkyCvxNOyVCqPv8P+mEM34s+LSRQvKiI0bWM2XnSF5yudGFNc0yfnd4I15UI4qkzTm6lPuAjjxKmZiJGQwGs4pklWZku7+U7N+Kt3MKK2evVIvpXM49+bJNoqAqYw=="}
01071{"flow_id":26,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":373,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167401,"pkt_ts_usec":905990,"pkt_caplen":535,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":535,"pkt_l4_len":501,"pkt":"8IQvSpdgeJKcD6iOCABFAAIJvodAAEAGVOjAqAFny82XotNRAbuSN1weMupxY4AYARXtrwAAAQEICgAw6bJFrW4wFwMDAdAAAAAAAAAAAs3H1ZM9NDXFCr\/F4X\/nO5HUAcxx+b5yJGhnLdCulewgQed+Fpr5ANLhW6Laa0nrCJt+a7t2haiHacgl12MjuKGTzn+QVSVWVtSA2ZKBvdoAsCTd93P0LQRUzdODQmh8Sjrhj9Bx51VqFfZ9QrAiShZWrmE+n\/N\/b0MC47+TWymwAknLmU59QOvHTQDoih7ja9SugPTE0X9JmS2\/fMpY28eViNP1SEoLbGHp33J7r8\/ZnZ1qYdbrO8fdrAifSj40WtXsCQpENLYpLOPKk8BGYeY4TQ8d4MdanW87a8GqlEJD\/B9ox1ch4hg+WTc17Qy3LU1QdvNXM4WUBUzuzOXCPj0Ga0XkFvojfL19iJNgohoQHlKy74ZbFonq\/H8HlLmjJURHBHxb2V8gI6ms\/T+kKKbwCxbhXXFegiTEaaoKhkSqWJSXbC6xTFpktgMtQZOR3ScZomeWHPQZttjlQ+\/pKGJSQwdCWoOvwmvsOkN3JbGDIWTPNoTx5I2bcbWIQYe04tdjOHGyzAwyLb0UE5G6RVVWWDW3T6QSNbx\/DbRseGQR+rMJink6\/Cfinlao4VM5SRbLMZD7\/\/WqP2WEZ9iQ0xr8YT3KMM\/Xsw=="}
00452{"flow_id":25,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":374,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":13192,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"eJKcD6iO8IQvSpdgCABFoABHL81AAC4G9pPLzZfTwKgBZwG7nyRpgH6Orb8\/fVAYAIMZWAAAFQMDABoY8p0q0Neyx8LzFoDelCtviTdTs0pFnXUR7g=="}
00407{"flow_id":25,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":375,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":13258,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAokupAAEAGgjXAqAFny82X058kAbutvz99aYB+rVAQAdESCQAA"}
00408{"flow_id":25,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":376,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":13506,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAoL85AAC4G9rHLzZfTwKgBZwG7nyRpgH6trb8\/fVARAIMTVgAA"}
00407{"flow_id":25,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":377,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":52277,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAokutAAEAGgjTAqAFny82X058kAbutvz99aYB+rlAQAdESCAAA"}
00426{"flow_id":26,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":378,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":271345,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0CNZAAC0GHs\/LzZeiwKgBZwG701Ey6nFjkjdd84AQAJ1JAAAAAQEICkWtbo0AMOmw"}
00408{"flow_id":25,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":381,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":309809,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAokuxAAEAGgjPAqAFny82X058kAbutvz99aYB+rlARAdESBwAA"}
00750{"flow_id":27,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":382,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":310146,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEi\/0FAAEAGFRXAqAFny82XotNSAbu9GRfhaSEzFIAYAOXLGwAAAQEICgAw6hdF0dMbFgMBAOkBAADlAwNcdyw1yRDcJ84bZrg3yfpXPyAQAyCg+1tU4GVhjRrgZCAaIhm+GrvSL4C3za8tBz\/r8L0Wzeb9BIm3rLTP4zTFlAAgWlrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8KioAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIenoAHQAXABg6OgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":382,"source":"wechat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":4,"flow_first_seen":1492167401063,"flow_last_seen":1492167402310,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54098,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00744{"flow_id":26,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":383,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":335967,"pkt_caplen":297,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":297,"pkt_l4_len":263,"pkt":"eJKcD6iO8IQvSpdgCABFoAEbCNdAAC0GHefLzZeiwKgBZwG701Ey6nFjkjdd84AYAJ36FAAAAQEICkWtbp0AMOmwFwMDAOL\/FfgXKdx6pGbalAz1ohkcA0lw2HwrHPuK9\/idzZPdcoSBfT7Jc5IB8+Q0\/iqiXWeiux54PEEb10mQ0NnmXUs1k9xWI1fO18IfaEHWmMVhXjTjn39E+xIiT\/rMyrwzBhM3vPKdwzqG2+\/pOewuwuaLCD2dBP+GQFajVHfNPwkJDAViiuPi1wGVZfBQk9kFJyHbovzhq7lZ+zlig0PtFdEi9Yiz60lOElWBfnTwm\/g1rqQnV4R\/ExK\/5BeoIvKE5wRE0CUm6sSbJRT8k81DbZZGlff0xmTiGNfAOA7sqmYeeMCC"}
00436{"flow_id":27,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":386,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":503323,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG701JpITMTvRkX4aASN8ihIwAAAgQFoAQCCApF0dQjADDpNgEDAwc="}
00425{"flow_id":27,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":387,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":503381,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/0JAAEAGFgLAqAFny82XotNSAbu9GRjPaSEzFIAQAOUFyAAAAQEICgAw6kdF0dMb"}
00424{"flow_id":27,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":388,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":663779,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA050BAAC0GQGTLzZeiwKgBZwG701JpITMUvRkYz4AQAHgFLAAAAQEICkXR1FQAMOoX"}
02346{"flow_id":27,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":389,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":665578,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI50FAAC0GOs\/LzZeiwKgBZwG701JpITMUvRkYz4AQAHj1YQAAAQEICkXR1FUAMOoXFgMDAF0CAABZAwPjjdO\/iKaTvZmxOOQcIaPi+XwdRT085iLMQSzoXvX2CSD2Roioh3VliBz70\/MEuqHmVMPaLVlcE9C1qSXIt5UDlcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":389,"source":"wechat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":8,"flow_first_seen":1492167401063,"flow_last_seen":1492167402665,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54098,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":27,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":390,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":665635,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/0NAAEAGFgHAqAFny82XotNSAbu9GRjPaSE4qIAQAPv+ugAAAQEICgAw6nBF0dRV"}
02698{"flow_id":27,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":391,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":666132,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbM50JAAC0GOcrLzZeiwKgBZwG701JpITiovRkYz4AYAHgsPgAAAQEICkXR1FUAMOoXi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRiCB\/oTnfbUwjHRkWGqKpkzWY2pPBFPSI0yl+TbNLg7osPgJcu3tO6CEuqUsUJjoo297g\/pub8Uk3SYQMbvnV8BgEBAAIRTPBMijx0A7fIwTN60i3BCQJK21T88+nZ0ohdQLtYXD8\/2Xu42EjSiOL4mMaRS77Lrj9FAnr3YwBIRoBj5ZexvizNqBZJjFOhCmH6CvsZswlyVIkh9WLXL5peuFTT5PdamoHJ0r5DMgU1OcATqzbQaTWDyCTkmWiu2xACXKNgb8p2IgGnpQK5LKxb7TPAuaJgJUboC4mA1aHYwMbhfvelmQQdHX1pXUjinFKE1tX5o6J8aYViGPJxnXnnIfo6K6TtO8nECxxn1upXYeDQGfk8aHchQCyPvNEQEF6u2ITkaCyH5bymmaKW4FybaGsc5FpnHpv26eig+cwL\/mPOvkwWAwMABA4AAAA="}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":391,"source":"wechat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":10,"flow_first_seen":1492167401063,"flow_last_seen":1492167402666,"flow_tot_l4_data_len":3698,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54098,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00427{"flow_id":27,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":392,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":666174,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/0RAAEAGFgDAqAFny82XotNSAbu9GRjPaSE\/QIAQARX4CAAAAQEICgAw6nBF0dRV"}
00409{"flow_id":25,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":393,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":666204,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAoAABAAC4GJoDLzZfTwKgBZwG7nyRpgH6urb8\/flAQAIMTVQAA"}
00600{"flow_id":27,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":394,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167402,"pkt_ts_usec":669115,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACy\/0VAAEAGFYHAqAFny82XotNSAbu9GRjPaSE\/QIAYARWScwAAAQEICgAw6nFF0dRVFgMDAEYQAABCQQSodlJVfkgcPdCNyg8MxcPPyMMVu2GGgiiQcNvSk\/XPNS4tHGVpWALjyRNlzUBgx8BOzjGw3P57YxKONN42aXs0FAMDAAEBFgMDACgAAAAAAAAAABpHCGE0LVyx5Ogac1iVBZTsPVuaoIc1Qg\/Jbk1Zpdak"}
00494{"flow_id":27,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":399,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167403,"pkt_ts_usec":18073,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn50RAAC0GQC3LzZeiwKgBZwG701JpIT9AvRkZTYAYAHhnaAAAAQEICkXR1K0AMOpxFAMDAAEBFgMDACgbsP2NNYJif+6lSsn5QXXt4R3OAUoL58YjbIDnRnSrCx280FkQp1TW"}
00426{"flow_id":27,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":400,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167403,"pkt_ts_usec":56266,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/0ZAAEAGFf7AqAFny82XotNSAbu9GRlNaSE\/c4AQARX2nQAAAQEICgAw6tJF0dSt"}
02117{"flow_id":27,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":407,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167407,"pkt_ts_usec":235126,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUM\/0dAAEAGESXAqAFny82XotNSAbu9GRlNaSE\/c4AYARWogwAAAQEICgAw7uZF0dStFwMDBNMAAAAAAAAAAfebI5XaJ010wJ70Ri2YGhndP8+ZytDiNBiAKP4ipKsMF8p4ERu13yjfNgMIGWA6O6R743mwM9q2GQ2emt3hDANg9txcFQJjGiGLRU5YIjMk2RqY+xutfvaF1cxx8m5DuGYfkMFaWwVNT\/H4XxyKk09AjkNcuGiAM7yWj8X4hzmrO0F1lvnkFD0kiI2tK+gdtZqGK4QalxP1XPkvygMWxYG+Ld30bja1Ef3yQd1PhEy742Yyx2q32bPtLl5onqGEcsJjFksvFX1XHESscua\/2dDyW9\/Dw\/dwhR\/BcQmPoCmbW9ZiR0E+eHLO36Rr\/rDAXWZNE8BENKHIWiJu0W2Q336RwMnybG9WeRqZCZOaBKPATu2rAst1VF\/HV5zJR4B70u1KCSQSHrh1114CI6i3mEJtljQVzISk9SCURuWYemfDR+y3wvuRdjV+NFg66JW1YAmzK7QRmKCg4+D0U5f6du4lv3zi0IIuAUJBC0MwFO7neVOKmdmHXuLFmm9FSw\/Xh3WHSlFc\/nvSL6JYikFwnOiA57P9K9S3t7a69fp26SsF8fs6XhDkcYL89h+104tRxKetj0QXTQ7vkQROjQoqnbF1H6wvcdZetMNnKqgpRw1CPa6dMLtkLBl\/PZXLqN\/LsAkS+LzixPMTvKb3ezUl7H7Pu5G4WNWvppvmgkLwA0MQDayGYK5SJPXmZSoZKUdsEwwrK8jPzo4Opm2Nve126FRRSPpzCNfC4XVZz7sSXF08ofqm1xROE+AybRrVgD361X1K4tkdnOKvM5umP7CnaP\/z6fVaEtzo98VjwWR3KsNrS725vErh34IsAaZXJbMTAKgezpcHriuwRIdANyF2F0iYsZkbVEmO8kyr4kjxU1Iuaz\/8uNYTV+Yq\/9pyu7IEjT0htB0KA9Hy7akAJCUGRWPcnHyFFooW365Xo\/3anh+2nzH4KMAi8F5GPafpSKEvJMbf2wzLEp39QSzBlr+NvHDciPN1CC5m\/BZ7enPeUj6zGuTef5o7Ujrerv1NURED31uU3R3WNo\/8c8hTpScvrmnO6zRhTuZ1e\/fekQekvNAhi5ZhmEsDIcfg06kBIvEoMK7Pc\/m42SsjueqiVyBW6dZNXiYvJOBRIafGJXYXvLdIiYGp2+ctlbD+rWHdZcCD2SGkhsVVPcA\/gxz42SKIZ1r21quG3N+oNV17W8SxmY1d2d+D\/j9vJ5SpGSUh+zzjqRBJk3dCFn2uIr+xrtl2qO\/tLabn7q+K4kQ99zZNihTcryYF8A5KsvNOSFNzVrY5QJXGgnk9SO5twWuZCGO57aIdcBkX6qePw4GKouU0m0ztV7tZCCUTIZWmwCVNlDe06GkxCtPZMZxqSbnjhCgxBBRsv\/V+R+wEHSAFgPYTeoOukuicgjhBG0Xuv6EXllM3GBuTlxcx9y2uPm\/TNVUdBlnba9U3O9IiW6n17ax0OhmkQ4D3src3ZJtq4ofF4VR2PJnGWecEbYcUyVfbEyhSSG\/GlU36KLc3hRUsq4xr2\/NZEMkWuRZxffLaAS0dHy++iL1s5GkAjUWrmfQDOBgtokVAcKW13VmTLKHDWGx7po4\/gi\/vf6P87vbHV7GV17HfIvhBwcfGteGUCVw3gXJ6q77EAMuNm9TuRct3BA=="}
00449{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":416,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167410,"pkt_ts_usec":267931,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABE4H5AAAER9h\/AqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":417,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167410,"pkt_ts_usec":267986,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00448{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":418,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167410,"pkt_ts_usec":268365,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABE4H9AAAER9h7AqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":419,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167410,"pkt_ts_usec":268399,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00448{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":420,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167411,"pkt_ts_usec":268663,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABE4LZAAAER9efAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":3,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":421,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167411,"pkt_ts_usec":268762,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1492167337792,"flow_last_seen":1492167353998,"flow_tot_l4_data_len":796,"flow_min_l4_data_len":32,"flow_max_l4_data_len":636,"flow_avg_l4_data_len":132,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54084,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1492167337792,"flow_last_seen":1492167353998,"flow_tot_l4_data_len":796,"flow_min_l4_data_len":32,"flow_max_l4_data_len":636,"flow_avg_l4_data_len":132,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54084,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00516{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_first_seen":1492167353687,"flow_last_seen":1492167354015,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54085,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":3,"flow_first_seen":1492167353687,"flow_last_seen":1492167354015,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54085,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1492167345896,"flow_last_seen":1492167360666,"flow_tot_l4_data_len":311,"flow_min_l4_data_len":32,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":38,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.78","src_port":53220,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":8,"flow_first_seen":1492167345896,"flow_last_seen":1492167360666,"flow_tot_l4_data_len":311,"flow_min_l4_data_len":32,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":38,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.78","src_port":53220,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1492167345896,"flow_last_seen":1492167360663,"flow_tot_l4_data_len":279,"flow_min_l4_data_len":32,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":39,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.78","src_port":47627,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1492167345896,"flow_last_seen":1492167360663,"flow_tot_l4_data_len":279,"flow_min_l4_data_len":32,"flow_max_l4_data_len":87,"flow_avg_l4_data_len":39,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.78","src_port":47627,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00509{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1492167353687,"flow_last_seen":1492167354049,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40741,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":452,"source":"wechat.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":4,"flow_first_seen":1492167353687,"flow_last_seen":1492167354049,"flow_tot_l4_data_len":80,"flow_min_l4_data_len":20,"flow_max_l4_data_len":20,"flow_avg_l4_data_len":20,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40741,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00425{"flow_id":21,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":466,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167422,"pkt_ts_usec":952271,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0KNBAAEAGqhvAqAFn2DrNjsJ7AbvMOVSD1yvysIAQAT2SvQAAAQEICgAw\/kAycps2"}
00425{"flow_id":21,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":467,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167422,"pkt_ts_usec":991183,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0f4cAADQGnsTYOs2OwKgBZwG7wnvXK\/KwzDlUhIAQAVRmugAAAQEICjJzSzUAMHos"}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":468,"source":"wechat.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":41,"flow_first_seen":1492167353687,"flow_last_seen":1492167367265,"flow_tot_l4_data_len":25193,"flow_min_l4_data_len":32,"flow_max_l4_data_len":5858,"flow_avg_l4_data_len":614,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54089,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":468,"source":"wechat.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":17,"flow_first_seen":1492167353937,"flow_last_seen":1492167367264,"flow_tot_l4_data_len":4091,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54090,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":468,"source":"wechat.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":15,"flow_first_seen":1492167355723,"flow_last_seen":1492167367264,"flow_tot_l4_data_len":4027,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":268,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54091,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":474,"source":"wechat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1492167440370,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00404{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":474,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167440,"pkt_ts_usec":370306,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":50,"pkt_l4_len":12,"pkt":"AQBeAAAB8IQvSpdgCABGoAAkj9gAAAEC8bPAqAH+4AAAAZQEAAARZOybAAAAAAIAAAA="}
00467{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":474,"source":"wechat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1492167440370,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00436{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":475,"source":"wechat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1492167440984,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00411{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":475,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167440,"pkt_ts_usec":984773,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPPkAAAECRRTAqAFk4AAAFpQEAAAiAOwAAAAAAQIAAADv\/\/\/9"}
00468{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":475,"source":"wechat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1492167440984,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00437{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1492167440984,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00436{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1492167440370,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":26,"flow_first_seen":1492167366908,"flow_last_seen":1492167378674,"flow_tot_l4_data_len":10622,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":408,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54092,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":8,"flow_first_seen":1492167367159,"flow_last_seen":1492167379000,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54093,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":8,"flow_first_seen":1492167367159,"flow_last_seen":1492167379000,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54093,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00424{"flow_id":12,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":476,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167442,"pkt_ts_usec":172270,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePNAAEAGFxzAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO1ERAAAAQEICgAxEQWFniDE"}
00425{"flow_id":12,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":477,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167442,"pkt_ts_usec":226462,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0\/NwAACsG55JA6ae8wKgBZxRsjLFKrVv6utDMqYAQAWXzsQAAAQEICoWe0MAAL7Ej"}
00436{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":478,"source":"wechat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1492167443647,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00408{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":478,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167443,"pkt_ts_usec":647047,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPPoAAAECRRPAqAFk4AAAFpQEAAAiAPsBAAAAAQIAAADgAAD8"}
00468{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":478,"source":"wechat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1492167443647,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00408{"flow_id":30,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":479,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167444,"pkt_ts_usec":467952,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPPwAAAECRRHAqAFk4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00436{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":488,"source":"wechat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1492167449288,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00408{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":488,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167449,"pkt_ts_usec":288224,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAWeJKcD6iOCABGwAAoAABAAAECQerAqAFn4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00468{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":488,"source":"wechat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1492167449288,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00411{"flow_id":30,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":489,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167449,"pkt_ts_usec":586432,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPQQAAAECRQnAqAFk4AAAFpQEAAAiAOwDAAAAAQIAAADv\/\/\/6"}
00437{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":490,"source":"wechat.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1492167449288,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":491,"source":"wechat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1492167452759,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54099,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":491,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167452,"pkt_ts_usec":759446,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8XuFAAEAGtlvAqAFny82XotNTAbtWrkW6AAAAAKACchAjbQAAAgQFtAQCCAoAMRtbAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":493,"source":"wechat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1492167453010,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00435{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":493,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":10353,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8DstAAEAGBnLAqAFny82XotNUAbuiFhVRAAAAAKACchAILgAAAgQFtAQCCAoAMRuaAAAAAAEDAwc="}
00436{"flow_id":32,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":494,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":125561,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG701NWIPBqVq5Fu6ASN8jLwAAAAgQFoAQCCApF0gWaADEbWwEDAwc="}
00424{"flow_id":32,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":495,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":125650,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XuJAAEAGtmLAqAFny82XotNTAbtWrkW7ViDwa4AQAOUxAAAAAQEICgAxG7dF0gWa"}
00750{"flow_id":32,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":496,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":126120,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiXuNAAEAGtXPAqAFny82XotNTAbtWrkW7ViDwa4AYAOUnVwAAAQEICgAxG7dF0gWaFgMBAOkBAADlAwMB1JsivsRgj8yUUGC\/C0eM+z7uYBFdAkifuDVMARIokyD2Roioh3VliBz70\/MEuqHmVMPaLVlcE9C1qSXIt5UDlQAgCgrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8mpoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI2toAHQAXABgqKgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":496,"source":"wechat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":4,"flow_first_seen":1492167452759,"flow_last_seen":1492167453126,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54099,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00436{"flow_id":33,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":497,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":357624,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG701Rfi5PhohYVUqASN8gDZQAAAgQFoAQCCApF0gXVADEbmgEDAwc="}
00425{"flow_id":33,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":498,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":357702,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0DsxAAEAGBnnAqAFny82XotNUAbuiFhVSX4uT4oAQAOVoqQAAAQEICgAxG\/FF0gXV"}
00424{"flow_id":32,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":494187,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA09Z1AAC0GMgfLzZeiwKgBZwG701NWIPBrVq5GqYAQAHgwIwAAAQEICkXSBfYAMRu3"}
02344{"flow_id":32,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":494952,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI9Z5AAC0GLHLLzZeiwKgBZwG701NWIPBrVq5GqYAQAHhYvwAAAQEICkXSBfcAMRu3FgMDAF0CAABZAwN6N5cNcKB+geZ586vm83PPhTrmXxNHenpMA7hzmZodZCDTV6G8D5hCzz2oy9LF\/fe7R79cAC6gdeTyhTkWLR5CJsAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":500,"source":"wechat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":6,"flow_first_seen":1492167452759,"flow_last_seen":1492167453494,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54099,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":32,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":501,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":494995,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XuRAAEAGtmDAqAFny82XotNTAbtWrkapViD1\/4AQAPsprwAAAQEICgAxHBNF0gX3"}
02700{"flow_id":32,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":502,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":503112,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbM9Z9AAC0GK23LzZeiwKgBZwG701NWIPX\/Vq5GqYAYAHgsPgAAAQEICkXSBfcAMRu3i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQSPkMfKw10jFMaRSAnXxd9r1t17LwS+aMPmApZZbfSXP0\/fWlyIToTneiL+QDMhsA1WoF5d0Su\/mCO4hAcQSFxxBgEBAFR74UoSL0b+jqsoSuKqGa4DlzExNf2fj\/VtLFzWfqyINaDl5rnJVFqEm08mNo0decbeQ0LfGXeY\/ZVKWLhL4oX2qYQuV0a6l5WWlz97kfhOzR0p2sFswTCjFWxqR25f3UG6vYLrXH9gMPcyuU2LcMcv94vbKGEE\/4iXgNeZ7ab1p+z1bK0+4FmgQjOZk\/qBByyRPrXhBO2SbqAXTdDQyFoS2lpbsxIo654dF5qMCX8Lyhk42vRVy4gvXoNtBxJqgsMJF2UcW3jbnuKu59F+PrIWN+MYhrKFPZQ0xjNi7muyFF6Iv8cXw0h7m5IHfZmBupLYosRzNZB16cjQPS4XnTUWAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":502,"source":"wechat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":8,"flow_first_seen":1492167452759,"flow_last_seen":1492167453503,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54099,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":32,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":503,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":503170,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XuVAAEAGtl\/AqAFny82XotNTAbtWrkapViD8l4AQARUi+wAAAQEICgAxHBVF0gX3"}
00599{"flow_id":32,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":504,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":506267,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyXuZAAEAGteDAqAFny82XotNTAbtWrkapViD8l4AYARV8ugAAAQEICgAxHBZF0gX3FgMDAEYQAABCQQTAUPypt9xaHCSU1tnZVmstVn87nMzf1JxjuZz0Dcm\/IjiDmrcH8Xg1GCgransUMQVsGK3AuYrz2m\/ZIpTChkN3FAMDAAEBFgMDACgAAAAAAAAAAK4eB3OcBQ+sbR1xd9XV894cFoYH\/CR+gwJ4Wm5PTFbT"}
00499{"flow_id":32,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":870993,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn9aFAAC0GMdDLzZeiwKgBZwG701NWIPyXVq5HJ4AYAHhfKgAAAQEICkXSBlUAMRwWFAMDAAEBFgMDAChEfqMDeLUua6RwlKh9qSN0\/\/E\/94R6G\/s4Y+xlw8mnUe4ch5s4cMck"}
02115{"flow_id":32,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":871867,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMXudAAEAGsYXAqAFny82XotNTAbtWrkcnViD8yoAYARXoMgAAAQEICgAxHHFF0gZVFwMDBNMAAAAAAAAAAYYMnVn215PUdq8d5A7X8PLOGlQz2polfuAQ3FUIJ9lGkFNif7zjaAlJKSNvDLa1l7frU2vmd\/NudQN4C9KonaT0HdJer2PJoyJ5vjlMtu+BV1uuIjghTqywPqpPG\/3VYFjdNU7WVea1bGgQcx+iLCMjRaMEVmTiSwNgmsJ3sneuDMK3EtFcHto2RyYk8PJYeba+NlUEVRjM\/KZRdWBP3+FPivLgEs2puvmQJlPv5aaYWHeGBkEutrnwyC1UgbfAP0sNwQ9DWsuXkejXM70WB6cgghmlGaPJZO\/UL5nKLjsYfgtTRofjA+cAIS51hbNM5DdxzWvw0T6tTubw781TnmV4bB4hD4wcNPYBW\/snjLBkNsrb5s8djmkP3KZg3vJoJrrl6UsFZhpJR5js2JUs4OgMsWV3sRVY8eZN9elSQ\/Bxsv6HMxSj5WtX7pMuFANW+nvn\/XCxvvzx4J33GaDEJE70KBjkS38sVnsozCr1k8ciC0eDf5YmoeY4\/w54nrqVUdY\/fbDy2a5dml7fou0GvZx60HY8eL7repPY0Kv0psLbFT+rFeRJS8bRcDzhT4+ZZy0xKNWkvknqk5eAC3ehmwvMSjbvsFIS9z7N\/ShDUdErbWK8GwKQQx7krq+o4qiu\/t5XjcCkaT8rJ\/6GS6XVVAjD0ZBFt+OdVkFmpoYiBLD\/EH0lwtyReTwUhUspVj5iTdfnN0gm2Iv7JLg\/\/65bk2RZVNXD9l6\/9zKhitXuKbtAIRqiv1wanzVuXLR8PQVcdCRl68k52pA5yIVjaf97VzlmiXkOv21CvKG6KCkzyT3AfzFh+3DGW6f01WD\/+b4Tk42XOXcgG3uCMXjcDG8AR1FwIzrwhyDclvtnqktRaRotPptRbuKJuEjaAZRhYgtCq9H4UwRHIFrBBE02Tki+zuROi\/Yzj4FMU3Om1Aj3kmEBhBnJxBlMquYEGKc61gwrfsSHf5tg8PLxmT7Z5CY7cLqoOkA7PymH8hT81VBVMuQaVMIOTgU25fb+q1uNKPObt99XlqL+lIWiaRKVueBd\/eYH3TQ+zaaUvy74nOSosDllQdbfR98zEFddsRaq\/pNEPqFwoeQvn49q3NaUAJfbf4Be2mNsq2DXkBhlYgEv+hHcqPFrGnw\/VxoKYIKKp4MUrXwxWb+2pNsjNoCa39dBtZ51KsxwOR\/zHqPasR6N4ubVwOqnBt4eLWT0tGC+AlgoyapoRvM+tf3+xzo8FwHyVL8sKlK0ApF7ya7Tlsx6F5pCrX\/RN9hyYENkQcUoy4wSRrJuekkC3h7moIic0wy4DqPbYZJLu8fCTXms6sfQSusVofc2ln0b8TPXamvMm7P8rJ+8\/cMTioNguam3\/7vr4zV6uLDvO7tg9SySIF+UJiLPvdRrHRoNThsvKytBV6S17RMjArlOrjca9+MfO4fzVUZ3t9qk4jjs71OdX7xumafJl6Ofj3+5tdplIgCvOL0QwQnJwzm9hq2E+tc\/NYzi5Job7pbaQCgrSGMgatFSlOqyCEwy1XxhLn6x1I70bFfzbwFLZCWgsV0nu0n72pbLAzLAkv0U7SveK\/wBX2Fd2nmAgpjvZh6rToxWkDSxR25VYpfR\/w2rV2a4749McFGpOgoO1dPa6eRrBasPnQ=="}
01076{"flow_id":32,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":507,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167453,"pkt_ts_usec":875106,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPXuhAAEAGtIHAqAFny82XotNTAbtWrkv\/ViD8yoAYARWb\/gAAAQEICgAxHHJF0gZVFwMDAdYAAAAAAAAAAvtBn\/6uM2YutXiUB5wx6pQKBAsPs+FjwAAZCxkj1AljGX0D+F2\/SNyVcVyOhBTnYSumM668nhfaJua9X+FOGxUdKBJg+KtZKDs3FeGACo+oAqydz3VoqqlnLVxtBjGLF8GmB2Qnl4VhOLT1CVz5XBh3\/IQGQBr6r\/fQKqsLwy58Na+v+FhwgW5JQ1OoaOpdtgg5CAFeDyo9B+ekVBh7JFpud90VWtjkk1AWDAy6BTCfK5jGdGejTJ62xw6R2IXZU4Cih\/j9Z3QufOBmKiFeKPKrcFZJgGH6q0e4dS1eHN0ENwku8CNqlBG97N9C2wtfivN0GXNwJNAmzAmWqEJAF\/NxeWV5OQxvZ4N+wvhYYluh4IV4LHBYSjFOwsxfJlMiLlJO0L1yfYgELS9u5AukWnkP1B0bVbIv8MHpETJx\/VXebC74dB8ILdszOjv4Rol\/IlqJ+HIxxoGaDd7Tf7wQRNloQthCHs5z+cTmSAwQ29CjKD6KdaRD6PB+P+\/9czo53yzA0GouBhO4hyjJxhdQHtp60IJP922x0k8WA3NkASGZ1jZz3MD49BOVN\/OvC3sbFaqEv7t0dv3OnxL8QEZvgw0C3S2f4Q4dCTYGELEqJA=="}
00425{"flow_id":32,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":249739,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA09aJAAC0GMgLLzZeiwKgBZwG701NWIPzKVq5N2oAQAJ8a9QAAAQEICkXSBrMAMRxx"}
02360{"flow_id":32,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":509,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":342463,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI9aNAAC0GLG3LzZeiwKgBZwG701NWIPzKVq5N2oAQAJ9QIwAAAQEICkXSBsoAMRxxFwMDBqVEfqMDeLUubHjXDqL1UGRQa3G75vA0XsmSupA282tfARdwquGHO0x5nFxgFKbnCYJDxmMKCsvAz2QxIpIkSsWjSA0XHKqtn5Syh\/QaoPNVi9wCZYkxBpJV7UK4zzyujwMu2d0E+ek++odStLP7ZbZeDrXnDrVaMPXCZ5Mazlxhe6ExAN6oHuD9a0ysejEGQabofHOHqdDXXPcNq1QmIXC5X1nllUpgQBOC9iUPOU5U5HIg+tTXKYnp+RJLZ08hBIoccW93msjeus\/j9YR5FzO498dIfM9rNMRpvnJq6GhzCXdZanGdLt0NDF8vuPNMD31XlEXt+5G9RPKQ6\/ebEtXLpCeKIDLW5NBx0iOg069KSU\/JXA+5vujQSrDwRG8LcsKmXzUUDP9cvJ92tR2+SYQcWJC8jt0qwmF7bIcvXbYHprodmGziiT13Ukq7cvjuHcFPXAjg7UxQgwjP5lWfEzrO4n6e2Xw0YrMZTzdrf0zxtNaR+87fWgr3C76rxoje44DiKTEsHmzU0LwJ\/OXqtTmnDalkW6NwrQuL\/yZIyjXsQGk+pCEiqSoBfUZiVjhW2UA8cJFBwXrGQtwv4gUlQeMFW+GqkPiNa6ALKInJuNYhg9md+lKrE1GnrP4\/vqY4m7j7e8wIvavumhyI9qB5UfnzWnhXevsT2hrAn2Xx\/JIfGvt6n0O4m2\/1WGioGTZlIX5WKUfK9HYKZhYiX74Uv9G+nNfnuRZoGEtnqQjwcb\/fjEKox3elkYliJYs+DpNlDmeZIVg+kJk+1dDXunwlWCUrhr9UllyZZrJNMYT5xDzc8eVSTg+4hlotjxjwH5eKLfve4b\/79RInir0E5Vg4WGkwKVXGS\/h1tmj9lmeVv8cGa9lJChHtFMomY1YfmCxtdjdJg1DazDpNx4CBYkdM59IhDC5XeV5m5iV7JUHDjUHIiL6iW\/5lRBwl+wBVnQYW87MuYbeDQX\/7oh2RFgB9wIwi2g70ZVNnHY+njLCHUlN\/DdNPwI+IjQj2VZlpD+tUmPKi5QR49fO+hlpAizXYG21QlRF59O0En0wUuwFVeP7s3nX1OTHWmuA49NFDJxmEeF6LiZ6kqDQViffw2WT4cirKDRyQB8G8QDOw49YTYyuGFrfXA4CueOWYJ+wUyWihOnDvMgCncoi557gF\/\/qVFW\/Ihqy4Gt8tuEQuj8IA0qtjCvLU8PyZgNmGrj1JRuaqFrr\/hKqLbFMLwCzfwmUnUezXM0P5GMRT1UAIfoSn8v+5SxCwgutg9wvEv5qxfCDTqBsXHIw0xbs1P\/EBTR9NsPE7JEa4RqrqGCsRlZhtI8JbKZ40y16nHhoFdrqD9ooXlRwpDst5Z1iYG+mZPWb7AMrIy8SF9a7JLDGi0qF4lVMu9vhE+rIruBhw\/IqPY++Fg4Q6RJ1GMqiKuzXaZdJ3K9sXvQYegVax8xZWeSCh+JpdmELYSD1v7\/0GTlBOxp2IqkiMqJXqyDV6XIy5sj7+RDvNegi\/WIIvwJIIzfiHdyVqGqGJIwep7L39xEGOTCl42UazACchASNMmjICAyAYUUW93i+yJjR46GRN0kanWx9jU+yOQN95BMOdsZGVq4jfYUxa648dyB3l05IgR+VR\/6doLb8A9iEbCsn2d6TBCdHW3Ul7Ybd7vmjSPOXpjuhvmEMFFtoT8AIhP9bMNBFIlCdkkgh7xeH\/aomjiYmb7E9rCM2XuFBYtrDidc1+uzNM3Kg41jYXwKtSfNBn5+2XZwK4Tb81HZr0v7VYQBOBVSUWZdcprOhcUOncqZ91rjFQyuJyk4KkkZIuhYCuC+FII09xjwblzeHgOBNeUtFveZ9qd8IoXCpSnzTgZKzGSId6tfyKzPA1XPMma74oOb0fwGLlgefPkUtYRBirG9UKIgbU"}
00750{"flow_id":33,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":513,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":373136,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiDs1AAEAGBYrAqAFny82XotNUAbuiFhVSX4uT4oAYAOURrgAAAQEICgAxHO9F0gXVFgMBAOkBAADlAwOwu7FYw\/oDOwKcTwOiOKv7YlMzDssvxBClvfkpiaCariDTV6G8D5hCzz2oy9LF\/fe7R79cAC6gdeTyhTkWLR5CJgAgurrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8uroAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIuroAHQAXABhaWgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":513,"source":"wechat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":4,"flow_first_seen":1492167453010,"flow_last_seen":1492167454373,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54100,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":515,"source":"wechat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1492167454457,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54101,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":515,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":457964,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA86XpAAEAGK8LAqAFny82XotNVAbue7PR+AAAAAKACchAqvwAAAgQFtAQCCAoAMR0EAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":516,"source":"wechat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1492167454458,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":516,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":458448,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8cSZAAEAGpBbAqAFny82XotNWAbsdO2wiAAAAAKACchA0zAAAAgQFtAQCCAoAMR0EAAAAAAEDAwc="}
00436{"flow_id":33,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":526589,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG701Rfi5PhohYVUqASN8gB6QAAAgQFoAQCCApF0gb6ADEb8QEDAwc="}
00424{"flow_id":33,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":526614,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Ds5AAEAGBnfAqAFny82XotNUAbuiFhZAX4uT4oAQAOVmlwAAAQEICgAxHRVF0gXV"}
00424{"flow_id":33,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":520,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":731209,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0lM9AAC4GkdXLzZeiwKgBZwG701Rfi5PiohYWQIAQAHhl0gAAAQEICkXSBy0AMRzv"}
02344{"flow_id":33,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":521,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":734223,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIlNBAAC4GjEDLzZeiwKgBZwG701Rfi5PiohYWQIAQAHhzUwAAAQEICkXSBy0AMRzvFgMDAF0CAABZAwOas640v324U5D9fJ5vO7sGpYs+zF1VgVdL3GKV1UbE9iAcYMK9E59njED1hK3WStu15DAHEEhJMQg30HN\/4iKe5cAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":521,"source":"wechat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":8,"flow_first_seen":1492167453010,"flow_last_seen":1492167454734,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54100,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":33,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":522,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":734253,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Ds9AAEAGBnbAqAFny82XotNUAbuiFhZAX4uZdoAQAPtfYQAAAQEICgAxHUlF0gct"}
02701{"flow_id":33,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":523,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":734884,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMlNFAAC4GizvLzZeiwKgBZwG701Rfi5l2ohYWQIAYAHgsPgAAAQEICkXSBy0AMRzvi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQS9xwP2rDZ8v5OM1C2UYmY22LDhJiPHMc5Uf4rUFegirTO92nlAEQiJAyliKnEsGzPz5GPmR+IFlsOriqNRgMwbBgEBAHuXA3aefQWaU\/lOUm5S0I9RFQ4IbYueXISYP7j0LkkS3uf4X9H3UqrEeehoKZacOFxJS\/ZGfGnSnlbIbkSCfMgwKIVi53TnZXqlGtoN1y32YCQRxr2TtMKFOvFHXXYHB\/Ac+HtEjLyD4FoRkgOs1lfr41Qb2jvew6cmKv0uk0+RtOPB0FkS3htNWgCsaO2tW\/BS9cINcffQjRG9lcCTl5oVld+YC7M37eMRLsPXeSL3dPhoQ5G\/8Pc3l\/3ccU4EzbDQCJ3ro4cMItf5yxd3LsEJ9Uv4AzzgVPjFnvtov+syVv5gL6Ziwn9T7\/5eReUBJwcy2rO7pN8dQWv6aP7QfBUWAwMABA4AAAA="}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":523,"source":"wechat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":10,"flow_first_seen":1492167453010,"flow_last_seen":1492167454734,"flow_tot_l4_data_len":3698,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54100,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":33,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":524,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":734930,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0DtBAAEAGBnXAqAFny82XotNUAbuiFhZAX4ugDoAQARVYrwAAAQEICgAxHUlF0gct"}
00599{"flow_id":33,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":525,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":736194,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyDtFAAEAGBfbAqAFny82XotNUAbuiFhZAX4ugDoAYARXDmgAAAQEICgAxHUpF0gctFgMDAEYQAABCQQSMckZo6cNJuKko7ASzNW8zM48WYISyypuNV8z\/optNU\/SHqo9BNV5u+mcIURe9QKYRxOU+O0Ixgamjl6HluJtcFAMDAAEBFgMDACgAAAAAAAAAABM7Fi0dg5nQ824BJcvpqk2VIb5P5kO5+onwest\/nLnu"}
00436{"flow_id":35,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":530,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":801978,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG701bGHEoeHTtsI6ASN8gRwgAAAgQFoAQCCApF0gdIADEdBAEDAwc="}
00424{"flow_id":35,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":531,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":802019,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cSdAAEAGpB3AqAFny82XotNWAbsdO2wjxhxKH4AQAOV3BwAAAQEICgAxHVpF0gdI"}
00750{"flow_id":35,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":532,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":802251,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEicShAAEAGoy7AqAFny82XotNWAbsdO2wjxhxKH4AYAOXnawAAAQEICgAxHVpF0gdIFgMBAOkBAADlAwNlRdxMBOhusYOhke3C4aoS6XOzHHv0fe3kJrWbx7\/QPCDTV6G8D5hCzz2oy9LF\/fe7R79cAC6gdeTyhTkWLR5CJgAgamrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB82toAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAISkoAHQAXABhKSgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":532,"source":"wechat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":4,"flow_first_seen":1492167454458,"flow_last_seen":1492167454802,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54102,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":536,"source":"wechat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1492167454818,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54103,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":536,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":818522,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8NuJAAEAG3lrAqAFny82XotNXAbvn9Cu8AAAAAKACchCqHQAAAgQFtAQCCAoAMR1eAAAAAAEDAwc="}
00437{"flow_id":34,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":537,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":836839,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC4GJp3LzZeiwKgBZwG701XgAvN\/nuz0f6ASN8ip9gAAAgQFoAQCCApFraHjADEdBAEDAwc="}
00425{"flow_id":34,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":538,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":836942,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA06XtAAEAGK8nAqAFny82XotNVAbue7PR\/4ALzgIAQAOUPMwAAAQEICgAxHWNFraHj"}
00752{"flow_id":34,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":539,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167454,"pkt_ts_usec":837325,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEi6XxAAEAGKtrAqAFny82XotNVAbue7PR\/4ALzgIAYAOV+twAAAQEICgAxHWNFraHjFgMBAOkBAADlAwOV9frOGjvUn7m\/tE4bAyr+3UrlA9jYYKoC1I6VS\/9RdiDTV6G8D5hCzz2oy9LF\/fe7R79cAC6gdeTyhTkWLR5CJgAgmprMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8+voAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI+voAHQAXABjKygABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":539,"source":"wechat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":4,"flow_first_seen":1492167454457,"flow_last_seen":1492167454837,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54101,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00494{"flow_id":33,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":540,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":84079,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnlNNAAC4GkZ7LzZeiwKgBZwG701Rfi6AOohYWvoAYAHhGagAAAQEICkXSB4UAMR1KFAMDAAEBFgMDAChPKKgx5Bx38tIqf0DBGgIgyJvCPJP6ArmNr9ujESXGV0ovD6Kp4fqZ"}
02107{"flow_id":33,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":541,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":84612,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMDtJAAEAGAZvAqAFny82XotNUAbuiFha+X4ugQYAYARXHcwAAAQEICgAxHaFF0geFFwMDBNMAAAAAAAAAAR3iS1C2zVdqt818j2V1AiBf6UJ+k1ajP+hPcA6ZaYO6QG1EI0V+qZOYYf829zKyM9HQwhpghq4FW557NyYcbY2QTbPztrqwDxaZpQyOlIGu0vbir1aEoWCT6MZ\/XE3W8+7QTd6WhoWUcoiPq+3G4NMdEENs0QwJvRMO7RovLuDhJbdxve+C2yTVR+S0aOnjOOSTk6W0Lyatd1nukKkQLmKk3u\/Db564dRnHhWL3BT+pRo+irQm5K\/3DXsyuZejR+18VRBN6oWdj99uqv96JsUmrU05J\/kyDJKYrsKpCq1Iy1vW+BycLnRaC27Sm+sOBG52f8Uz8uIVaq7tNp4l0ijXAerfw5LhD7LhmVFerHk\/EVjGXS7WMopb5TZBOiO0P79l7K7gqWE+i99S4pPiEAoulb3yKd5ZOxuGDjWlPXG3vTxYxvhNKBswER4jet7arTc0728EVqPx3WPkbznZSZKOxzG71oH0vpIqdW015UjMJyTPGH3gniVVExyPG5ldb6OqYQEvUOwmI8X86HtJBabpDWWkonoJ36QYMoixUqrEjCDCpI3I8nild2PLQZYlvd4qwxE6U1T8OiRDFZ+DvZmOpeRaUajX4fFEV10jzNsUnbD1Q8\/FPMpfM4v5BIF\/8bMBW\/C88WDS4wX3IfizYufrKsAcPIvEDpsLSFw+2OxzRgnVUpLk2kNAKTjlBkN9lnzAgkZKT9YNwKsdAL87PkFa3WfZwKT32YrMXPEmy6HGgLQXJ8xRODVE4gbePgySsJTyt\/oE4jS+V+d4tEzkWrZUEPz58JOJaJ4LYcGcVeay\/gtmZAfh\/dWcYK5tdhkDwqyElqyuCPXOewpH9f25dV43K22sDJBI9elGbrAV76nzDQJZjt4oTY14EbLv\/ABmrTZGYD8Gl7MRaiWtMzCCU8tbS7hh+Egys8wQebsWB+JpalwBLkacx+ou0FmgPGu25p4fJKWbGP+98GqdhyqLbZrCoFGTijJs1DBOUj+hAHOiUkH9KuaHEbGglvuNriPIOPsRwT7Ba5Kfi7g3kh6MfXTKEdDxAz8dZ6ZU23+pvmtEwNVqJMr3beZ\/sTasozYVuEpoUkbkto766BHf36SeemWaLiRottQSm3a6P2pEPmlfMN2BBMTwv\/Ku1\/8lr+c9jyF568Cm6yHFKhL3+A\/d0t0eJ\/oCcIFSgsFpFGs+pMhKc3r\/qeKR5r7RE54XYBiAeN+h7ZRls8Brtj4iTaBA0O3CwNYCYgC116jAm8c46XWmmg8JgFtRqgpFpiUkpL8yRoZ1rRhDhaPRN1j7SH73kSzr6nJObLXp6ksAWEp+okWPN6JRnXHD\/6U6nC4vRYgcpLdAyonX\/+5Bh4h9Cof8J795MKp8tQgvbvZDOgaajJOLXt5Q1N2WdhJHD8IwCRwqbQvy5ANalhvNZFz4bfaalGqy7F5lI9WjmslQs\/eaNCyo7ULm6c8V7ylUvCRbA3GqAq7K0roB4Wxmam86dxv1aXrSNxN28SSnnpkXS8w7CL530I5v+Hzf8rCtiClLxNHM8M7yvWg6hZ7TZiBXw0Mh6Yf0SauRXDNw8g52XyV5NlFj53vz2yvIFc2K9WtL0RJnDFSHe4u55hDkAqTZptWkOqTy8zctLBpJk1xg2TA=="}
01069{"flow_id":33,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":542,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":89189,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPDtNAAEAGBJfAqAFny82XotNUAbuiFhuWX4ugQYAYARUtwQAAAQEICgAxHaJF0geFFwMDAdYAAAAAAAAAAjCzXzV3NG55tysMmI01A0QawQKFiPB2YLgGazQfU83WRrCqYqvYZaoahgTyGhhR8OpxNgyiOhsBzGTVY3qrP\/Jgw0+huGS01956KIo2JCrmSGPA22cdsksfy77E+N69p+yxEvEl42WJmJqyZhBBDQbAsHrdw0lriW2L6uVO9om39xEl0QXJBlIlmevCd0BSAtnRk1diTX+KNhvChTab8Ro8eVKlHlwOCcPPe2tBts1++cA3xvMA4+wfymy+TZV9iBG1GvPw0Al4XVbJxjMzzT\/GFujlS90D+g5iRJ1sIgq3HlZl6UXJKBlVcIOrnscjGy55U3NQDBgO5Q7NOvuYjN4dWS3AISIU+jOB2HPrGU9mvUG6qqi4MqZbhv4xIKTeZaKKg3GhUtSeyyFIxlp9ZOXmYX3\/k+kB7PiZwOxnRfqv8XCmSOk4oo7eHe2HPUyk6NPBbHPXj\/XDvufjqp6\/bclIqyhIrfMuJfJacd13Ljb644yCzi+Y9509IabjTl7yRt1uEniQokFNFBYuWPNs5RFMSpi+R2+gvO8j6QLp2LGwnlxgP7g2iIRztNkmBv+AT6AsKKBnuKmU\/9sBDH2NId2yCHl7rNxgM8HvZBn4RA=="}
00424{"flow_id":35,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":543,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":176105,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0TYZAACwG2x7LzZeiwKgBZwG701bGHEofHTttEYAQAHh2NQAAAQEICkXSB5kAMR1a"}
04611{"flow_id":35,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":544,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":179324,"pkt_caplen":3182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3182,"pkt_l4_len":3148,"pkt":"eJKcD6iO8IQvSpdgCABFoAxgTYdAACwGzvHLzZeiwKgBZwG701bGHEofHTttEYAYAHgx0gAAAQEICkXSB5oAMR1aFgMDAF0CAABZAwOmYbJLVdEO1ex7gY39w3pjblOvuQdKqKCbcmULhSMqtyAeq8lCW6rjUSzPbiceDj7yEdXWbqYjSjHYCRN7e3dLe8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26Ni6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQqe8spAPs0X7RSbctKEExQii\/nZR21jBCdajGyxYXcWPJe1w6JPBIlstH2Aoln9E4iU5tSUXZOZdyF8FrZVEJaBgEBAMWGbVtOArJVXT\/6qrGzFQuyzq4Bk47TGF1wjrD7pK8SjxPeYu51kidDbiWdIZgua7gWIBY8p4rVnzXyLHfYGXxlyEdc+TelbHvVdjVaVY39\/ANn+Cxe5u1b8iGn32lm7alsSei+HgOQxj6CEKlIXiPl8DkLoVWpvOn5F0W4pUWDnmydd9BWtXpSD8A30RKRjZukcNrjqcpryQ6MKXfADTHQP8xvJHo+FlaSOZNCJocZpCSmvyTbr9r5QWU0B1RdEtBLvLPInRdqdbnGdw0JoEpqQPTuKmpaSjlbgEojQMf2718xrBgfpXJxb\/Uv7A5CiibTbmbTIvEbYT4D\/OIrVj0WAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":544,"source":"wechat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":6,"flow_first_seen":1492167454458,"flow_last_seen":1492167455179,"flow_tot_l4_data_len":3562,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3148,"flow_avg_l4_data_len":593,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54102,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":35,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":179351,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cSlAAEAGpBvAqAFny82XotNWAbsdO20RxhxWS4AQARVpDQAAAQEICgAxHbhF0gea"}
00438{"flow_id":36,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":179366,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG701d\/O17O5\/QrvaASN8geewAAAgQFoAQCCApFraI2ADEdXgEDAwc="}
00424{"flow_id":36,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":179381,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0NuNAAEAG3mHAqAFny82XotNXAbvn9Cu9fztez4AQAOWDvAAAAQEICgAxHbhFraI2"}
00596{"flow_id":35,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":549,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":180353,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACycSpAAEAGo5zAqAFny82XotNWAbsdO20RxhxWS4AYARXAvgAAAQEICgAxHblF0geaFgMDAEYQAABCQQT6mbFqrS3fjAwophItOMwj+qLk5VGgJXN36xSlo0GL+1w788l2beA+lKcqQIgQCQhuR7wPprFiAQeCn1u6Sl5IFAMDAAEBFgMDACgAAAAAAAAAAOd5V0DLp\/WK+k8tV1TnsQdr1hYfhUS8aZPXAvoeqGeZ"}
00750{"flow_id":36,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":550,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":180487,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiNuRAAEAG3XLAqAFny82XotNXAbvn9Cu9fztez4AYAOU9hQAAAQEICgAxHblFraI2FgMBAOkBAADlAwM9fcE0colRywJmHYx0JC6oiZlXQMNTk+HTiXDSO5d6\/iAcYMK9E59njED1hK3WStu15DAHEEhJMQg30HN\/4iKe5QAgOjrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8ysoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIenoAHQAXABg6OgABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":550,"source":"wechat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":4,"flow_first_seen":1492167454818,"flow_last_seen":1492167455180,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54103,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00424{"flow_id":34,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":556,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":190875,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0UbtAAC4G1OnLzZeiwKgBZwG701XgAvOAnuz1bYAQAHgOWgAAAQEICkWtojsAMR1j"}
02345{"flow_id":34,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":558,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":193294,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIUbxAAC4Gz1TLzZeiwKgBZwG701XgAvOAnuz1bYAQAHgpRwAAAQEICkWtojwAMR1jFgMDAF0CAABZAwN5lLx\/anNa5CdWKHFAWo2KsKhrZTHGO\/XekBGAWPpWUCB66mvcfG4Ged5EomNnAZ+CIUduULHJ6+CXsjslEbhhf8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":558,"source":"wechat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":6,"flow_first_seen":1492167454457,"flow_last_seen":1492167455193,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54101,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":34,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":559,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":193307,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA06X1AAEAGK8fAqAFny82XotNVAbue7PVt4AL5FIAQAPsH6QAAAQEICgAxHbxFraI8"}
02697{"flow_id":34,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":560,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":196100,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMUb1AAC4Gzk\/LzZeiwKgBZwG701XgAvkUnuz1bYAYAHgsPgAAAQEICkWtojwAMR1ji6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQSNBLURiDoD55uWxibVC9zReKlFx4BEDXdWGxMFKl9T5qwy1j7jAhyxCIBDLoSWJR9Dlx+HdqCUriOCLFcbeBelBgEBAAXkcFQocFdv33akBjke47ngxkAOMRyasoYgBHjGenVYoTi0PEjdl2sqxRUUGSjaECcxq325chACNvyY2ywZ6MFYIqCgdp6tGKuaNi\/yYIylqLGjabd5yIM7Fdx2GGZ0FEQ4p5DgF1tVyTFPKih1R8rrMvLAjaVmJ8Od9tDaDoY7\/RGQ2kL9HmcXerZBDlLAZAGfVp+8bNPWvgn95WjyjAbsCdg37ZVasaluIxi+CTaA3uKtwBbRvWklXfef10CSBDExvA1micJApp7qZ+syX05\/pRCf0iLsVzOyiiw3Ql5tuxBGzYKExfaCqObpMkrjeni954t5Cs00PEmIQHs94A0WAwMABA4AAAA="}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":560,"source":"wechat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":8,"flow_first_seen":1492167454457,"flow_last_seen":1492167455196,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54101,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":34,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":561,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":196125,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA06X5AAEAGK8bAqAFny82XotNVAbue7PVt4AL\/rIAQARUBNwAAAQEICgAxHbxFraI8"}
00599{"flow_id":34,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":562,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":197171,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACy6X9AAEAGK0fAqAFny82XotNVAbue7PVt4AL\/rIAYARVbqAAAAQEICgAxHb1FraI8FgMDAEYQAABCQQSe9ct109vl3nZaGpDspqU+kMk+njSATjwJpfRNEoBk4Fy+IGL5tqh9idWN8sua685w\/MhQolN5LUCaobR2x7W5FAMDAAEBFgMDACgAAAAAAAAAAA3rMunx7WZhU\/w92CUQrH9WIDvPZrDkxZfJeEKQqupU"}
00495{"flow_id":35,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":564,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":495488,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnTYpAACwG2ufLzZeiwKgBZwG701bGHFZLHTttj4AYAHiAnwAAAQEICkXSB\/YAMR25FAMDAAEBFgMDACjdvGeXbmORNz3imQRxQgJuk9A2g4DSsr760MLCQrIRMFfV61GTF3hu"}
01911{"flow_id":35,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":565,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":496690,"pkt_caplen":1153,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1153,"pkt_l4_len":1119,"pkt":"8IQvSpdgeJKcD6iOCABFAARzcStAAEAGn9rAqAFny82XotNWAbsdO22PxhxWfoAYARVpUAAAAQEICgAxHghF0gf2FwMDBDoAAAAAAAAAAec2HimkjMvSkuGTQ3MrrTK23YW6zEDG4HtifnBw8dy\/ojjIDVyVauiw2mlYAjbJT7NoH9FiJFwpEOYf27Ebh63VcW8lcOJQJY4vc7EFvVhuDfqkQP78nKDH0qu8CQiY4oXrWHevBRnQoohdj4XDQvoJBw1q\/tgWflxu+7ggVBgjwzHp6ZNuSTLYyhqgqbl0HSDz3BIlXowmwek2YRTP9M2U1LQG9BIHSccX2vVigNw7HpSTkpZz\/\/\/outcNZ2XkMgxOvXVZ630tzzXLsce7GCDGj7DMMl5vC245eeVxx1gQgFSu3x9vugLSoAbOfeE2BOSAf5KWO+Z94IpXmE9Hk9UbMSd+D4wC\/plixDabpKlFbmKADc+kgXGE3eCQxcbh2k0ufOOvYfxWltK7b7z8bPZ2uNOBO6UhLN3p7jcjRbTjIh5+Y5IIEU7iObF8KmgTGzKg+Zgl2vrTFwJxOANMP4g59abHekT4w7GDbu7RXS+Rne8P89j5SJb\/Ms1F+Ay\/ei1OCO13cI3n3ksVR8Oj\/Lo7QlUgkeTKSLhqGUMqEFCPF6IIrb9MVdfxAAETx0ZVKOYynr+X8LI3vNuJ304FY7pG3\/0emqFYzc0M\/FooXUVth+rhH90BTvEv2X\/j9wDc26ribOTSvxyLJoCGsiby5CZlVF1\/djEcjWtcBhkx+\/SLp+dCI\/bfztvDFm5NqWp6YHm\/lsdIxcVAUJ7uUvemZrKirC0o+aMPsbvM\/fYVHqk3q2j2bhSx7ql8BfcZ5LnHeKk1qOcRHl2B0r9lng1QKMASp0JL17\/9stq8Mo9Xrvq0DePvW\/pBqUgQVC+N5aaM8Wnzu0l76NC1xzArS3uVrpEfwS8EyAkZUW1+jDhJ+uQJoeFW+K7OaBq2oa30VkhYpyJUfOYHMmDcJAwLwQcfAYlAxvdlv5pHrNe16uCbjBLisa6JrIY7FQsx2eCPxLs62ZEmdWQImjMwEjFFv74zU\/iqlJfzpeWnLiAnLdALgv5YIePmzWNE5UIiOdat93mdCEsg1AnnhnsXjMXclzsElsm1fwXwPokFCAC0d1ip\/NhZimGoDvsSlRRsj0N8xu9199ysceqlt00bdwnXGp9s+5ObDy38W9nAKQcqKcUV+I54\/sJ84UKa1me1\/29cLFg5qyRgPm++q8jZLGGVQDZLNGanSNt2+PRfhzDHHx3gP9JxWEhLQQ5PmK8u\/myqe1pzKcvvgqtvTir\/xCjK+2+uBRok96zi\/uvTeSBoC12CivEVumMgq5G1XBO2RMq5YgXHlTwkNN6YwYaoXQb1lRzQ7QT2q5lYO\/nriGmObzoWg+CAtR1zudzHb0HWzq3LyXPXOBNv9IT9lFXTbGKmCk3YVTV7xH2ipkEBkxNxFaU0dUOuAy4vOHVrsPUR3hSgKRwmWOCS3m8keVhEVF\/BD7sWrKIglA=="}
00427{"flow_id":36,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":566,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":499530,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0\/F1AACwGLEfLzZeiwKgBZwG701d\/O17P5\/Qsq4AQAHiC3gAAAQEICkWtopIAMR25"}
02347{"flow_id":36,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":567,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":501579,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI\/F5AACwGJrLLzZeiwKgBZwG701d\/O17P5\/Qsq4AQAHiLTgAAAQEICkWtopIAMR25FgMDAF0CAABZAwOF+7w2SmHcU9zcb28JcDQnGAmx6shrVHepdober5\/0sSDLK5nEKozFFehKxLSZMCTAPUR52rwta8Dt2NpTSUG7QMAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":567,"source":"wechat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":6,"flow_first_seen":1492167454818,"flow_last_seen":1492167455501,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54103,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":36,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":568,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":501611,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0NuVAAEAG3l\/AqAFny82XotNXAbvn9CyrfztkY4AQAPt8dwAAAQEICgAxHglFraKS"}
02349{"flow_id":36,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":569,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":502415,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI\/F9AACwGJrHLzZeiwKgBZwG701d\/O2Rj5\/Qsq4AQAHh6jgAAAQEICkWtopIAMR25i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQToYIgPQnFHMukPpCMbYAtyCkTOgboRC\/IWCw2BGahXVmhSR3xmGfhbAz7L54KSkbhSzva1W6S0OrLg58ojgD+UBgEBACuWqtiy"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":569,"source":"wechat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":8,"flow_first_seen":1492167454818,"flow_last_seen":1492167455502,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54103,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":36,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":570,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":502446,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0NuZAAEAG3l7AqAFny82XotNXAbvn9Cyrfztp94AQARF2zQAAAQEICgAxHglFraKS"}
00785{"flow_id":36,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":571,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":502904,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4\/GBAACwGK0DLzZeiwKgBZwG701d\/O2n35\/Qsq4AYAHgYwAAAAQEICkWtopIAMR25VvFXSBWRH4LVMoif+a3PWQ\/IY3BX1hsBcm4fMDEwF26AvgqENGI8gqQJZCUGW8EqJbDuE+C\/hb1onY1PrhIBPuko\/71qFkmEs6my44YjiyE0x5TShTvdPqSejfT2TzPPcV\/3e+xH+tvqecNTCjdapI4+MA9Yb8fMsWeyfnMeOHXnBYsd2bDm8AUL7SL31x7YPixZDmVgHBBoDdtAKPOoQ+5faYTOkBXiEXR+97jLhGMU03SdTNf\/mmmX3YJXLfBjFjLxGIGnf6GveFv7WkltHvsT0euwWA4nsRqqkJ2s4JDJYh8zA9ILia+m50OrVV4Bak0GHZi2fEv\/a3QWAwMABA4AAAA="}
00425{"flow_id":36,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":572,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":502931,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0NudAAEAG3l3AqAFny82XotNXAbvn9Cyrfztq+4AQASh1sgAAAQEICgAxHglFraKS"}
00596{"flow_id":36,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":575,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":505447,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyNuhAAEAG3d7AqAFny82XotNXAbvn9Cyrfztq+4AYAShdrgAAAQEICgAxHgpFraKSFgMDAEYQAABCQQRLfGOXKsHTwDwaiRJMPFQZdrXTkVPKTQM6wmtGWYnFpie6rLE6uLmht2BoDbC1KqgfZuZPPJuk1BlRiwEqCfGNFAMDAAEBFgMDACgAAAAAAAAAADunnwkcqCnL0CfbOpb62nSTksEflqwm89UZmoGusPUM"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":577,"source":"wechat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1492167455528,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54104,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":577,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":528205,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8kudAAEAGglXAqAFny82XotNYAbvneYz3AAAAAKACchBIqgAAAgQFtAQCCAoAMR4QAAAAAAEDAwc="}
00497{"flow_id":34,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":579,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":563548,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnUb9AAC4G1LLLzZeiwKgBZwG701XgAv+snuz164AYAHizdwAAAQEICkWtopgAMR29FAMDAAEBFgMDACgzgIElE4pLe+2zi2rQXdcjmX\/2eB+Fwjq43XnFbQ9Q8FQ1vez2N5\/z"}
02015{"flow_id":34,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":580,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":564493,"pkt_caplen":1239,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1239,"pkt_l4_len":1205,"pkt":"8IQvSpdgeJKcD6iOCABFAATJ6YBAAEAGJy\/AqAFny82XotNVAbue7PXr4AL\/34AYARU0AAAAAQEICgAxHhlFraKYFwMDBJAAAAAAAAAAARWWS0VSAp5WXsKBTFf3GCcV8No8JgJmaPj7Fnc7VCQ0J4HlpaDIvs5ol2wRgWiq3aZipcP2F9MHXtsULWPBpMz02LSA4l4zWp2WFWDx1KPZCtHn4iHy1VwgNIKHnrcxv5GD7o\/gYakEexoJcB9XMyFnKQ4uIm51lzZZuhWVi2zFr9qhNPXyiiTLRmd7yHGKLd6xXdyraU\/vOw53LWLm4pjgb9FCtHEhbE9bwa4PoBzIASy15AIAxRtlLPpCHniBq5SPgCkhoZBBZRt4+Es\/HJ6j7cdW3V4YbS9j4JGtvjJEr19ADYKRQi4XsVICY38z3W3UuOaz5tWWUJ266IzaXpEIAUT4\/IpNwlY7VTuCiP1r8CPkBDJ59EyioAla7Mm78yYXNdTzNUBQaPyCcCBVlvChNp0Zub6o9NJBEBw7+FSq6sRjWyldgNITiJTWQ0ilGii8gkM1x1ve1HWvY9Vg7EBf4Rs\/al3Wqc5hU\/LPc34VHbl6GIx5MU01gDseeeHtIoC5Pu0UekyiBxdwmUtvj26YoRWVb1jgumP1H\/6IOIhE3Rdq0M4xHQHEyiOt1KX17L1W\/vPlTxhKXE5dN5wjN7jw6T5BHY17MxAYlLORyIKYK892BsQ2W0GcirIm9GGYr2PLrnAcYtb4y3111+ce0ok352NAeiX33SVVSmYyPq0nXUyC1GMYPwBTzj64sIlz9XSkR5uFF7d5Bqy42tvwU4A91yfiyn9ZHIHDO1kL2FQL3DU1K3f3RlZAD6QezJaBAmKQGZc8wxajGEOZK2xrAsYFrRj48zy4O0kdpMWSNOfUvENBMlh+c3LicWYUQjocSZTiHqY5IlajArulaYTCLB2vvEA4ZS1L38BXuWcdnyCblTnBkjxFnGSx6DATx4yrE6DlwMfycuVVceAidGHBk6ameXFetbkUoKE9XZPecEmYJuJS5RKyA0M1LCJNmnRqrsNDpAVnaExWjF7OEWU0BJOiQsTYBAlxA5IF8We\/OTgQ6uEgjJ7Sid8g262Q2EzeQQgVFDVQd5\/mM\/0gMeOcYdcBxaVPbffXkdWaxDjeuH9jQeuVzPr+k4yxswT4Y1Al2Akz8o2eTGRuAE3wiRCpps7MA3fzunwOR6NZuAkiHwev4fBZhBEiY9n8ltTqBbDZlmE+L6J0p+7GHVQu3OOBdpnggOr\/xthHJqDe9hI7h8Z5YreKyMsBsUvTQ\/T6\/Eg3v2FMaQWgLkhern4QQzLDjBVTPBOmsXTdQkOaenRMhENNhg7Xv62q43S9MlRqsNUyjWrXudvL3bEgfXFEfdvQK3Wi8cwS8Gj++lqITnlfhtObZKN8yJ\/3hngSm82OIGLE3ZjFyyrT51iPw\/KWgteCGoFGuAtv9Um+E2RJlRsFsq5CK1jdM2vHnKEd4wh3jX4+3axO92CX8Pq2qiuplCxQY4VPHmyOndIUMExP0VPFQ7OylVRIaKs3emskGDEEn88N6jXm2Myjo8BpH6m1H7Zylp5\/d0BQp9Wte6obZmfHWktFjlzfq6TYgwZJk\/CF1BlhWQrifnoz8Zv8"}
00940{"flow_id":34,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":581,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":568897,"pkt_caplen":443,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":443,"pkt_l4_len":409,"pkt":"8IQvSpdgeJKcD6iOCABFAAGt6YFAAEAGKkrAqAFny82XotNVAbue7PqA4AL\/34AYARUKlwAAAQEICgAxHhpFraKYFwMDAXQAAAAAAAAAAsI9TWOIX2BRYcRXm\/J9v5tqId6D\/iZcVZSk+9ZDezUa5bfbqTzd7spwcX0h1eOniofVNJxV2+C5RoWCK6bqgKrH9LTzkNfzg+uv+TEfrj1C1WG9g76DG2r2qZxHoKVjG2QSRXnxAlBQIJf259hFpPEpa3VYIzL5qR5aG+nK6UbbuOcXaOVbtmoR7Jw6VLvjFGJe2eZ28wLZrqfpDvByTtLcDArZ+XaN4VBJFPAL2hU2ViDwXszTKR7pi9AtmUmom2SR2bHJ9VwA8SXCM1lopu2ZAoLzxtutpFtPe0BrUtpMek6Hnp1mZb6keCLv5IvaAZ\/\/+NikzG+Y8WWZm1S5\/EodvCgrHTh7+EqZtyVFBQVM8JD0mQYY7LzzuIp1fU76+lgx0TKQ2fduOYYt22ax+eztDlVwUZ0pEKadfwQUR+YAQlMnmNv7u9\/aIKf+527l\/7ScgAC5kfQMnblr7yttgnU1w2JC8eszXmSSvz8="}
00499{"flow_id":36,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":596,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":834688,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn\/GFAACwGLBDLzZeiwKgBZwG701d\/O2r75\/QtKYAYAHhjewAAAQEICkWtouUAMR4KFAMDAAEBFgMDACipqlamxow5+yVenQFNK6XxJgF7A3RPtrL\/BnQoxqXPqDLnmSaLQe+O"}
01905{"flow_id":36,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":597,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":835258,"pkt_caplen":1154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1154,"pkt_l4_len":1120,"pkt":"8IQvSpdgeJKcD6iOCABFAAR0NulAAEAG2hvAqAFny82XotNXAbvn9C0pfztrLoAYASiK7AAAAQEICgAxHlxFraLlFwMDBDsAAAAAAAAAARSUjHdUSQM5xuBUOD+IEAJUhanYifnvnLCOVJ8dO6oSX6v3frKg9tx4gSdp2ihZkQ6fKP9kyzGU7URnpYK5cAhNGyk4Ti\/QCCrzxefKRgIjjjgOjPuNu8\/h61\/XZw8iSYv5l3xS5qrHkDa1HQexqtmAC86FQV1cY+vcWu3ObVsepWx4wz7hf8Ll5ncKnKeKM\/VENGkdq7vgeW6J2DjJYDf33hL6hmX85YV32qk8fp0y9U8jH8\/bt5GRA4FEuNMEWjzzk035Dz7MBUo7Sglu5Q0EyFVzURMt1+74uVsPMtKwCK0+XOxTpCbBjX6R\/YGHMfBrED+7Cp1olqrX2UsYLMBWl61RO01c\/cXZ0Bd4iX2vM4+CVm9G3VYhlCGhnljDSE5F\/tB2paKpvYn6qFjnjmJohgbwmM1Oq5iJl5wPMbxe6mvFqN2+i3UitRxhPT7dsJaawQ+B1a3Ny\/frGsYVg1H8xBlyCnfsGuRoj0V6LdNb4Bej+ZZv4+YbiCbDbRNmiBnyax\/mODL+FoMwio+NWNjiFsgo02p7YYAb1rel0CaLvjNKd1vb+Feo7r3P+zlrRM1xd+I070jw+JlGKekjqEWUypgTwElVNFs3A9gsiJX\/NB11IRTA2sex7Eb55jSfCJNpd542MQSnyWeBrxrevpqEPhlwjCjjVRpm4cnkKwciZDFQImQhpypGyOGdM52ktMGFNcCJBiyl3hCmy9xBIw3UYctg4HT5hJVNn0zaLq9HRZ51hqIWp0FR4CqZZVMNSStHZQ0pLBNMYoxKj8OeraLoQijpReO4MIisKqsvrw1iX6aZN3\/Sogf9Pu+6I0g++n9AZUzCI\/mtij1HRWf03r1bU4rdDK6DIRfzLPjHwwdPvWxOGEzI1TuAeeetrOKLckAXDMlX7YAokwLaDkvImEyr6i\/u\/PsUY+Gz40WNC8WiE+McJ4rGmg32llln80D9IBXtC7JLU6kZCRKpZynPJA5pnpWw6uJfanzrjBNHgLo1q1IIiPESB0GDWUTqVWM2DWCHUNJFY0yt5QPDnoOKHO6XV4KdGSvI1m+gh5un9dOYc69InLjtZN70rBI+Vs7OGtwobcYNP\/tO4feeqKiqlBa3TGH\/aMnlPTeduJDrVgxeZlnMle2DuKn+alLnbgfH9eVlGWzflU8eTRGgt4lVJ+dIaORhBPyWLTrHWX85SRKM1F4ktTewlFghcBgmo3XeJZ+LJg3tvMgskskHW0MERj8h++f2jpNboRI7epk+e\/UrXflT1H0TXjVcI31q1gnn6G2o8kx1liBgxyHtwzWPLrAb2VU4PUO9MrOFqAWkCoTixKZfPf82Cqq3km0wtCFNoJyYfLJNsCp\/BdWh27NK43nM\/sNNBbnwEMOYwoKqjjCjU1CA8h4EdbOR3n\/\/NLqjJRwZSKPDJ83TVud7v8Njygx5Yxw="}
02369{"flow_id":35,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":598,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":842148,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXITYtAACwG1YXLzZeiwKgBZwG701bGHFZ+HTtxzoAQAImjKAAAAQEICkXSCEwAMR4IFwMDLSLdvGeXbmOROG5Gk9\/CF5MaPGA6ixWm6kVy8v\/7R4SJbU6PzLo+F49GQHdUF+Jg+Qb\/2Vh\/TK1l4USoyONcLcHCqhKf7VGNZ52kXfwD5k9HuPwWhT7HroCRPND3yXwaD1jA7jr8boPJzKSLVRvGE0059PKzXNOUWSxt7e+A+XcHbTtG1T7AHR9\/uWzxPSnHOU\/DnyKKrReZFpn9kOZ15Dk3hWtX3poRa6RJtCTmV9KKqC4saHjilv6u+ifaVhsYKPNp5djowcejg2x8PY5+e00Go3bD5d87VRueGCWSutqGSQ1xyvNESB2rjtWRH44XemiPT9MEi9QDdyXkmXFmROFGIGu5bQyUswR\/GgR40RmJsRn7VtiZ0yuJjvsoMUR\/Owp8Pc3WbhLfiXMorrbubAesQS7yo\/BsTZwRQkoXBhYntTTRKekTmfOo+A+YpfHtEelCaJUgoG69vL1C2Ktwy2jd9X7WOSOzkW+EKzv0LcYCwNYYp7Cia3zX0sFSiEeTDgf\/mrTrbuJCn+BZBnOec5f4amZYZJ1Usk1py1fPjzhjVVLlMdbPA5UzPvUB7OQDBIZ4OHAWGDo\/qegkSs0NAXOOTs6bVWpNLVRw\/5q4XQsJgvlpa3UhNBZXNz5U7M42nxGBncRsBZjzgZ7QXJK7TmC1pD5qaIp3dXs\/\/DOsXjkLTOP3P\/8R\/JcHw5D8YrCulFithgRdHzKJp4mDV25BeA2VsJnqegQgq0R3f4EVT0y6bOUjD6rxhssgI4LF\/kPYQVPS+mIoaUd1JnDvP\/+mxC+t3n3c1UUdAza4CLK4LC\/Zd\/f7RDmkuyj70TrQnaLlfIHEuNnz93XlVvxG0MKS0ZjZww4plwIGEXKTI7KoUE4LvgMAjn8Io4ZUfVijggoGL5RM\/dCjQYsUEtiM7MpZltgHnHKTPoBmC4xlttZ978qqmtFSdEbP8rbuJ5y1m8esX954D4F24\/xOrvbFFMA3CbacQDmemFowz9NogNBZ5pY8yDXGZZfTNdvskkV+e6v5+XO4CdZKEcPQFa6VKo\/kCiuIZxr5\/XuR4hMXK8KJ9jEx1aCZBxEr20z9JgVvScJp4fGINFRTIUqZ4bT4ZMiiwYbDe5LD4\/v9QK+Fe5LqXXu3XRfttxiSIiGkbgUma+x9kA3DN3N5HaWhSx0X1Zut9E\/ry3KvG7iCuMVt8UxobEKhzFQrtAUsqz4w4LplFVqnInufEDBkOESFvWVWVWfcmkpcoPmJ5UaW4Tw3vA9pnetA\/wEif8uW2HFSEF\/CN3ib7s64YNiiG9dZhILYT9JqxZlj2JnxSQWffghZSYRQkJXfr4HvAFvj7PCI2LytTAXs8CnH6f9mqft38g0ean\/uES0HNURtnjAEXuNB\/Pvb7T1FhUJIDMXv5J9\/VT39X62y+cOThS8YNRv+5oYHTeO7Ax6a6956GDYq+SfgVdLzWvu30HYqhdC8UCld6G5PT3OTZIlJSZ3fpB4DOEzSdAYD10tgEyZCJF5xzgj5QTREikBq3UAdvR3IMWt+TSoDfYXGLdvc9QxjYvRL5eN6gdd4kEQkEnpAT7RgmVrTsTcyVa9brDzk14upBmBvzZ7fSxFfZqeW0rLe25oKNez2vzTYzkBadbgl2+QR5GD\/oTqKAqrEKVO3VlDXClVr9pj3AntbsH05+8d0pL04opCYp3mzmIebTtIPmHpjUXRk+uq9A7R7JVZoJdVFI5rR1yIJYuzfWK11cwabBBrN+rjf9ckd9JCzH7EZhHj8UZI8eRMkAOoapG5woivb9BaYcp4xO1MCPUW354Sc\/xOiO3QOvqUcFasuf88+R7OULcZTV+GV7HVhQXR0eRYVICAmq9Uz6uwCH6dJMuklymckpLWxAaDWW+FF\/zIjwcL65ruFd83tZDou"}
02357{"flow_id":35,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":599,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":842949,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXITYxAACwG1YTLzZeiwKgBZwG701bGHFwSHTtxzoAQAIn5\/wAAAQEICkXSCEwAMR4ICGha7x9NfokK1Sd0AH0QWVxsnH8QJgnV572rWL5bzcS2kdVMSoD8va9IVzznKd78g1FKHjDmPqhkMy9ocXL\/2C+stpyocpYFGs8dYBLyk73QRWVVrqscjvZzMQNuIar8XKHhjKBTjRsNucXNKePy4jw2yS2amZYdvENW6Nv4G+PzWZB4I9lcPgTHaafw3kahcZdKqvN9rEOUZXxk5\/sJTVeqKGdl6yMcEuUQgUTrt0+QIl1bltbY+8m5fEp4S06uUIZB8jURDJYff4Gm7vpW4zvWmh9ZZsZAFrpOGbzBIXP0USTM\/HArDSWxNSYbAjcLu+auSCjId54OOG9VjUK9z4VveaspG+xN2vduGcNFZTkB6s95BtfLQvnOSmGFRfQ3t5SiHf3alISharQBp6bpzVVaaszE\/QG0t6PdDgTTx5B\/LsRxWdhjX02NF1C1mspodzLgWlZWETkt4D8qRasEIusYAz\/d5ktFvbMc93Fw6auK4L7QzqPUZESCboOoJRT1ez+2Qi5KMfdlD5Ur9y52YrPj7iHP3jXipLFcq+Dnz51n7Tuc+H2H5TXX8zfp2FLcpI+EThaYL4XP2q1SUg8317d5ViBcAcBBoPY3Uu1arQT5H\/DvCvQ5RR2Phfd5lwtIBXfmgJQx16x06w3lmElZONgxfAaZyWDFtCb39lq9I83+hdk8DIyxDRGIjrXwiBwl2rzNWLHRU57E+L3QoCtzxmE2aqGtFjND6NqgiNO5o0KmNecgft9eaoxp1H2XjVXZTR+kesAJmLtM\/HinWskFDIYtYgdtP3i9DtVXWYfebbrjA4smiODI97eBebWZ8CLIiTD3+wSvxCaIaxYufTzUlfXcM6LbLgdGMNATtYuA5\/v6DyF1hTTxaZonUGB37Ai6oiH4uKTAZ7yb6ukC0cOEGnQUvDix26ISCkdT9siWJv2y13gpAWQEedWF3u6jsMd2Ul4NIBTzuph48dxkDiHhuoI0+GzaD3dVfq4MSqrRBbYKIfD7pihQP++k3CQCiPkBviQr1l+sIKvxPOaF8PogjjzmKqvawD7p2n0XQvtCaZp+HpH\/3FJCPTdWDu0PSnAJ02q8BTBMfMDPdpflqNotNmqudEYlztCY9LeMtlzmjmj6COhSha1AP4apv8vQEwBloSPeV9MzNHQ+9tg81\/e6h+Mocna3U6Ycz4ssn5pSnVU4gqnX1ljJ9JHsMj\/s34hbdgkMvJq5nrbaYXHQbMbhkYaebBVidEAqua8W9esg2\/2SgAsmdGYeNzbKWW7EDs5hV\/Pr2NLgeb\/adY6uIgjPTvpH1yIqnZTVNJq0GXd27EVh0Q226DLqrWde9xfpoxGcxasXncX6gb3bow6DJe8gV6GO9A0h27Lz7\/ulBbIWw2RgKrrNhOjI1561FUkgekwxNGLoCnaJgPYwgKV3mQgoFV+BlRtQbGz8Z+mQ1sM\/1QwzDGoYDqjTFo38VLyWzhREaRVs89SOAfYFwG1pVzuadA8Z2p3DDC3iZK0pD5mlS5TFT8LWrcU5fgWUu1tHUy1+PiWRHDljc7SXd\/hSvpi9NA\/\/wUI0iM5CrHkUPtAiHjyuG0Bgz1PfWeB11zT6oRx1uJ7qBxxg5cz3agOhmQbXM9XlBw79qyN8AeNP++YKBeoDlBtVBelzIKblAj3JYysOTN7pp0jePMjr+FLm1dyACVm3Q2eMvEKb2O7CyguVrBMsAz4v2hrBVUPCf73LwVB8rV3h5eeRPFiJCwMCgCBxeH6+pm7IJWAOm9gTYCCXthngW9L69mrvA0kjm4yGcu31mPk0MAZJ7BNR3i8Qxr+3hlhx27LOuyBYKqMbqAryAnCY4PymHAZ7cncPkYLvs0fuwKVvnUnYQibAYAbxd3UG4WQUQFnoEWPoXiK4HEVHA9LinN\/1"}
00425{"flow_id":35,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":600,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":842980,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cSxAAEAGpBjAqAFny82XotNWAbsdO3HOxhxhpoAQAUJXcAAAAQEICgAxHl5F0ghM"}
02365{"flow_id":35,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":601,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":843496,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXITY1AACwG1YPLzZeiwKgBZwG701bGHGGmHTtxzoAQAImU5QAAAQEICkXSCEwAMR4IBxwWeCBtSANs1fCUZB7KofnXXOYi\/cd8z68khSuX0FgKmcVnzGHDvk2Y9bQkpE\/6SXMeCQhxjRsfqC6SUgn5fcL5NLVJTmBCF8XB8Vf64ChjYfOVs6sGbs3Fsn6dEFAJwrtw94rlk0wem79vvfc8D4s0pEbvmIxai8AT\/76ZVi7uextSFF7EizVa\/sCOfb3wiuvk\/wEAtKX+KTEkphVObh1s9OkrS4YXUaPPqpSyPpGwm9PmXwtkZWSsfKZ5CmK46YfY13\/oR4zN2m7cr8cfUzeH4OKBVV53MmC7ZZaiMGRxJU\/R46Q6X3xaWEAN6fCsQfYTMh7FnB2sc9y228GnjwfQTlPUUNIDhTaHSkFCyJEMYpwKsQwSA98TP9gHUmoOi7l9HaC1w8Pk\/22g4zVwWXIJEqchlZZsFamyW7LfU0\/f93PiteOzBIcMN0N8L5DxiO+FDX70UTKOAZV+NXjbVq3p4SHf7tCVWNFWBfCh7iBPWKwFUUWubmjbq2EzMxyTKLWwT1xISXCovoCtzUAj8M015hCdjt5C4TsLeUbFhbhGgIKms7jgKzpV2SXC\/9HuFbCXlzThZ9ZdPN6rgkcUbmNFknlVawcY9ipjqct211hH600EiTV+8y0kZ6YTHlh0XhLvc61h34\/P1lbs1WLNEDfTuQJNJMvghV9pqPkVCguQWfsRtPRP2ynPKQYYTO7A8Tf9puXs2CuK5AxVpIweTjH0a6O0j5lQTLDkbbyXrpLdsVKrcDiFyz2dnsS2b\/X8equtR9bVefW9fEYoXuo9eY5zfJTsPVntnrpWB8JwczE7YqgakiWGVbsI0I9Upz90oITT3fFumb9I0TNfpsKmyxucgrmWaUGqTA08MeIkmnh+VYMydNt\/kxqG1dw9GfR+2XYUve78IZo2lD2VMpjzMphrJGoTi\/JpGrONE0rqD7To69Ib8ptMqcsgPP6ovPtog7atxC0eokP90756FVmGV1iuT6S\/+LF6Y6H\/nQsdEFcKRx67NKLwMXipkptuCOe0DlbOS1YykueUJDtLHnAH7oJlOZNu9OnFmx6kEaaTZvcXCwFUonzm4k+gteZbhwFtSk7RSuoOZk7z1FgY5FLuWWlycC0Z2\/iXFC08uop3B4vawksGrZpyJzbdobVsbVsKMlQ9TMEgTc8lD5W\/+iJleDlrYIoT\/M3c7kqGL9kjMRgaDiLXQ35g19ZBIP5Nt\/ekEeo0bZHci\/uRCM0mkU56OltZUzfbeNbkZhiU9jTLpyzBiqGEu37uoOEh4hCkusXu7hG\/okF6WHC7UcF0saIFal4UK34aUgesrr+62fmg8z9fZ1i0p+h9fuqUDZIOUnWI7iFStRoBotP7WzUXkIh31GvrHKFUDyFWKuiFzZu8BV2Ph6vmqUpkhV4heK2wRZYa6LNgSZdfVaz9x4ikhJ\/kBlRxJxU9O0NYu84jeR+hN55hcBUULamdFsXt6w2HyyBSHaVzubDCb9dIvnaW3Py1sxao04IE8UD4sGKTS5+S25UgCEB\/iFKylVE1aHoouyPeZJUYPiChcAaKqV6V3m1mokgpub93F1XmID3KtOAJcj6+9nf7qKZRxDJJ2W3ELyE4Yo8ay\/n71rEFGSTuPpn9VozlSlY\/chk83umXgs4twvBVecfADOPZr4nUgNtJM6TGXsj5JJM3A52g5FPtKCV8T56uetNYSfPBBe6OmC7RQqrQ6GBvtCLMJa90vTYV45hdXvrobCi\/iqu5GT\/VYujrduFkG1dCNHKqGfrTw+N81zHgopiOmN6peIImW06Mdhyz8Uim3wc3b7LMUZML0GgFvD7iD4kf6dtaQj\/ChLXxCqQViR\/M0krWHJnHTnDlRncJfTE+G3ZzgXN17pmVpEimzVfZWQSL7pVhF6ntdO9Bum8xEtRM"}
02364{"flow_id":35,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":602,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":845435,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXITY5AACwG1YLLzZeiwKgBZwG701bGHGc6HTtxzoAQAIm39QAAAQEICkXSCEwAMR4IlraYSM62vg\/RlVO0c4uzg2DFpxWCxrsX+l8c8B\/\/q3FE37d4FXV2TzH3lYu2GKef+bB4H9GpMnxNaHIi5oJUalDqJbuUhLcGFrPux0bLrrpyuyJOs68kCE+cd8ldIXmYEdg8+VlkmSIBWGuzoTec59ku4UJrVtFVjAlc5ibFL316dPCzAdvFcxmLY9w8v072\/0wPAUuSL1RICi8AIw7IE5S6iHSiZWoJ5kS65R8TvxcWVmQNj0DOXoO3EPQoD\/B0v90ATMOVG+tCRouYx+eXKpQDrjOst+nXStqP2KwVGNzhxifCUeglm+91L9jIs2r1YJAqiqGHfe8HuF8BF6wyGP+lIbhSrCGFZJmOgBRqNriT16GB0PbWh1tM82IIe2MqTiwmWAd1RYTSgRzfgepU2BZ0AUfu80WRLV+hDyRHNUKrgJApKXVz\/O0jp+OuzArtJxJpd9H2C100qvtQfmfQeGkl8SH4\/lXcUz9pry6AKfYMxMpOjWtvSuhrisE7bwZlnmLdWohfHLkasGDaHS0P1OBqOYwnhko0T7MnxL7pzEyEYdeLM8+GYijXQVCj1rxnIMiR+ShxDkN9joEp5InNGwDUaTFLCi4Q5\/5zhc+0guc1NPPxssuxpFR5laJY0klzX+VH\/R6sggiK1KpsFhixWDpJREkZI8q4BumUvSaGGipAyUgFxQZtuRy4+rhIU4\/zF7ZSDmLdlSddydSTjHoAn4hd2usP1foTXCs3LGTw+zYmfHlL08X\/wQQgovCDu61RDGbaW04Yoiov0KEI8hER6YMTYVZBHeedQx43C6AA2uiWyw5V2aozgr+XEgx+Hf6Lyk0yjkgR2SEKe2jJdPwpdwJcBH5yBvVUPYcbP5L18CZkBO5vXtqXE97txA1Mna10q98bao\/Fof7vyAqyf1uKwphqYRLWd\/lY16oZlfz4PeDmVjW7W7KsaSMQtp2FPcfDY6YgCf++5OrblPNDCuiKKe817F64gbQ9akpurFiPLWnlbcd3yy0a3jfWxQ6ngFawsXjiffC7gDaKd6XuZEPLQ5HHNkCddLCE0MoITjT1hYCtmV7EbGcGIk6GOGe5n6bQ84S0DQn5kBDsjBs4yjDfNJaKerDR3AS3sHEEsfOIcf0wbBe+1mxicrO+81+6D7NT7G\/RbZpDtX+hrYPM9OUF1AixQNDwkByDzFcrS2UcvexxoNN+r1MZ1xbvNew28WifRrGZYfav4o8up3O+fhXrmfyKfMp+DyQd4T9b1oVJwK0e5DDpCJWj0+jKaNPQRY0\/ItYLjfxbeqmNOQyd7pV7R6XFuSIdeWC\/Ew3FaQVu6AXnSx4lMG0xPpggkdxkmzdjt\/EOGv9YPTcj\/RyqGmxDFbtDyTzUvKFd1jREeq3DQ\/R\/nAgbJPVExKk6xDdqnR3ViyRiD9u0HG0xchWr4HwrJ3aOG8zahOgyjDbyyHVdzMEzZB7D0aOPIvw9PSbQ+jBbIcv7a+869rpX0w3CsLuxvFWM0KxBYFcKoReRx9jUgIyLHyq4BwaBtdQiOJgVQroQ1\/IIbPX\/c\/YXAAbBlSNhXi2Ta87MRTfMjfpfgWe61M3XYVCt73FgtetOob5Vxh4VUGYv5cHtOUtvkfXzg\/aq2tYq2eWHxRLhjNGoqqCFv\/fCR\/9QqrbSbcUqXV4FoZFxfaA1MkaDBSQaLsncXSTVipwrDG5GV\/JiSEy78vVbHNU5Na1SzqOdTvn+hQ7ac6wHSlrGjo8OiyTiYGHvqERZcSXLJwC+jNPIDtCXIWsTgkqGK5HMBbYcZA+pxcVuQEfMf3lbKEpefAiaafwpEVYjLJw6fWHR0oGMM1FzQ3iHWLmSpOO06Kv2rZ1aJgigUnMCDQht8a2ur7TL1NFaJnb6VN\/P6xIzCeMMkPVpcCkpq3K6Mdb\/"}
00436{"flow_id":37,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":613,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":891345,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG701iyhnqT53mM+KASN8htQwAAAgQFoAQCCApFraLqADEeEAEDAwc="}
00424{"flow_id":37,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":614,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":891380,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0kuhAAEAGglzAqAFny82XotNYAbvneYz4soZ6lIAQAOXShAAAAQEICgAxHmpFraLq"}
00748{"flow_id":37,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":615,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":891558,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEikulAAEAGgW3AqAFny82XotNYAbvneYz4soZ6lIAYAOW1DgAAAQEICgAxHmpFraLqFgMBAOkBAADlAwP9NQ6LikCBiVimjppT8i2VlLy8HZBkMhwiS9FNacyQcSDLK5nEKozFFehKxLSZMCTAPUR52rwta8Dt2NpTSUG7QAAg+vrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8CgoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIOjoAHQAXABiKigABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":615,"source":"wechat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":4,"flow_first_seen":1492167455528,"flow_last_seen":1492167455891,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54104,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00426{"flow_id":34,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":617,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":929354,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0UcBAAC4G1OTLzZeiwKgBZwG701XgAv\/fnuz7+YAQAJ352gAAAQEICkWtovQAMR4Z"}
00700{"flow_id":34,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167455,"pkt_ts_usec":960498,"pkt_caplen":264,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":264,"pkt_l4_len":230,"pkt":"eJKcD6iO8IQvSpdgCABFoAD6UcFAAC4G1B3LzZeiwKgBZwG701XgAv\/fnuz7+YAYAJ1nsAAAAQEICkWtovwAMR4ZFwMDAMEzgIElE4pLfJQd348ZqSNDqad9eLAkFSn\/Qn\/aCUPmc91v4Nbf17CDphJt9xgDEWm4yV5Bd+d6hmXjgjwBMGg4KC5twbaB5ps5qAZvll8pxQG6IYBX\/XIVfQupfuS+\/xHdb+td97LCtH4IaLiyhWXnejZkJEW3wGse+Xrmf0gIjfCyD8gkUvjSd\/jG65fM1UgysG+\/Z7LwebuukPlzP8RlzXnkDRv\/YlDrAmi4dNtSRztaplua3ioOqlULZgQWuN7q"}
02360{"flow_id":36,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":635,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":174239,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI\/GJAACwGJq7LzZeiwKgBZwG701d\/O2su5\/QxaYAQAImGXQAAAQEICkWtozoAMR5cFwMDLW+pqlamxow5\/KVqaz8H9kh+D7lmanUu0PfOVhPSQv1L5HmytrqsqtERUlRR4C8NL3NbBqMtzn3q8Z2skLt564odY262\/p2WQdJ2o2s4R5sZJfRsKhyrWsQVFm4eAEYbZyGearsoXux6xLzBshWk1Zcle2o3dcIHCHWNIj8QYAJ2kinFO9VlUgzUiIjPj9l\/vyRLripa9XApjUSXtHU7trVZE6gNGeEqQ6vB05matU4IJXb9Jn6bwPC1CQq\/Dx09TBEdMnFewkbxevdsi79k+GnxtX1YQumNm40QUaHVBUkehN26mRHj01NbzWLozjbyT41wX05nbchtv1v+Dv9i11kdBm+LDGVmEbzRvXlLeSWgPO1V3iWcGWbgbNSL2\/PLbsW0EVKh3mxqktZZOhMYI9m4+\/rlG2GKfrH4nYENGcOZgLDVpdPoPX7X8T2Pp7Beikv2Fooneks88wQvKVtUQVvwkODqIuJV8SkNMeMU5bQUnTC9JX+tcc9MbN973c9oL9I21K\/VcvMqfA3OrBWY46EtiN\/jTwiGItXnoO6hmzTDzKXoQGopjS3jVH93AfzrnJm6zg65+6VvSWJiUgEOi+1Swj1abnCXN3iG9gmAbLPVkB56lg5A3XK8zDIRZwPCY\/5WtYy4xMwhrQ6NZ+6dvnbYp1\/1ruROlO4SXZQTwkR6yy\/IvoTraVU\/Fsh228XByuwZc+lHSOkr9zOgwelvSbGrZg3BlUuaE9sJNxr\/O7fSB1r9ch76c9OPejogztHzmIJmZ44ZkLTARGn9PN1Si+zrK3LE5l8IP5s69CGLv81HYdXXWwrFUIr6v3fkgLWFnsbKye959Q1kdbEnV3vZ7Y7PUHPegerW0VwlRbIfwf31BM6cvlaC54jKnJRlLl4RfJDF+Me7nK8deeryq6YfbHeDwpz+S\/vwHz6Zw0r1jtLGQran4jGICbi6dDtcFBodp4788Vjs2u8fZiS3c4aATqhgOFYtIP+0x5IwYR6LcSpWsanAoEeQZKgrUIi\/zsQTRMHLpt\/Be9PV92VKGtSiy7tXrc9PP9M2byeH3MI7LQqdjlf\/PS1t2KfaJg5Wgcgpf8LKojTyqWuXdYymr3khRr8YFfrPSPfGxt4J3J8aRBx4DguTH586DUZgidtfdhsGO7XxaDMu+Sj3GZ9\/p+nuFHCtIH43qUYPnTOGHyWTErmug877DXN+iGWjs7eFc5rJtwiH1lEzCYsFHL7KL+H5zGR3taPCP2GExvDi434s9TEY2d74ESZZyR+EckHYsXn2kAuniATLe25tAbZdcLrpZs1GVJndduxhmhHd11aec2NMf0CIwRmjRN9WfC9KTdFI1XlLV0wIbYi1SNeH2p+ffZqD8ZNSq5iq8wnOcYKVrqViJM2UKRSt8\/KaN5sXzHfmqvIVlu5LiPm8DdHLuJp8kKLEPvGHxVkXa16DDtuVmYGN3zCgb\/fIvA++6nLx+tfsuQSqm6q3dDae76rkPRwehw2Af8O2C30XsMBaOqGCYOlWKGDGBps8qerTsU+BjieilKxETnBzJxLGLQOTi1vwiPhy4UvmrYhnaNISMIWY9c8OxC97D7mtwRhO3RUkxq0Vm0Bum2ko\/dsE62XkJ6OQjcUmo56lFntLAg48b8UDwSGR77HGapiEIlQ8OR3wlJjnjHWSWIJk4dV2qA67KKyMcOLTnzLStYYWvBXr+89YEKnsvampoIaKMU855gBl7HAvKy7cV5D6wgwSpIruVuLAl7Sum7XdC1Kmd9BPMUq0iFASPw1ClqnWGwyqw31CHWMMIpNI2mwkusKHd0jsx4rsuAM\/Ksok6imzjUWg0E1C40uuUAGbhgSMRzOqCAkMTAWsfy8DpvLKTGZbFnszOkW134J5jHFFuEFJFiPuVVL8M8lA"}
00424{"flow_id":37,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":647,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":250115,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA02dBAAC0GTdTLzZeiwKgBZwG701iyhnqU53mN5oAQAHjRqQAAAQEICkWto0QAMR5q"}
02344{"flow_id":37,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":648,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":251036,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI2dFAAC0GSD\/LzZeiwKgBZwG701iyhnqU53mN5oAQAHgD6AAAAQEICkWto0UAMR5qFgMDAF0CAABZAwMQyj9bbiaPkZ2Xb3zWKEOFcszlPlUALGGF4F9n4cC9IiDqltGHEEOjKzGx6kNwPHwxPh3WsTKhUSaEhLoaKlfYzcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":648,"source":"wechat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":6,"flow_first_seen":1492167455528,"flow_last_seen":1492167456251,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54104,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":37,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":649,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":251067,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0kupAAEAGglrAqAFny82XotNYAbvneY3msoaAKIAQAPvLNwAAAQEICgAxHsRFraNF"}
02347{"flow_id":37,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":650,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":251627,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI2dJAAC0GSD7LzZeiwKgBZwG701iyhoAo53mN5oAQAHhdywAAAQEICkWto0UAMR5qi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRppmH8i+60HAbfTvc3xrcF3kHQR5qAmyZW25jCWYkU3FVgzVXITZim69Ml6n3ZD\/8CuP\/PuMiAsIMJSiS22QraBgEBADtaHh5m"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":650,"source":"wechat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":8,"flow_first_seen":1492167455528,"flow_last_seen":1492167456251,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54104,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":37,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":651,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":251652,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0kutAAEAGglnAqAFny82XotNYAbvneY3msoaFvIAQARHFjQAAAQEICgAxHsRFraNF"}
00782{"flow_id":37,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":652,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":252601,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE42dNAAC0GTM3LzZeiwKgBZwG701iyhoW853mN5oAYAHhaMAAAAQEICkWto0UAMR5qzoSbMlRqH7JaM3j53Tya0SGHn7w\/kJXJq++JFot5vOIiA37Z+swSemgzUvwnS+Fw2saYEzNJ+4Ye1hhr0v\/ZNIOb5jEv7gXnS4KzYyWPKLzehGWKKv1aw6z9SGGwkYsHOh+V4suW\/uLEOoNs9XfOni2rPI2bq9VakhWOli88tcieGr\/Mf4dZBEfNk53qumJ4AJLNG58v+b9FlXfGphRu0ObBSROzHoSWcZSsfppUZ+1pZeAgq7hS5l9\/5IkexrphWB3y6VwXD\/XvC3Q1lQJWMycXCgMVOSrtvqnzE+WkRt8iIJb2fDRhsWNEEJWXhabDDSZVYq5U0oTWbdoWAwMABA4AAAA="}
00425{"flow_id":37,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":653,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":252626,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0kuxAAEAGgljAqAFny82XotNYAbvneY3msoaGwIAQASjEcQAAAQEICgAxHsVFraNF"}
00598{"flow_id":37,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":654,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":253751,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyku1AAEAGgdnAqAFny82XotNYAbvneY3msoaGwIAYASj2agAAAQEICgAxHsVFraNFFgMDAEYQAABCQQTMl+90f3n6IbQvcRcRI7HcLWGaHVCUB1s1OrvQxpnYMZ6jBC2wJJD7ZFLjBOTh6MSd740CZ0EmgP9EhT+VUq2UFAMDAAEBFgMDACgAAAAAAAAAAKzhbQGk8H\/1IAZFZZB9r63fYh2rPpelt\/UlfhZKCVuK"}
00495{"flow_id":37,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":663,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":609151,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn2dRAAC0GTZ3LzZeiwKgBZwG701iyhobA53mOZIAYAHhcTwAAAQEICkWto54AMR7FFAMDAAEBFgMDACi3C2ngHhtHi2MfV2Pcnrxt9lEm5HpWTvknUmhLZpDDS9lgFX9COg3T"}
00425{"flow_id":37,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":664,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167456,"pkt_ts_usec":648209,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ku5AAEAGglbAqAFny82XotNYAbvneY5ksoaG84AQASjDBAAAAQEICgAxHyhFraOe"}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":803,"source":"wechat.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":40,"flow_first_seen":1492167378674,"flow_last_seen":1492167401175,"flow_tot_l4_data_len":17095,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":427,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54094,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":803,"source":"wechat.pcap","alias":"nDPId-test","flow_id":23,"flow_packet_id":39,"flow_first_seen":1492167378926,"flow_last_seen":1492167401170,"flow_tot_l4_data_len":24397,"flow_min_l4_data_len":32,"flow_max_l4_data_len":8257,"flow_avg_l4_data_len":625,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54095,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":803,"source":"wechat.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":17,"flow_first_seen":1492167380581,"flow_last_seen":1492167401124,"flow_tot_l4_data_len":4091,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54096,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00510{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":803,"source":"wechat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":8,"flow_first_seen":1492167382020,"flow_last_seen":1492167402666,"flow_tot_l4_data_len":191,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40740,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":803,"source":"wechat.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":8,"flow_first_seen":1492167382020,"flow_last_seen":1492167402666,"flow_tot_l4_data_len":191,"flow_min_l4_data_len":20,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":23,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.211","src_port":40740,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00425{"flow_id":37,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":812,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167467,"pkt_ts_usec":125789,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ku9AAEAGglXAqAFny82XotNYAbvneY5ksoaG84ARASi4yAAAAQEICgAxKWNFraOe"}
00422{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":831,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167468,"pkt_ts_usec":8215,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0KNFAAEAGqhrAqAFn2DrNjsJ7AbvMOVSD1yvysIAQAT22vQAAAQEICgAxKkAyc0s1"}
00424{"flow_id":21,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":832,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167468,"pkt_ts_usec":48114,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA05nsAADQGN9DYOs2OwKgBZwG7wnvXK\/KwzDlUhIAQAVS2uAAAAQEICjJz+zYAMHos"}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":44,"flow_first_seen":1492167400812,"flow_last_seen":1492167448100,"flow_tot_l4_data_len":18499,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54097,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":38,"flow_first_seen":1492167401063,"flow_last_seen":1492167448091,"flow_tot_l4_data_len":13790,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":362,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54098,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":54,"flow_first_seen":1492167452759,"flow_last_seen":1492167467498,"flow_tot_l4_data_len":34617,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":641,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54099,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":27,"flow_first_seen":1492167453010,"flow_last_seen":1492167467495,"flow_tot_l4_data_len":9614,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1764,"flow_avg_l4_data_len":356,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":86,"flow_first_seen":1492167454457,"flow_last_seen":1492167470188,"flow_tot_l4_data_len":63075,"flow_min_l4_data_len":32,"flow_max_l4_data_len":4316,"flow_avg_l4_data_len":733,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54101,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":28,"flow_first_seen":1492167454458,"flow_last_seen":1492167467494,"flow_tot_l4_data_len":17089,"flow_min_l4_data_len":32,"flow_max_l4_data_len":3148,"flow_avg_l4_data_len":610,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":96,"flow_first_seen":1492167454818,"flow_last_seen":1492167477932,"flow_tot_l4_data_len":60378,"flow_min_l4_data_len":32,"flow_max_l4_data_len":4025,"flow_avg_l4_data_len":628,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54103,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":17,"flow_first_seen":1492167455528,"flow_last_seen":1492167467498,"flow_tot_l4_data_len":4091,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":240,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54104,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1492167617247,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54109,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00425{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":840,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":247730,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA044hAAEAGMbzAqAFny82XotNdAbtNZ116WRhNMIARAViFkQAAAQEICgAxu\/1F0qIP"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":841,"source":"wechat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1492167617247,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54110,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00425{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":841,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":247977,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0trJAAEAGXpLAqAFny82XotNeAbstqSV4qlMZrIARASwk9gAAAQEICgAxu\/1Frj0D"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":842,"source":"wechat.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1492167617248,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54111,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":842,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":248213,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8JpFAAEAG7qvAqAFny82XotNfAbt51Z1vAAAAAKACchAH4QAAAgQFtAQCCAoAMbv+AAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":843,"source":"wechat.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1492167617498,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54112,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":843,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":498933,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA82VRAAEAGO+jAqAFny82XotNgAbuDb2VoAAAAAKACchA2DwAAAgQFtAQCCAoAMbw8AAAAAAEDAwc="}
00438{"flow_id":40,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":844,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":560653,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG701\/B3aGGedWdcKASN8hYRQAAAgQFoAQCCApFrkDUADG7\/gEDAwc="}
00424{"flow_id":40,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":845,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":560732,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JpJAAEAG7rLAqAFny82XotNfAbt51Z1wwd2hh4AQAOW9kgAAAQEICgAxvExFrkDU"}
00750{"flow_id":40,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":561213,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiJpNAAEAG7cPAqAFny82XotNfAbt51Z1wwd2hh4AYAOWw1gAAAQEICgAxvExFrkDUFgMBAOkBAADlAwOiNE1rRkT0h3QOeP2KdM3vXFnz\/PaRz1MgqYNk+PneFSA+FXDDfXOJsJmV4DXnwkF2Bf3XeOpXHU2Ui84OelC\/LQAgqqrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8SkoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIOjoAHQAXABhqagABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":846,"source":"wechat.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":4,"flow_first_seen":1492167617248,"flow_last_seen":1492167617561,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00424{"flow_id":39,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":562993,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0KCxAACwGAHnLzZeiwKgBZwG7016qUxmsLakleYAQAJ8hsQAAAQEICkWuQNUAMbv9"}
00424{"flow_id":38,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":848,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":598882,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0701AAC0GOFfLzZeiwKgBZwG7011ZGE0wTWdde4AQAOqB1AAAAQEICkXSpjoAMbv9"}
00436{"flow_id":41,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":850648,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702Andsj9g29laaASN8iTkQAAAgQFoAQCCApF0qaCADG8PAEDAwc="}
00426{"flow_id":41,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":850,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":850743,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA02VVAAEAGO+\/AqAFny82XotNgAbuDb2VpJ3bI\/oAQAOX41AAAAQEICgAxvJRF0qaC"}
00425{"flow_id":40,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":851,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":880360,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA04KNAACwGSAHLzZeiwKgBZwG701\/B3aGHedWeXoAQAHi8wQAAAQEICkWuQSQAMbxM"}
02346{"flow_id":40,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":852,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":881041,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI4KRAACwGQmzLzZeiwKgBZwG701\/B3aGHedWeXoAQAHjxgQAAAQEICkWuQSUAMbxMFgMDAF0CAABZAwNR3Yv58EXkARruI6MbXBUr2l9SVzFl0EZ4wibgNUpCviDg0to5\/h\/p7gAXT1kViG+D6U7ulXWnLBXIcoeBXEekv8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":852,"source":"wechat.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":6,"flow_first_seen":1492167617248,"flow_last_seen":1492167617881,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":40,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":853,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":881093,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JpRAAEAG7rDAqAFny82XotNfAbt51Z5ewd2nG4AQAPu2WQAAAQEICgAxvJxFrkEl"}
02347{"flow_id":40,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":854,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":883554,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI4KVAACwGQmvLzZeiwKgBZwG701\/B3acbedWeXoAQAHiHUwAAAQEICkWuQSUAMbxMi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRvmOK+fTnqOModyMUfEJPqNuPEK0K9F8VanEMXLo3emZnyyByi4h3TzEoJ3NZkWfVMDbYyLdAZFt6um2TnU2csBgEBACjRh\/zk"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":854,"source":"wechat.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":8,"flow_first_seen":1492167617248,"flow_last_seen":1492167617883,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":40,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":855,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":883571,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JpVAAEAG7q\/AqAFny82XotNfAbt51Z5ewd2sr4AQARGwrwAAAQEICgAxvJxFrkEl"}
00789{"flow_id":40,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":856,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":887240,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE44KZAACwGRvrLzZeiwKgBZwG701\/B3ayvedWeXoAYAHgafgAAAQEICkWuQSUAMbxM\/b5DNs64DIF5q7fKZyFICi9kQ\/lct9MI5GWa\/cqfyCs1GKceNnk6Y9GUvH+fsTdws9yPHuZm9fVmEyOZfvxY3PYax2LhoTy4jqGwwoONIIaUV0SEi2BY+zl9efMqYaJb\/SVywLPKEpu9E7WYPUulJS\/ghB2hjRHGdlg\/mPz7ya\/TKuviTZ\/XTu6Pj0pXNeXSk7o3HIzV0B+ECun3x707qYY1dyWOBgntihvasSdGXPEKHh89ZqUtQ4u8a3BaAUKyZ0vOCUo1w8sVLzKygft211f4ugtpGo7SyPHyY+w\/tHk64Zd3c6GhtFij\/npk7b\/UhVdDrPfRxDj\/aloWAwMABA4AAAA="}
00425{"flow_id":40,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":857,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":887251,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JpZAAEAG7q7AqAFny82XotNfAbt51Z5ewd2ts4AQASivkwAAAQEICgAxvJ1FrkEl"}
00599{"flow_id":40,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":858,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167617,"pkt_ts_usec":888100,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyJpdAAEAG7i\/AqAFny82XotNfAbt51Z5ewd2ts4AYASjIAgAAAQEICgAxvJ1FrkElFgMDAEYQAABCQQTCb+94+x7+yEsJvT\/TXWoWWgsy22MZrh2xjKuNy\/msvP0PuoCQInKX2+CwiU5qltG21qqcrcKgj1mty3wX0yMgFAMDAAEBFgMDACgAAAAAAAAAANVsgur8uIlrmu9Sb648TJ8cZYStftO6nrKZyuc0vZZB"}
00497{"flow_id":40,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":859,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167618,"pkt_ts_usec":200673,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn4KdAACwGR8rLzZeiwKgBZwG701\/B3a2zedWe3IAYAHiupgAAAQEICkWuQXQAMbydFAMDAAEBFgMDAChO6s\/g2cTvA0dLzXCkMG1q3E+8ytNH4Hcoz2xFFzQ8EaTeAjZA4mKR"}
02012{"flow_id":40,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":860,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167618,"pkt_ts_usec":201819,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATEJphAAEAG6hzAqAFny82XotNfAbt51Z7cwd2t5oAYASj9OwAAAQEICgAxvOxFrkF0FwMDBIsAAAAAAAAAAa2HV0m6YqkqKosBh+sq+h55rxjiQ56Aq3uAujbMKTUnhXCjwZICTC448ualjKI1rhm5T2VYu+JpgvRouRhsUjk18O6iapWIljQIrpxs3ATIPQC0IbhK\/0VEDVaCC6y0r\/WQ7E1+wtrUjKdXqvNCUlFHxSDPdbjQ2kPFBQ2CqMsIy7mSR9dmk92P52iHrU\/kdsFaWeu8sJl0bWz2FT5ctx32gnyrcuYOi4NzJfr8myIRqeNeZN0hA5vX2XACMO2uIRAHa\/5SNGBnPvYMTZ+0oOnFF+biGwLfrIqYp\/b0Kh2mJJ4OaEcPEaOEUeD7kbCxz+vCnG\/KCU3qzaVUDYPM9IGVaYazN80cdl+UdyNvLz9N7cCfY4T9r4zElsr7G0H40+88WMGHWzvVyIkK2L2uA636b5GdJAXQnT9Jeefq6pEH3hWcrbzS1Mf6SgqYJJH1br22ptnn5DrIrv82Qt8x\/s9\/JGMCSqmdwSIq2OPKqPYNOhEucW272pO6qYW9Ci9yr1XiB2sdyQRwWnlkpnw1AtkeVm9OrVhaI8wLbks2YAs+mLB9jirxUwmCKm2bkOz1YTBwf8WknUkHRUfIY8rhPUIdhucExAZVEzkUJaVbTIDPCihfwaj34SzjKdmTBryDsVFWXIaFTPCtTkUqdajcahVxCSI+yDnUAuSOtVWxk0vhAwX6h6iexRX3PMP2OK3xRVJ\/CwMLwSgOekg\/V+lGn4373E+LZx7vjTNxfByiLqWBwOUKJU6X4I8hj8IuierqIi9uNeYsRBj+JQTMYJKZ9qx+o0lVCvIn7SlvUHTD6lj1jG2Y9z9PLvoAkzGdgTZAVoAAosMKDiFkXG5QKbn5VJZK+cYtxtJqYvtp+aShn9xIowNQtF2oGtlDD+AJ5KnhAwNgCJ5j5ugDHQtdIZOWjDJZgeqHPk\/N9CzGFA18+SAxjRaCiV17dIBUPFOnsl\/l\/U1ZIDJ\/c16+gBWzsWfZHUXO6KN5YihYzms0U2HirBweHI68rCq+JMwH1H2qlbc6B7DyPVEmQbPhsCbU5mkcfbuvm6KSJsiNkSuXkHZG0UJ7YTL0wXD9cvXW4h+xm6moOhg+JppU5GPNLimfsMOf2J5y4Tu71YfIpLnQgGjr\/q\/YRvvxKW8wQtR5ivIz9rig\/Z3hzjfypuOZgdRPmPPDnicgEvu4dFJYvMbNdAw\/Tx0t8j3nzRtetecQIHCbiepL\/rnpZ+DIQL1t+gV1\/LFH7xCzCuLoDhrA62z9mphQnWq3rvPDJgX0QTuZ+wkNgZzfE4exmrSGkJJyUUrewhBrpzc7GehddsH4efkIO5JRB3JW6vew6qO3TkGyE7EyFPm3bQHJ7Wvi65ptOEgDOpdjUEoAAMX13WFJs6o2NnCRK1STQ0WCDuD5ckIYxeh2U2O7UJjghl984Mzdg6JV7\/VghR17tHTlP2xMhST+s+Gs0vmXZGn30+PckVstBZZcUwkhDMx5DMydF4mTcC1VbpUNbFJfJJ9A9iE8K0rYWXoJYfKykpnGVG9ZiOSQYyC6H0KrkthKoA=="}
01032{"flow_id":40,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":861,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167618,"pkt_ts_usec":206374,"pkt_caplen":513,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":513,"pkt_l4_len":479,"pkt":"8IQvSpdgeJKcD6iOCABFAAHzJplAAEAG7OzAqAFny82XotNfAbt51aNswd2t5oAYASiMbAAAAQEICgAxvO1FrkF0FwMDAboAAAAAAAAAAt44uUgrR8S6ggxct0rsCFrK0VkP5jjpuDxIZHwGT\/LQ5oM0yKemOo3CJy+sgYabwkMKAQRzt1ziA+vU4hwmO\/h7VhdV302peVeCUzrwNxc3R+BgZwXwWmVB838IjzvBe62dlXiDkeuqa8P9QnsLOGK0ecP0DG47X81\/9p+dp0jpLEOorOEYwMgWg9wo0EU50cqVPyKg0hxw9qaa1dOVra5htlg7g67fvU8Z1ztKaE9LEmYnwxa2+AkX99swBreBcaitKRYQcoil17RFhlaySWGP8GedvbL+VyuZtqW70VHus1vb5wFJZ3avIjjNrL0fKHF+W0wIVVFZJa+\/e+lUh\/\/71rWY4CmTjYrQA8g4IdqMFzC1SocKZICpaGecTLkfp6adgogvH118clIVw9L+YGn0xucbAFmimdNpGNdBZHN4\/GYO6Sxga4RhaTM5YS+oDixeEOL+Yqz9bXszOZGcfDFIGko0qUe9zyJHwJjlStjBDLSZ+oLgyVe7syHmD0Mp83t0I+Oi4vVjYfIl8Q7VSqd7x\/JKFlT3vAUPwoZPlbFpv2tfIc3flxI7VYZnvxq5pben"}
00436{"flow_id":41,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":870,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167618,"pkt_ts_usec":976754,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702Andsj9g29laaASN8iSHwAAAgQFoAQCCApF0qecADG8lAEDAwc="}
00425{"flow_id":41,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":871,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167618,"pkt_ts_usec":976798,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA02VZAAEAGO+7AqAFny82XotNgAbuDb2VpJ3bI\/oAQAOX3ugAAAQEICgAxva5F0qaC"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":874,"source":"wechat.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1492167619048,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00423{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167619,"pkt_ts_usec":48267,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Dr9AAEAGBobAqAFny82XotNaAbub+DW+SvgsEIARAOUtjAAAAQEICgAxvcBFrgFX"}
00424{"flow_id":12,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167622,"pkt_ts_usec":380250,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePdAAEAGFxjAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO3UVQAAAQEICgAxwQGFoOCz"}
00424{"flow_id":12,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":877,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167622,"pkt_ts_usec":434983,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0uEoAACsGLCVA6ae8wKgBZxRsjLFKrVv6utDMqYAQAWUzwAAAAQEICoWhkK8AL7Ej"}
00504{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":878,"source":"wechat.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1492167619048,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00477{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":878,"source":"wechat.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1492167619048,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00424{"flow_id":41,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":880,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167639,"pkt_ts_usec":304044,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0bxNAACwGuZHLzZeiwKgBZwG702Andsj+g29laYARAHDjOwAAAQEICkXSu3UAMb2u"}
00425{"flow_id":41,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":881,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167639,"pkt_ts_usec":304212,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA02VdAAEAGO+3AqAFny82XotNgAbuDb2VpJ3bI\/4AQAOXO7AAAAQEICgAx0YhF0rt1"}
00425{"flow_id":41,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":885,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167639,"pkt_ts_usec":887787,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA02VhAAEAGO+zAqAFny82XotNgAbuDb2VpJ3bI\/4ARAOXOWgAAAQEICgAx0hlF0rt1"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":886,"source":"wechat.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1492167639887,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54113,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":886,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167639,"pkt_ts_usec":887918,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8T5xAAEAGxaDAqAFny82XotNhAbttdZ2FAAAAAKACchD+DQAAAgQFtAQCCAoAMdIZAAAAAAEDAwc="}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":887,"source":"wechat.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1492167640138,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54114,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":887,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":138557,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8VUZAAEAGv\/bAqAFny82XotNiAbsbK4ceAAAAAKACchBmfwAAAgQFtAQCCAoAMdJYAAAAAAEDAwc="}
00436{"flow_id":43,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":889,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":203151,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702Ea0aYHbXWdhqASN8gHqwAAAgQFoAQCCApF8injADHSGQEDAwc="}
00424{"flow_id":43,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":890,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":203226,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0T51AAEAGxafAqAFny82XotNhAbttdZ2GGtGmCIAQAOVs9wAAAQEICgAx0mhF8inj"}
00751{"flow_id":43,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":891,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":203667,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiT55AAEAGxLjAqAFny82XotNhAbttdZ2GGtGmCIAYAOVdJQAAAQEICgAx0mhF8injFgMBAOkBAADlAwNTKUS2Efj261J+LE5stULB\/lzfBlOjyL3qEyuaPjoLLSDg0to5\/h\/p7gAXT1kViG+D6U7ulXWnLBXIcoeBXEekvwAgWlrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8SkoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIKioAHQAXABi6ugABAA=="}
00722{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":891,"source":"wechat.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":4,"flow_first_seen":1492167639887,"flow_last_seen":1492167640203,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54113,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00425{"flow_id":41,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":892,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":214427,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0+B5AACwGMIbLzZeiwKgBZwG702Andsj\/g29laoAQAHDN6wAAAQEICkXSvFkAMdIZ"}
00436{"flow_id":44,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":893,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":450553,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702LyUvm4GyuHH6ASN8hErAAAAgQFoAQCCApF8iogADHSWAEDAwc="}
00425{"flow_id":44,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":894,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":450646,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0VUdAAEAGv\/3AqAFny82XotNiAbsbK4cf8lL5uYAQAOWp+QAAAQEICgAx0qZF8iog"}
00424{"flow_id":43,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":895,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":521509,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0jDpAACwGnGrLzZeiwKgBZwG702Ea0aYIbXWedIAQAHhsJwAAAQEICkXyKjIAMdJo"}
02343{"flow_id":43,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":896,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":523427,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIjDtAACwGltXLzZeiwKgBZwG702Ea0aYIbXWedIAQAHiFDQAAAQEICkXyKjMAMdJoFgMDAF0CAABZAwOpnclgnMJRDF3ZiLpnTC4ta7TfKuCxUQBZwDuf6z48miBYxgzAaMyfJOk08sA4g8dg3UnK03IZIzAXShNAci3a7sAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00779{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":896,"source":"wechat.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":6,"flow_first_seen":1492167639887,"flow_last_seen":1492167640523,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54113,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00424{"flow_id":43,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":897,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":523484,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0T59AAEAGxaXAqAFny82XotNhAbttdZ50GtGrnIAQAPtlvwAAAQEICgAx0rhF8ioz"}
02346{"flow_id":43,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":898,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":523898,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIjDxAACwGltTLzZeiwKgBZwG702Ea0aucbXWedIAQAHjD\/gAAAQEICkXyKjMAMdJoi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQAdCFM+z4Pj3h++LNkD49ZihRhKeOZguGplPPY68JOtUwDnXttZieII13qQKxtqyn32q+R2+1jkY8pOqvVI0bkBgEBAHBcPcRx"}
01312{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":898,"source":"wechat.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":8,"flow_first_seen":1492167639887,"flow_last_seen":1492167640523,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54113,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00424{"flow_id":43,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":899,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":523937,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0T6BAAEAGxaTAqAFny82XotNhAbttdZ50GtGxMIAQARFgFQAAAQEICgAx0rhF8ioz"}
00776{"flow_id":43,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":900,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":525014,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4jD1AACwGm2PLzZeiwKgBZwG702Ea0bEwbXWedIAYAHj7wQAAAQEICkXyKjMAMdJoxFwy3+pR7798L38aICm5PRXbvMTLd8bAytx20qUedNneLZhqqX+fas2jW9BTEa6+Y+g0FbaEsc0CdV0uSOiKWx8PESp808CDboG+hmz3XQR5H+kbrqgFqoLhOEegXLkTsLAzcdj8Mft7ftSP2tUH+bwMwlskUk2APWvNNtnGYXnJlN1Xx8DB5+yWP+B2cgJylQkcr4PeHueLkxI4HuHGGGlcCmmsodYm+yzlIityEkxJy2XMHEQJ+k2Zgz9YRaoV7ZAdbrc+xsmlSxnUNzA9OPMOR+gqYL50oTMcmTMwvAItw9y5XCKsP0JRZeI3o7TLpNb3qhcA8ChQZFMWAwMABA4AAAA="}
00425{"flow_id":43,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":901,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":525046,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0T6FAAEAGxaPAqAFny82XotNhAbttdZ50GtGyNIAQAShe+QAAAQEICgAx0rlF8ioz"}
00596{"flow_id":43,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":527605,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyT6JAAEAGxSTAqAFny82XotNhAbttdZ50GtGyNIAYASj2MgAAAQEICgAx0rlF8iozFgMDAEYQAABCQQSYqWHtZ8LgWlO15dh+fdJ3nqcBuUM8+tfxqz2jW8tfUye0eFFyRslXvQE7fsTpUszDWskMifZN48VBkuaCTdLHFAMDAAEBFgMDACgAAAAAAAAAAAVsrZYAUhs26PgMirptnxdGhmLSfoG067ZtHNOeFNxQ"}
00495{"flow_id":43,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":903,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":841633,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnjD5AACwGnDPLzZeiwKgBZwG702Ea0bI0bXWe8oAYAHh4EgAAAQEICkXyKoIAMdK5FAMDAAEBFgMDACjNNFVdUvW9s8mTz+nzxahD1GvhgdlRv34kDHdsJx1G0tkwx3ap4Xwb"}
02114{"flow_id":43,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":904,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":842751,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMT6NAAEAGwMnAqAFny82XotNhAbttdZ7yGtGyZ4AYASg0gwAAAQEICgAx0whF8iqCFwMDBNMAAAAAAAAAAfZ8pWGJ9Xhy9pAWnIbCJ9+mB\/KUJleQZZ3CBKTEaQum9+FgSGoxeY8cb+uPSGy6YwdWS6WDrEl2zrPesptuU7aug2IdMNteMgt+XlftKB\/ZUbvMkEV9w\/SdtlRfFeOYk0KYhiD\/j3YZIt4U3vU8Z0JCF5QxWhZ9mj6N8HIx3HPrAp+7hSrCHQ8zq9CGHkmY1dY6SULZByNhUclk2TwSZ5jrYUF4ZRZudhDRqFUKw2fHP01P7uGReCLSLbOsZj3UzspovOLaDnZV7FVIxRqeKMSugwaLtq1oJ0+ZS3sihC3CqeWXJ5rKrKsA\/PXbOu\/6P1slauYOGt8x+Z8jjKSOnOu7WPnDJFDhrDdQJbq\/VTrJAE7epNeSYlMlLZMHfwHnSTx7x4tsuwRIg27IwJsQzFKu42L3NT8kXFPa1fedeHReO7+szwmdVJZEZwlbNaaLkR6AYOLHRC1KN0orOP0mqUkeAvWyox8+pV\/WTns7bkOfsvVbx7A0vmMMIlDjqIaO8Y\/qylm4VO\/8SvFyP1ScPekPR0qSPvX8xA\/gdrd2ElpsXEK1AOjbNTrqnCgmNSKBNS5W+E8f34akcSz+GxJXbvDrkI95NmlWNGj9f65v02BTWZtZ7ZbKB4irC4heWK1Vr2M\/2taMqE1+0cKdBLJtNtZeu8DjK\/LCzTcXL4+\/3kPPdfl3T\/g1M3j\/URCIjkLg+yRanclVscWhLrsuag\/wuNBRQGMXWGOdamtwrhCKyTs5K86lvVEauz+OJpE+PJUmqhCpozBIfw6cuHF57JWBZiPD6bWSWvHABhw0PHkJbpuCCOQ++sS1otMcCacgG2N+yvf4TKHOD40Fnh0tAJlv3A4eEUtEI6ff2ZUoX6CJ34OvyMlJJVx37S7FSE5FgB1Ox8O\/0kg1bi56t3KlZAbjT1aGCRXm0QQ4RtjiutMg5dpttlnVl1wQyTUPd9CGV+z7ccpzIhvC6pDVgiYu9A7lzFZzIAI8SsmfK1D3BhQ4k\/2ldn8QKrEmB4eUqJOY1qiFZ0j3n2c1wtKfKlAo0ULDGeIegz5n8YId4DYAIC0OKyjssGSQ1Ru+ByqWqXqqcZJDCVAwaMYpkKR7w9rMHz3WAg\/jOHa0q8W9bBT4r9iUlgDY7CNaU1f+TjDOtyMTPdjc7KJGE6QJ+rmI2Oww+47xB8HnFsH9ZrmjihVKx7jpeaFc8ca\/s89PUt9TcglOtjXQtK8LkMvMFdM6qDHg3GloAhIRHUh8hoSy6HZAZg5QgNmO7IuCOHw1vyA1LGemuq7d3A68216J\/FU3sY7xvPwb\/1ufVAwdmUgfj9lRfF4r\/Gc1VygWFZL0YJZU8yXJOdgZygbCVJGEUz5lMgRbtNfSt7XEFLeiqs+p38akZDuTZz3j82tYcrM18htwQ\/LlDGT1FeuRPS\/Avw5DU4nvnBd1ZZH9+7J+azuLJm50pEAZSMv8dbvX8Fa1jsihBnI2CR4wDpZ3OIxlur1RWGSNNwcCDpO68HMtbivE0cXxTHFpqHy4\/tG4Zw6M58xrzS8Ys0mbmu108w3TE50mBCWRrNsO+iBx9jK8bD5qT10k2PRSZo1oK376ODGnh+cXAO92sr9zDQDISqfbgg0qmbB1hrKHBx2FYlBtCsmoKCX2gg=="}
01068{"flow_id":43,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":905,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167640,"pkt_ts_usec":847391,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPT6RAAEAGw8XAqAFny82XotNhAbttdaPKGtGyZ4AYAShHHwAAAQEICgAx0wlF8iqCFwMDAdYAAAAAAAAAAh1muGjOPXIX40dIJ1pd+2dFHsVMoNmHUc0fTMh1mApRVoCS2+G8qiOSrxGvgq+gc1+zTHqk0N0pq5TVYV2lpi0YYsI9rI3KMcQjeQSC129QCarWmDtfPvsv3PQdjZSuQw9o1ppwGtEhzY3LANHXfWguKZ2dgkOMTSEMrEV8QVc6uRyJMSv2VycsQzxdnRdz3T6iTn01YMbKWjGoqnuNfhb\/7rIQln+ltAsN6U3Pyw3EN\/MUT7Y3dqAOj9lkrb9No0LqpI0M9vmqs+RuThumptBGDuZxS9JDwzr\/YYZyKVZZFCC39iJItVBRrPleOQhv9muxoW32a1tXbE+As\/4MvMSMuRYuXWKCjrgBUsKfIjGG9EthdYXlwG01QkGdcsfvbJiMTrHX5a7rZBzpbdNxdc7BnNOInKgrK2P+szZ13Zfa+U6zOLkqDYYZQ6penSZthBEl0rCZ0xShqemMcI5ltxYwYx4Kaa9zbw28Bdh7xCCGijNfRY4KlDbCUKmrOQ4wbVQwy+5yysqRP5m2wWNlUpDYDSniojwRY7TnvUlquV2JEJjY71eqGRYXECVcg6CL89Oy4mqoP0fDV+w87hmsdveWVzBkLIdSGCkJtdtHRA=="}
00436{"flow_id":44,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":921,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167641,"pkt_ts_usec":723120,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702LyUvm4GyuHH6ASN8hDHwAAAgQFoAQCCApF8itfADHSpgEDAwc="}
00425{"flow_id":44,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":922,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167641,"pkt_ts_usec":723166,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0VUhAAEAGv\/zAqAFny82XotNiAbsbK4cf8lL5uYAQAOWouwAAAQEICgAx0+RF8iog"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":936,"source":"wechat.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1492167648243,"flow_last_seen":0,"flow_tot_l4_data_len":39,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":19041,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":936,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":243043,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"8IQvSpdgeJKcD6iOCABFAAA7101AAEAR3q7AqAFnwKgB\/kphADUAJzTVMN0BAAABAAAAAAAAA3JlcwJ3eAJxcQNjb20AAAEAAQ=="}
00627{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":936,"source":"wechat.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1492167648243,"flow_last_seen":0,"flow_tot_l4_data_len":39,"flow_min_l4_data_len":39,"flow_max_l4_data_len":39,"flow_avg_l4_data_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":19041,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.QQ","breed":"Fun","category":"Chat"},"dns": {"query":"res.wx.qq.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
01055{"flow_id":45,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":277339,"pkt_caplen":537,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":537,"pkt_l4_len":503,"pkt":"eJKcD6iO8IQvSpdgCABFoAILAABAAEARs4zAqAH+wKgBZwA1SmEB91rcMN2BgAABAA0AAgAMA3JlcwJ3eAJxcQNjb20AAAEAAcAMAAUAAQAADgoACwVyZXN3eAJ0Y8ATwCsABQABAAAALgANBXJlc3d4BHRjZG7AE8BCAAUAAQAAAC8ABgNzc2TAMcBbAAUAAQAAAhgABgNzc2TASMBtAAEAAQAAAIwABMvNniLAbQABAAEAAACMAATLzZfUwG0AAQABAAAAjAAEy82eNcBtAAEAAQAAAIwABMvNnjfAbQABAAEAAACMAATLzZfjwG0AAQABAAAAjAAEy82eI8BtAAEAAQAAAIwABMvNnjjAbQABAAEAAACMAATLzZfTwG0AAQABAAAAjAAEy82eNsBIAAIAAQAANa8ACgducy1jZG4xwBPASAACAAEAADWvAAoHbnMtY2RuMsATwQ8AAQABAAACoQAEtv4QccEPAAEAAQAAAqEABLhpznrBDwABAAEAAAKhAAQOEROMwQ8AAQABAAACoQAEZwce7sEPAAEAAQAAAqEABHt+dlDBDwABAAEAAAKhAAS0oxYuwSUAAQABAAACoQAEtv4LcsElAAEAAQAAAqEABLb+bmTBJQABAAEAAAKhAATLzZfxwSUAAQABAAACoQAEDhEsW8ElAAEAAQAAAqEABHBaSWTBJQABAAEAAAKhAAR9Jy3o"}
00658{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":938,"source":"wechat.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1492167648243,"flow_last_seen":1492167648277,"flow_tot_l4_data_len":542,"flow_min_l4_data_len":39,"flow_max_l4_data_len":503,"flow_avg_l4_data_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":19041,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.QQ","breed":"Fun","category":"Chat"},"dns": {"query":"res.wx.qq.com","num_queries":1,"num_answers":27,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"203.205.158.34"}}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":939,"source":"wechat.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1492167648277,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43850,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":277830,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8euFAAEAGk9vAqAFny82eIqtKAbscYaCqAAAAAKACchBlYgAAAgQFtAQCCAoAMdpLAAAAAAEDAwc="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":940,"source":"wechat.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1492167648494,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43851,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00438{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":940,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":494081,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8\/\/9AAEAGDr3AqAFny82eIqtLAbsShiV+AAAAAKACchDqMgAAAgQFtAQCCAoAMdqBAAAAAAEDAwc="}
00424{"flow_id":46,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":941,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":582668,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0AABAADEGHSXLzZ4iwKgBZwG7q0qHWOtEHGGgq4ASOQgtSgAAAgQFtAEBBAIBAwMH"}
00408{"flow_id":46,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":942,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":582745,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoeuJAAEAGk+7AqAFny82eIqtKAbscYaCrh1jrRVAQAOWmPwAA"}
01107{"flow_id":46,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":943,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":583174,"pkt_caplen":571,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":571,"pkt_l4_len":537,"pkt":"8IQvSpdgeJKcD6iOCABFAAIteuNAAEAGkejAqAFny82eIqtKAbscYaCrh1jrRVAYAOXThgAAFgMBAgABAAH8AwOCKLlYqqAvHPbStkNWfjviIJbNG8Opd41AdjWFUM5PDSCzw4Dj+1hijcfqB70gmV5q3+xDc\/7ZaGy4swNwVbbuBgAgiorMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAGTuroAAP8BAAEAAAAAEgAQAAANcmVzLnd4LnFxLmNvbQAXAAAAIwDA2rkP6N2F29W8IwDuml2ZBBexYWjz5d457nDC1tP3qzS2OGOajXlg7G9AUXA4imekq\/giRMEwa6iYhFjFjW4HKVdggoetJsKG1EFlq7Nse5+E1dc7PIUx4S\/ZrSiowXWl3yiYnLRXfAjDAJmKDd8SHhSHQTacbrGt8DQhtrFK0Cnfg4052zdZqAPMursq2AeUYh3+Ngc6z81+fZTHJbme2+rUNgUjlpPVl20yUvASxiP0qdMrlctOXqH2ToAmQQaKAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAABIAAAAQAA4ADAJoMghodHRwLzEuMXVQAAAACwACAQAACgAKAAgqKgAdABcAGFpaAAEAABUAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00717{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":943,"source":"wechat.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":4,"flow_first_seen":1492167648277,"flow_last_seen":1492167648583,"flow_tot_l4_data_len":629,"flow_min_l4_data_len":20,"flow_max_l4_data_len":537,"flow_avg_l4_data_len":157,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43850,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.QQ","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"res.wx.qq.com","ja3":"550dce18de1bb143e69d6dd9413b8355","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00425{"flow_id":47,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":945,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":873395,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0AABAADEGHSXLzZ4iwKgBZwG7q0tO\/rLJEoYlf4ASOQgjJgAAAgQFtAEBBAIBAwMH"}
00409{"flow_id":47,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":946,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":873492,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoAABAAEAGDtHAqAFny82eIqtLAbsShiV\/Tv6yylAQAOWcGwAA"}
00408{"flow_id":46,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":967,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":901608,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAouBhAADEGZRjLzZ4iwKgBZwG7q0qHWOtFHGGisFAQAHukpAAA"}
02370{"flow_id":46,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":968,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":902355,"pkt_caplen":1514,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1514,"pkt_l4_len":1480,"pkt":"eJKcD6iO8IQvSpdgCABFoAXcuBlAADEGX2PLzZ4iwKgBZwG7q0qHWOtFHGGisFAQAHtKVwAAFgMDAEgCAABEAwOl4vZPF0bScJW+f8qrSOuG6NWtKghGWg36rESUqwxOoAAAnQAAHAAAAAD\/AQABAAAjAAAAEAALAAkIaHR0cC8xLjEWAwMSvwsAErsAErgAB7QwggewMIIGmKADAgECAhBrUPksf4oyMjSwV4ASgKLNMA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNjA1MTAwMDAwMDBaFw0xODA4MDkyMzU5NTlaMIGSMQswCQYDVQQGEwJDTjESMBAGA1UECAwJR3Vhbmdkb25nMREwDwYDVQQHDAhTaGVuemhlbjE6MDgGA1UECgwxU2hlbnpoZW4gVGVuY2VudCBDb21wdXRlciBTeXN0ZW1zIENvbXBhbnkgTGltaXRlZDEMMAoGA1UECwwDUiZEMRIwEAYDVQQDDAl3eC5xcS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDxAHUrCcNPlCBG6Ea74TgkCCNchqGwaeD2Gja2dtIEMhguVwcs2KcnPZ0BTW+Wlhjcw18e8a3qA5aNNNR6HqXXdpw\/\/iT557Axy4PbSeFd1UmxKwVpaDAK2lmFMGkIJZbI98Zm4W3hxCjhQTkBFZj5ePX5DrDh8NNFWdYeJpGDyQlwLTMtrViHAeoiVcJ8jPS6HWtO\/UiyIoryHVf+I52fvdVGVzMegbmFxAHrivdrBE5BhYr9d3wq3zhFepiy2tfGI8B\/Z1qLYHNh2WE25oNbTGh4cE7gu5oqY88UmzyxVxa5eR5B4OUwXYcO5yrSTEcdWhsy54YdU7iCwIG\/OHwPAgMBAAGjggRNMIIESTCCAUEGA1UdEQSCATgwggE0ggp3eDEucXEuY29tghF3ZWJwdXNoLnd4LnFxLmNvbYIWd2VicHVzaDEud2VpeGluLnFxLmNvbYIXbG9naW5wb2xsLndlaXhpbi5xcS5jb22CD2xvZ2luLnd4LnFxLmNvbYIPZmlsZS53eDIucXEuY29tggp3eDIucXEuY29tghBsb2dpbi53eDIucXEuY29tgg13eGl0aWwucXEuY29tgg5maWxlLnd4LnFxLmNvbYITbG9naW4ud2VpeGluLnFxLmNvbYIWd2VicHVzaDIud2VpeGluLnFxLmNvbYISd2VicHVzaC53eDIucXEuY29tghV3ZWJwdXNoLndlaXhpbi5xcS5jb22CEXdlYi53ZWl4aW4ucXEuY29tgg1yZXMud3gucXEuY29tggl3eC5xcS5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MIIBfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdwDd6x0reg1PpiCLga2BaHB+Lo6dAdVciI09EcTNtuw="}
00804{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":968,"source":"wechat.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":6,"flow_first_seen":1492167648277,"flow_last_seen":1492167648902,"flow_tot_l4_data_len":2129,"flow_min_l4_data_len":20,"flow_max_l4_data_len":1480,"flow_avg_l4_data_len":354,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43850,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"8":"Weak TLS cipher"},"proto":"TLS.QQ","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"res.wx.qq.com","ja3":"550dce18de1bb143e69d6dd9413b8355","ja3s":"290adf098a54ade688d1df074dbecbf2","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_GCM_SHA384","alpn":"h2,http\/1.1"}}
00408{"flow_id":46,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":969,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":902391,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoeuRAAEAGk+zAqAFny82eIqtKAbscYaKwh1jw+VAQAPuecAAA"}
05030{"flow_id":46,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":970,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":903691,"pkt_caplen":3484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":3484,"pkt_l4_len":3450,"pkt":"eJKcD6iO8IQvSpdgCABFoA2OuBpAADEGV7DLzZ4iwKgBZwG7q0qHWPD5HGGisFAYAHs5gAAAvswAAAFUmcBh2QAABAMASDBGAiEAiufSCxdOF+7bgLpOmxcQG65s2qcgk7pdknOslLXY\/LoCIQDE45vN8fjY00CTdAwWDifBEAx38j2fQnz0tu8VuQYaaQB1AKS5CZC0GFgUh7sTosxncAo8NZgE+RvfuON3zQ7IDdwQAAABVJnAYgoAAAQDAEYwRAIgCJtQ2j0JaTPEQjEs0TuxHQfYaL2uWgH2iq\/PKYGE1wkCIAWv97otqd2tBkfL2zH82LGUijT7jPOhF4bZh7VUmVMPAHcAaPaY+B9kgr46jO65KB1M\/HFRXWeT1ETRCmesu09P+8QAAAFUmcBiDwAABAMASDBGAiEAsFcX8neGVSoD2KIq715oreo+ZZHssfyESZimYGEqbZECIQCY6c45FdAvBmBvBM8a7DIvTZz7Hqf\/jJKOfuPp2IaPgjANBgkqhkiG9w0BAQsFAAOCAQEAacSpqaeLeHtWG6B2q1V21KOu+t+P6DKXMlAHJQxnO\/Z6eX2lm2slENukRZAUJAfqy+pjKmCYyh9yOqKpYcU\/1LwhjaA5NbGJtr5doYCCLzWgEYUTI0CcVrgndk8aV9eIXFvmPSCniyEo0G+srQoPtcOJ\/dJ0fnTCOkJ5\/idKuF0HBwZDY3W5iZiYNg4LjjlBsrZrDbBuDmmmQ3X3T5CNLGlle4wCpKbNX7Ax4WO\/kwQeyYxpZrtwVijbRENwCnxqfK2bTAq08T3eIw+RT2WONqajChf3hIvPkUpOX61AJrDZm2Tu8KGncijArQGQQ3+qiBfUWFpk1ENGcqqlL9V\/NQAEUzCCBE8wggM3oAMCAQICAwI6bzANBgkqhkiG9w0BAQsFADBCMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3QgR2xvYmFsIENBMB4XDTEzMTEwNTIxMzY1MFoXDTIyMDUyMDIxMzY1MFowRDELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xHTAbBgNVBAMTFEdlb1RydXN0IFNTTCBDQSAtIEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA475+Coajz2ttPSuhl61JJE3Xd7k0eQilnqKe3kcSkj1+6hmGsehPPV\/30Kd3mlsfCgO1GVPbpSGUaWOdakyRDBBHvhH6bIYlt6sEaEI4CWXwFNoZnvprC6ti742n72NwI6ivgfPRbohnU+wSpCl1iqfyVz2ig5iX8gp91OdDbjB4YiJZWbhxJ0WqD2bGVT\/6MhcrMY9GoPppFHydn1ri6zNOEKaz7Xdj2MOe9N3feZp61O7e3ZrMw7epXcwROge7b5ekASNHlR+jd\/pYksbH0L3PkxhCt373nmXq1TvK7azFcKH+1BCa8BIERKwaW3hQRVdMb72Ay4FcLbO8dqEeZQIDAQABo4IBSjCCAUYwHwYDVR0jBBgwFoAUwHqYaI2J+6sFZAwRfap9ZbjKzE4wHQYDVR0OBBYEFNJv95b0hT9yPDB9I9qFeJujfFp8MBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgEGMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9nMS5zeW1jYi5jb20vY3Jscy9ndGdsb2JhbC5jcmwwLwYIKwYBBQUHAQEEIzAhMB8GCCsGAQUFBzABhhNodHRwOi8vZzIuc3ltY2IuY29tMEwGA1UdIARFMEMwQQYKYIZIAYb4RQEHNjAzMDEGCCsGAQUFBwIBFiVodHRwOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvY3BzMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFTeW1hbnRlY1BLSS0xLTUzOTANBgkqhkiG9w0BAQsFAAOCAQEAoNT3LPt0C39k8c1Dap9iUxwCfJiQou5PaNQgGnMSPnezUOtyvO6Ivn8X6nePg2GVT4ShyzJPbCG+0mmWfWO93CuoH9AThHD+9jWVifmmd7BGyLu3E\/XJYGnWTP7Sju\/TYMGAgOHn+4tvIXlK4NypG8G3+8NJWVy1dwdE1Jf8SQCJbwZOAXAZrC8RwOLmDy+GS417w7mnLvTxrBY+OUlRnhdLTxA6W6Wokm\/9+tYLA01HVlcZ88tr9fPWz7D19aMR0iBTEzQ3BSxDWmPfjUDWhR5R6VEXHgNWyfEwreebEaK50DGBm2ix2ejz5pR+x64TL4ft0CWwaPneCFrzKczUkgADgTCCA30wggLmoAMCAQICAxK75jANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTAyMDUyMTA0MDAwMFoXDTE4MDgyMTA0MDAwMFowQjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUdlb1RydXN0IEluYy4xGzAZBgNVBAMTEkdlb1RydXN0IEdsb2JhbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANrMGGMw\/fQXIxpWflvfPGw45HG3eJHUvKHYTPioQ7YD6U0hBwiI2lgvZjkpvQV4i5046AW3an5xpObEYKaw74DkiSgPniXW7YPzraaRx5jJQhg1FJ2tmEaSLk\/K8YdDwRaVVy1Q74ktgHpXrfLuX2vSAI25FPgUFTXZwEaje3LIkb\/JVSvN0Jc+nCZkzN\/Ogxlxyk7m1NV7qRnNVd7I7NJeOFPlXE+MLf5QIzb8ZubLjqQ5GQC3lQI5kQsO\/jgu0R0FmvZNPm8PBx2vLB6PYDni+jZTEznUXiYr2z2oFL0y6xgDKFIEceWrMz3hOLsHNoRinHnqFjD0X8Ar6HFr5PkCAwEAAaOB8DCB7TAfBgNVHSMEGDAWgBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHQ4EFgQUwHqYaI2J+6sFZAwRfap9ZbjKzE4wDwYDVR0TAQH\/BAUwAwEB\/zAOBgNVHQ8BAf8EBAMCAQYwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwTgYDVR0gBEcwRTBDBgRVHSAAMDswOQYIKwYBBQUHAgEWLWh0dHBzOi8vd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMvcmVwb3NpdG9yeTANBgkqhkiG9w0BAQUFAAOBgQB24RJuTksWEoYwBrKBCM\/wCMfHcX5m7sLt1Dsf\/\/DwyE7WQziwuTB9GNBVg6JqyzYRnOhIZqNtf7gT1Ef+i1pcc\/yu2RsyGTirlzQUqpbS66McFAhJtrvlke+DNusdVm\/K2rxzY5Dkf3s+Iss9B+1fOHSc4wNQTqGvmO5h8oQ\/EgADJDCCAyAwggKJoAMCAQICBDXe9M8wDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVxdWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw05ODA4MjIxNjQxNTFaFw0xODA4MjIxNjQxNTFaME4xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMFdsVhnCGLuoJotHwhtkRRomAoe\/toEbxOEYiHD0XzOnwXguAHwTjTs4oqVBGSs8WtTXwWzy2eAv0ICjv7dAQns4QAUT\/z78AzdQ7pbK+EfgHCZFVeTFvEPl2q3wmgjHMxNWTCsUR47ryvW7mNFe8XZX1DS41APOojnvxT94Me5AgMBAAGjggEJMIIBBTBwBgNVHR8EaTBnMGWgY6BhpF8wXTELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0VxdWlmYXgxLTArBgNVBAsTJEVxdWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTENMAsGA1UEAxMEQ1JMMTAaBgNVHRAEEzARgQ8yMDE4MDgyMjE2NDE1MVowCwYDVR0PBAQDAgEGMB8GA1UdIwQYMBaAFEjmaPkr0rKV10fYIyAQTzOYkJ\/UMB0GA1UdDgQWBBRI5mj5K9KylddH2CMgEE8zmJCf1DAMBgNVHRMEBTADAQH\/MBoGCSqGSIb2fQdBAAQNMAsbBVYzLjBjAwIGwDANBgkqhkiG9w0BAQUFAAOBgQBYzinq\/Pfetc4CuRe1hdG54+CVzCUxDQCmkm5\/tpJjnlCV0Zpv5BHeY4VumO6o\/1rI01WyZnFX3sAh6z0qpyNJAQSGQnv87n+iFlK1Z2fTQNs7JliyKHc9rhR3Ydb6KmYnoA36p3Nc6nDxlCFlRF\/6\/O8paKmih3nvee9PrAd3OBYDAwAEDgAAAA=="}
01367{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":970,"source":"wechat.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":8,"flow_first_seen":1492167648277,"flow_last_seen":1492167648903,"flow_tot_l4_data_len":5599,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3450,"flow_avg_l4_data_len":699,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43850,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"8":"Weak TLS cipher"},"proto":"TLS.QQ","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"res.wx.qq.com","server_names":"wx1.qq.com,webpush.wx.qq.com,webpush1.weixin.qq.com,loginpoll.weixin.qq.com,login.wx.qq.com,file.wx2.qq.com,wx2.qq.com,login.wx2.qq.com,wxitil.qq.com,file.wx.qq.com,login.weixin.qq.com,webpush2.weixin.qq.com,webpush.wx2.qq.com,webpush.weixin.qq.com,web.weixin.qq.com,res.wx.qq.com,wx.qq.com","ja3":"550dce18de1bb143e69d6dd9413b8355","ja3s":"290adf098a54ade688d1df074dbecbf2","unsafe_cipher":1,"cipher":"TLS_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=CN, ST=Guangdong, L=Shenzhen, O=Shenzhen Tencent Computer Systems Company Limited, OU=R&D, CN=wx.qq.com","alpn":"h2,http\/1.1","fingerprint":"67:53:57:7F:22:BB:D0:A6:D4:5F:A6:D4:B3:0A:13:73:29:23:D0:C9"}}
00408{"flow_id":46,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":971,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":903749,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoeuVAAEAGk+vAqAFny82eIqtKAbscYaKwh1j+X1AQATGQ1AAA"}
00845{"flow_id":46,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":972,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167648,"pkt_ts_usec":906084,"pkt_caplen":372,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":372,"pkt_l4_len":338,"pkt":"8IQvSpdgeJKcD6iOCABFAAFmeuZAAEAGkqzAqAFny82eIqtKAbscYaKwh1j+X1AYATFcEgAAFgMDAQYQAAECAQAhawO\/So02owaxwtSBTxgQTMGYEFFwQfENZd+q51oYgQaRl474gqK1J1Qcn\/lTkYGvPp69dZQntNXEY5pmbpNXrM5S78RwbgFdRvg9LmN5xSHxhEG+PtKta2IW9t4ERcm5QkxyjclvEYp\/3f0gkLogOpZzo1D6BoBxwqxl2od9ghrNs\/fgh1yMYsShe51\/CE6NfJmxw1tAncj0mIpZ\/V8NOsuLtjcBXBd5Yi0ZUzWmw95su4oMpe4ZCuldslgd3DFEQSFRYu5e+hEPRE+d30syoeIdkZiyk5oA9X6WlIkQLzKVKAPU9\/zOFZzCyerdURGdA8\/P0FtIx2sWQmLQY1gJFAMDAAEBFgMDACgAAAAAAAAAAHreAZXwYU5XDew+sGUU0hHC+4w9SB7ji3gKd9\/+recE"}
00417{"flow_id":46,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":991,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167649,"pkt_ts_usec":223893,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAouB1AADEGZRPLzZ4iwKgBZwG7q0qHWP5fHGGj7lAQAIOQRAAAAAC4nN6O"}
00757{"flow_id":46,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":992,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167649,"pkt_ts_usec":226715,"pkt_caplen":312,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":312,"pkt_l4_len":278,"pkt":"eJKcD6iO8IQvSpdgCABFoAEquB5AADEGZBDLzZ4iwKgBZwG7q0qHWP5fHGGj7lAYAIOadQAAFgMDAMoEAADGAAAXcADARmd9wm0qbpS1rmR0FUVZp4NmWX0DAMK6cEyyTZQHRyxKIfdveqHM\/LscRQuwt7NwDYCAOnfI3WBGVA0W+gF3ZrDQWwlGAPk2iIa1WZe1pjmSSeitcjNp+0lTc2ZsvuZQ539EhMFwYT1gImvrl4N3GL6aKLxLf6TDfl4TNbrg9XHwxNLx6AGQ+3BV5aF6RA5Ti2uz6EZ4Sg+r9PcRLlxvu0Jjfv0OTWlaQfC5bxwgKQ9nodhswjwTdUkCVmjejRFuFAMDAAEBFgMDACgy6eHBv2K633TSMJHkQK+Y4YIBEW55ljhJJM1dKX0lQRXj6zioyhKZ"}
01089{"flow_id":46,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":993,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167649,"pkt_ts_usec":231886,"pkt_caplen":556,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":556,"pkt_l4_len":522,"pkt":"8IQvSpdgeJKcD6iOCABFAAIeeudAAEAGkfPAqAFny82eIqtKAbscYaPuh1j\/YVAYAUjtBAAAFwMDAfEAAAAAAAAAAXo3ZqAIQZwh7WYehCHlMp2CtH44uuwR0zgQklawhRCsENEZBjI9PajPfT3VsbMx3WNURWJcAL6kcoNnDveagRd0RvLoKQbbVVXJA5Yj5eUPm1jx+5TE1\/ecNxSmtvyYECbmTTUblYS8ovOS2EBTA3j44A3UEct12yRb6UqJBd1siIyEUG3Zh1ku8hETRMmCk0SUIJfwsW8f40KA0F5eAAJEE8KqSzmbeUYh5GoMrv5Mw0hzFP2++\/pU33djuMhPGpvKO8Qmdo7whsId36G97l8LJQ4CatqxrzESizmQabw+zetuhwhPHh9Tu2m3k5xpX8oT28JvF3aqNOHtpbSSjaEZxtZPmlxYCAkwTkhN5q++m68WJThU02jI9ogUAN1XsBczrFmIB0KxNPkD36NOUM+SgChL+kvofeB399\/h+ZHtqGzQ31HxLRXn9tF\/MRlgZOIxSIz0D7lxlRhR2lkmUkBofEiuZW3W2VYXmyv4xNfJKuFpgeEI7tEbJKy35TMd0LLAAGZPZ07Bq2vq6aac31UUoTWHkbbDjaGI+UE8W+am4YZXNWi7mlvK9B5Z+NeDM3J61DZvgANBOqAKrwBNpgdNHhTTjVuOIx13FeZDMNFJXDR+X7tyKkdn+pdzleEMLhRKx03JGAIOyQ=="}
00417{"flow_id":46,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":994,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167649,"pkt_ts_usec":549109,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAouB9AADEGZRHLzZ4iwKgBZwG7q0qHWP9hHGGl5FAQAIyNQwAAAADcFepn"}
01671{"flow_id":46,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":995,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167649,"pkt_ts_usec":551913,"pkt_caplen":984,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":984,"pkt_l4_len":950,"pkt":"eJKcD6iO8IQvSpdgCABFoAPKuCBAADEGYW7LzZ4iwKgBZwG7q0qHWP9hHGGl5FAYAIxFlQAAFwMDA50y6eHBv2K64C7+tJIQlCdw2jUNZme81zBy9Kudd90KLapxrnKnOsSMuJfxCzRNgfWOQYwttn0mY\/t6aW25mV59UxR8nnPwhFXmjTofQjxTb1I89V\/73gJlncSt\/B1VlChgh0nl4hq+MNOHTNwf+6iIL3CbjtAS\/uFE1MRfMG2IzAWVohyS1zlqHfVH7dc8+5oj4UkxVlADQTMFb9uBsPH1MO0bV0zM9dmOm7iaKG\/PfvbDT8ROTgsUMYc95gKmCgbMJ1X1nLgVMtsXZOqXUESKGpgkUyDSGaKmFApsD2jbiEc7rHoz5S3NqWERAmOdT9PxkpqZgGX7g2c7WRqQdWEv7IJaRxvAx\/dgDrn4GXUBTMEQe4LfrDkGXxx0+OBdqBxvKZyt2svgQtIoijhUywBLw7ECbrjrNm3RCYQaza3Q7ZeXzpJszCiKLlqJM++\/1VDrvVoJ6qRkHK3E2n3WAiYSO6X9hlTqjlhALTKp9xuw4aBQI9vTAUKMv8l61n6GtcPlv1i9qFQJHocc94IwZrWaYA+\/hIVCy8OAc0mKOrJghE0pyY3mS4rYhUDtGSIDfLdVc7xZCGJT\/A0vKcIpmz6GyPOQEBxnxLi3K4Z\/v7dqmz87KJaqWbasRHhwUknVx+Qv8WEqUKxrU57ccRQEXGF+GNjkj46fcUrTA1\/Q1yt1KCFvFZxCRRA8phQeBYG9Ex\/r0eyVnv\/x5yKt5S1qto4LOBnDbqqRqlWEGAzYIoRh4Gn2Pa9lGBPM3svNKpd2o7plM1ICOKo+Qyuwz5Uqdx3SxU4R0EyWih9nqE19hRdxHQnyyThg5JunE5cG79CdtE+PAcg1XDWrbywOJDRXhXp1E6HHjPKvlzmNyOUUm8Ui2sY3e9XFdYYVVZX4mBBB\/XXP9VhbUZmSWHe1evb2ShulRaptP1T4uK81o7jbH7VdtvCHZjuBpRzZSYd8UFXpNUKPYrF9Pyh+a2AXknKLHQe1P7OMsLvCTYzuNAfEsCJQIgssxuUVh3rlvd0FdEgiddFvA5YHie3zCEIHmFPDnhUDvCfEF2N2B3fF2Q2Y8R9clzIhB\/jBSLhYKKqPyMzuGv4T8pHGEH8unfFFERaPv9BZRHW2HKULct\/SPhWcvj7+RlopmuzfQxR0jJKYpH9S4pO19aUX4raoISFb13mJ4M6wVLlnADsiu9c4m2L+\/Vvv\/YS+HyVAZ1\/KzBpu+nl2z9Hp7qT0FQQKtvobc68f"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":997,"source":"wechat.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1492167650311,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60562,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":997,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":311981,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"8IQvSpdgeJKcD6iOCABFAAA916xAAEAR3k3AqAFnwKgB\/uySADUAKTCBKzkBAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQAAAQAB"}
00641{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":997,"source":"wechat.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1492167650311,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60562,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"ssl.gstatic.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00651{"flow_id":48,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":998,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":345975,"pkt_caplen":234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":234,"pkt_l4_len":200,"pkt":"eJKcD6iO8IQvSpdgCABFoADcAABAAEARtLvAqAH+wKgBZwA17JIAyGqeKzmBgAABAAEABAAEA3NzbAdnc3RhdGljA2NvbQAAAQABwAwAAQABAAAAHQAErNkXQ8AQAAIAAQACif4ADQNuczEGZ29vZ2xlwBjAEAACAAEAAon+AAYDbnM0wEHAEAACAAEAAon+AAYDbnMywEHAEAACAAEAAon+AAYDbnMzwEHAPQABAAEABTcbAATY7yAKwGgAAQABAAUtSQAE2O8iCsB6AAEAAQAFLUkABNjvJArAVgABAAEABS1JAATY7yYK"}
00670{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":998,"source":"wechat.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1492167650311,"flow_last_seen":1492167650345,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":41,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60562,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"ssl.gstatic.com","num_queries":1,"num_answers":9,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"172.217.23.67"}}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":999,"source":"wechat.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1492167650348,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":35601,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
02205{"flow_id":49,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":999,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":348036,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"8IQvSpdgeJKcD6iOCABFAAVibiVAAEARQTrAqAFnrNkXQ4sRAbsFTiZlDSoBZwIONIO7UTAzNQGbgwNlLywtCSgLtCegAQAEQ0hMTx0AAABQQUQAIgEAAFNOSQAxAQAAU1RLAGsBAABWRVIAbwEAAENDUwB\/AQAATk9OQ58BAABNU1BDowEAAEFFQUSnAQAAVUFJRMgBAABTQ0lE2AEAAFRDSUTcAQAAUERNROABAABTUkJG5AEAAFNNSEzoAQAASUNTTOwBAABDVElN9AEAAE5PTlAUAgAAUFVCUzQCAABNSURTOAIAAFNDTFM8AgAAS0VYU0ACAABYTENUSAIAAENTQ1RIAgAAQ09QVEgCAABDQ1JUYAIAAElSVFRkAgAAQ0VUVggDAABDRkNXDAMAAFNGQ1cQAwAALS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1zc2wuZ3N0YXRpYy5jb227JKt8ARxJVGRWJtplczZ+Y0Ub6N9qmKgMLrSZKyo986eVN4hLCQ8XNjFEbipb4AqXbG2doRLcUxXPUTAzNQHogWCSkhrofu2AhqIVgpFY8KviMDAwMDAwMDA5UDTgFLbVCW\/cQ8zfwllNkC+Y3GQAAABDQzIwQ2hyb21lLzU3LjAuMjk4Ny4xMzMgTGludXggeDg2XzY0Jc6XFWD7G7yXYXhVaoxdywAAAABYNTA5AAAQAAEAAAAeAAAA4qvwWAAAAABQ8MfjcV\/rNPz9nE7SSiHC6cDht5RKlsv0JChHgsKm0olGM4pgTHU2HYUvFhtNkOqQx\/75FAQP87Et+xOmGXIhZAAAAAEAAABDMjU1wgnkHLidnM3CCeQcuJ2czT2t9HxBefiRQAt7kKmuees8hQEA9eDJxrTnigGUXAfpWeAkSroNTkBs4scsx1Ra2LSNreNDFvpSDuqq6UeKpHg6NTM40g2RnXl5QzirTperKCTKzWwn+4\/bmuO2uGlriSPr4ExcTigYtlruN8fxdgnsCAuRhi2\/JFjFnbJqpKvDwpzJerd7H8C9zsxPzgMehsK4\/vItkCcZuwJmgaicPHLBf9M3RGKygCyV25zBdoSYTv7XUf5XBhgAAPAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}
00629{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":999,"source":"wechat.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1492167650348,"flow_last_seen":0,"flow_tot_l4_data_len":1358,"flow_min_l4_data_len":1358,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":1358,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":35601,"dst_port":443,"l4_proto":"udp","ndpi": {"proto":"QUIC.Google","breed":"Tracker\/Ads","category":"Web"},"quic": {"client_requested_server_name":"ssl.gstatic.com","user_agent":"Chrome\/57.0.2987.133 Linux x86_64"}}
00881{"flow_id":49,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1000,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":348333,"pkt_caplen":400,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":400,"pkt_l4_len":366,"pkt":"8IQvSpdgeJKcD6iOCABFAAGCbiZAAEARRRnAqAFnrNkXQ4sRAbsBbnP9DSoBZwIONIO7UTAzNQLoUPe6\/kTOTlflPotTtybyc+JAmHNEvZwUaT+Y9MqSJDNXVlUHwBVN0wAQzobHU4rvOkVihYNG2ScjXRicw6QFTtMMe25DwzQ7F0UKP\/Y\/8HMbQmw9b+v7cjBNs8yLamuYyeUaQ6lA73AshAIuQPhL6IslIuIHWs+l0MLo2wd57CZSUFbeEQQGDWtD8b5mwEuaZ88hm8yA3WeZQ9Zu4UUro5Belh+M9DB8RCMbVDEQZk6oJR+FSwF3TriZCorpIzSRESc2crvu7FP1Tb9g0NyoL87e9cFlDFVypNQfdhNO+iEyVuMUtOGb6OQn1vrWvB\/icrLc4DopKhApNyBIG\/+MQmYuPalP+mCA4FXxaPeMi1RdjyuuqxJb39HK+6wmJsCzWDR6cvDTk6ywHmETP0AOjEu+QTifJk6chcMbgKmp0ErfBPvocLYD7Yj8Qw2lL48a1tEWZIz4lw=="}
02223{"flow_id":49,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1001,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":401660,"pkt_caplen":1392,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1392,"pkt_l4_len":1358,"pkt":"eJKcD6iO8IQvSpdgCABFoAViAABAADcRt7+s2RdDwKgBZwG7ixEFTkCsBPCmO80d\/CW5IJoqjbn6lzjr5TC1v3d2foeU3jLNcA4IAV35th92JTinR3E92La4uW3lsByHG3R1axVDDHGrIc2Dhs2S+7aBzkyVbwcuUK77hYdmfJ4TJuEFhTaYjceo9r51oYeJqOHOCc1BBmB5E+A58P\/H55fRg4dxRA9v1f2aVQ6I67HK4M7mS7147fzZ170E12rNhRLBsPAWwZ8U93ZWKjAcVK9waq7ihKZ\/GTyfNPuOCQnhcxCFRMVEx2xx65NSFauaw3a1qVgRV428j6Bchcyom0cvPgxBbWJUmObxkeqmQAFmTPCN6igcJnamWF5CRIXtlRtvIVi8G3Rds0EdWXNYvxaTSkwCziFaIH6mAaz9hCwjxATLUAdqd1Yo+wN5ikpGmpiBzh3Coj125lb7YXMKgdIF\/8K12iKaeICQ1ArpMEt9vvWxk35P363XmPN9SjUjvFqh8rl+ETiuGHzQwTYDZUwFRT8Tnc90FuuWkSHrjLuI78eE0u2MPArYDWbkXnAkM9f\/B1mpEGpwrQCQA0PHuwaHNDaEcqfk+htDhYfF2k76y25VNuFHeOfHnAe8W\/L6MSq0NvvJdxpclRqAM5S2hcBrDwho6FgiBa0XuPrQx61q\/3nmcTSWb0DXXos+FWaLGj1Jg4cyk4xSeKoZfxTTY8qOxPxWcSNcXXGMVMwz3NtJzwB28A6uPq8NBF+APnNiUzkLELf20sskbghw4Wvw2P5GvZ6Z0iUqrAzGSGc0IroovL34w3TMmjBnTPzAWKnwYJxIrcFH65r\/43AXULA7mwVKw7TuryWaAn8PVofDMn5VL+m8Bc4anaE3270Gx7DXXa3CWGylYl6IhspD51Ji7UqD6pJpDanmkxF7QRS0mZz7M+VCAuE5+TvKpba5WKwmCrXKMkHXnBfHSx4yC\/BngUmyj5AqU\/35FBtHK2MhZhT3uv3ixGib\/DhROgxNj\/fCIDmyLmZy6LuI15IWBQr2uiGWD15jLW9srpQ3r\/cpXrjFWrIOILP7BDqFX16AVMtIyhn8QUmpyMBzWR3rPBVnAwwCQUSi7lOuHYSBa2JAApapl8ibPeq+IESORJ2WC1jpiGlKVsyKHvCUxM4DB9CDGl+VMCLfBwTUsv9jC9A0oISxfI+skno\/pMiMhfE+1+tVpq0kVbytQk5I14sgZgoXLliJYkFCOr3ikDyMImPkBDegikF\/nhKUricS6KkRKOBVEDYofUgm6hebzs7TAwbIX0LHGrieMSNYdiZ\/RaP9BKZ7WUS7z8Jvlw3DtdXYHHGY\/9m62j8jgUA89FYp2sdoaRFheoQUmxEE6EpSZHWMo5+AT1rvxDTcNLYyAF\/NKlyP79gaAWae04vlwFQ4Bupkoby3AV8qNrlb42pc54gLBwr2\/V8SfP1Jf8GHKLnbnMMGzz8c8g08IQe\/1e7EH9oyogw0WeUU2ddyxaRPwa4eLAdObHTP\/jn7fsHAYVorRI56TLQ62d12KS2GZw3\/dElBm43NGOyNU1Hp381LUrTlDOWD2CkkP1QCRN+zezQnIAdftR9GtZfdliGgi4n+DRQuugUUjAENUiyLbjua9o3CfXKyGh5RlHt3r219Xp7bzpU2Sa3x2tOlotON5hkk2pmORaeO3NrbIHwpGOzFl20\/4Mhk6xhdUZeHJoEN7V1+kqNLH9CANDu7wpMSMlhqJfpnckBvaCh9BXX3VOJErUyDwJ\/yEG1ZNKGdvcDhAfCDrZsIbxElU8wBdoFg5g3GjSgWUZyHIUdESjz3nA05zyGh0UQ5UNTBZNmAzAGEZvPJPDUf"}
00451{"flow_id":49,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1002,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":402045,"pkt_caplen":83,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":83,"pkt_l4_len":49,"pkt":"8IQvSpdgeJKcD6iOCABFAABFbjFAAEARRkvAqAFnrNkXQ4sRAbsAMdx0DCoBZwIONIO7A\/2cOIqV1ZCK4h2eK05EMevTWpEuYxJ\/wRQedJtK4Zk="}
00437{"flow_id":49,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1003,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":402224,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"eJKcD6iO8IQvSpdgCABFoAA7AABAADcRvOas2RdDwKgBZwG7ixEAJ1FNAAKKbXDyukAED2gnENfkBoaaYzFpqRX7MwhtVYvU7w=="}
00433{"flow_id":49,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1004,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":402242,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcRvOes2RdDwKgBZwG7ixEAJi6WAANEGtEs50ixWe+ABqEl9SJOgoy0S657xf4flgbZ"}
00446{"flow_id":49,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1005,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":402327,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCbjJAAEARRk3AqAFnrNkXQ4sRAbsALiQuDCoBZwIONIO7BAg+F6C9OJtOw9xbOObe2FsMePS5IHFvVFWfi\/g="}
00784{"flow_id":49,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1006,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":419895,"pkt_caplen":328,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":328,"pkt_l4_len":294,"pkt":"eJKcD6iO8IQvSpdgCABFoAE6AABAADcRu+es2RdDwKgBZwG7ixEBJqaZAATD7MXnehtiXlUz+Hk1AeZaUc2+ZMvDZUZ0GqGxNNaAlZinDCrBrnaOATxSGsOCFMaCaFec4SV7oO\/kLFwrUENrwh1y1mgTHgoiDmnYRHxuSeGyRFMYgw\/xosUJkzw12lBcnAXTNv8a\/2SuAyzWJ4jI6Iu2NlHm3V9zQ8CxPjqgYIbUhNNdrG5USoTXaVi5Y7S5DrKlzxBm3pDBUHpSYYgnG\/IeF1QrqlkpO7en7C1cHKFw6gJSHCRIMxY8ZiapLj1p4qZkxYLvpZc5K1weMNgNi9AfEMvDInvOymojlrBOTgO6WjdYp9wpg0vGani4DMjzXYMZAzdJxYXKztZguyy1lTWS4COCVAf8P5zodYdJZ5FJBDf9WNj4Gj5A6A=="}
00445{"flow_id":49,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1007,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":446122,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"8IQvSpdgeJKcD6iOCABFAABCbjpAAEARRkXAqAFnrNkXQ4sRAbsALnSgDCoBZwIONIO7BYiI4Q8+7Irw1TjIeblP7I8YsZt0hiW0bAcHDAs="}
00436{"flow_id":49,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1008,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167650,"pkt_ts_usec":467068,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"eJKcD6iO8IQvSpdgCABFoAA6AABAADcRvOes2RdDwKgBZwG7ixEAJriTAAUXSH3m+iN6aIxogGzNWS8zq8zerRpTJGHn\/W\/H"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1009,"source":"wechat.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1492167654504,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00425{"flow_id":50,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1009,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167654,"pkt_ts_usec":504261,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0DsBAAEAGBoXAqAFny82XotNaAbub+DW+SvgsEIARAOUK7AAAAQEICgAx4GBFrgFX"}
00505{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1012,"source":"wechat.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1492167654504,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00478{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1012,"source":"wechat.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1492167654504,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54106,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00424{"flow_id":44,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1012,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167662,"pkt_ts_usec":38819,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA00hRAACwGVpDLzZeiwKgBZwG702LyUvm5GyuHH4ARAHCUGQAAAQEICkXyPzYAMdPk"}
00426{"flow_id":44,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1013,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167662,"pkt_ts_usec":40225,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0VUlAAEAGv\/vAqAFny82XotNiAbsbK4cf8lL5uoAQAOV\/zAAAAQEICgAx57xF8j82"}
00425{"flow_id":12,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1018,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167667,"pkt_ts_usec":432251,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePhAAEAGFxfAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO34WQAAAQEICgAx7QCFoZCv"}
00426{"flow_id":12,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1019,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167667,"pkt_ts_usec":486259,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0HvAAACsGxX9A6ae8wKgBZxRsjLFKrVv6utDMqYAQAWWDwwAAAQEICoWiQKsAL7Ej"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1022,"source":"wechat.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1492167669545,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00690{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1022,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167669,"pkt_ts_usec":545491,"pkt_caplen":254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":254,"pkt_l4_len":220,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoADwPUUAAIARd2TAqAFkwKgB\/wCKAIoA3H9oEQ7+\/cCoAWQAigDGAAAgRUhFSkVQRkdFQkVPRU9FSkNORkFFRENBQ0FDQUNBQUEAIEFCQUNGUEZQRU5GREVDRkNFUEZIRkRFRkZQRlBBQ0FCAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAALAAAAAAAAAAAAOgDAAAAAAAAAAAsAFYAAwABAAEAAgA9AFxNQUlMU0xPVFxCUk9XU0UADACguw0AV09SS0dST1VQAAAAAAAAAAMKABAAgP4HAABHSU9WQU5OSS1QQwA="}
00555{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1022,"source":"wechat.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1492167669545,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1023,"source":"wechat.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1492167669545,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1023,"source":"wechat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1492167617247,"flow_last_seen":1492167617598,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54109,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1023,"source":"wechat.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":2,"flow_first_seen":1492167617247,"flow_last_seen":1492167617598,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54109,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00517{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1023,"source":"wechat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1492167617247,"flow_last_seen":1492167617562,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54110,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1023,"source":"wechat.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":2,"flow_first_seen":1492167617247,"flow_last_seen":1492167617562,"flow_tot_l4_data_len":64,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54110,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1031,"source":"wechat.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1492167690433,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00405{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1031,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167690,"pkt_ts_usec":433709,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":50,"pkt_l4_len":12,"pkt":"AQBeAAAB8IQvSpdgCABGoAAkj9oAAAEC8bHAqAH+4AAAAZQEAAARZOybAAAAAAIAAAA="}
00468{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1031,"source":"wechat.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1492167690433,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00409{"flow_id":30,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1032,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167690,"pkt_ts_usec":638500,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPVsAAAECRLLAqAFk4AAAFpQEAAAiAPsBAAAAAQIAAADgAAD8"}
00408{"flow_id":30,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1033,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167691,"pkt_ts_usec":48074,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPVwAAAECRLHAqAFk4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00411{"flow_id":30,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1037,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167693,"pkt_ts_usec":96253,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPV0AAAECRLDAqAFk4AAAFpQEAAAiAOwDAAAAAQIAAADv\/\/\/6"}
00409{"flow_id":47,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1038,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167693,"pkt_ts_usec":928244,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoAAFAAEAGDtDAqAFny82eIqtLAbsShiV+Tv6yylAQAOWcHAAA"}
00410{"flow_id":47,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1039,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167694,"pkt_ts_usec":228698,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAo4WxAADEGO8TLzZ4iwKgBZwG7q0tO\/rLKEoYlf1AQAHOcjQAA"}
00412{"flow_id":30,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1042,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":144163,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoPV8AAAECRK7AqAFk4AAAFpQEAAAiAOwAAAAAAQIAAADv\/\/\/9"}
00411{"flow_id":47,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1043,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":236955,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoAAJAAEAGDs\/AqAFny82eIqtLAbsShiV\/Tv6yylARAOWcGgAA"}
00426{"flow_id":44,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1044,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":237043,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0VUpAAEAGv\/rAqAFny82XotNiAbsbK4cf8lL5uoARAOVfYAAAAQEICgAyCCdF8j82"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1045,"source":"wechat.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1492167695237,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54117,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1045,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":237173,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8M9xAAEAG4WDAqAFny82XotNlAbtEgzv7AAAAAKACchBSeAAAAgQFtAQCCAoAMggnAAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1046,"source":"wechat.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1492167695488,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54118,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1046,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":488485,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8xuRAAEAGTljAqAFny82XotNmAbsIrs6CAAAAAKACchD7hQAAAgQFtAQCCAoAMghmAAAAAAEDAwc="}
00418{"flow_id":47,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":535847,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAo4W1AADEGO8PLzZ4iwKgBZwG7q0tO\/rLKEoYlgFAQAHOcjAAAAAAICnRO"}
00410{"flow_id":47,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":538677,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"eJKcD6iO8IQvSpdgCABFoAAo4W5AADEGO8LLzZ4iwKgBZwG7q0tO\/rLKEoYlgFARAHOciwAA"}
00409{"flow_id":47,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":538744,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"8IQvSpdgeJKcD6iOCABFAAAoK+RAAEAG4uzAqAFny82eIqtLAbsShiWATv6yy1AQAOWcGQAA"}
00427{"flow_id":44,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1050,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":550159,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0ZdRAACwGwtDLzZeiwKgBZwG702LyUvm6GyuHIIAQAHA\/GwAAAQEICkXyX\/AAMggn"}
00439{"flow_id":53,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1051,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":562421,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAACwGKJ3LzZeiwKgBZwG702WgJJlmRIM7\/KASN8ga\/wAAAgQFoAQCCApF0vJmADIIJwEDAwc="}
00425{"flow_id":53,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1052,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":562496,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0M91AAEAG4WfAqAFny82XotNlAbtEgzv8oCSZZ4AQAOWASQAAAQEICgAyCHhF0vJm"}
00750{"flow_id":53,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1053,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":562959,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiM95AAEAG4HjAqAFny82XotNlAbtEgzv8oCSZZ4AYAOVrOQAAAQEICgAyCHhF0vJmFgMBAOkBAADlAwO2WFDDl4dFyeBPNOhybUjd72FmGP\/nu4brBDO9flonhCBYxgzAaMyfJOk08sA4g8dg3UnK03IZIzAXShNAci3a7gAgurrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8WloAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIWloAHQAXABjKygABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1053,"source":"wechat.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":4,"flow_first_seen":1492167695237,"flow_last_seen":1492167695562,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54117,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00437{"flow_id":54,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1054,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":854360,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG702aaLHzgCK7Og6ASN8jmSwAAAgQFoAQCCApF0vKlADIIZgEDAwc="}
00426{"flow_id":54,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1055,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":854441,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0xuVAAEAGTl\/AqAFny82XotNmAbsIrs6Dmix84YAQAOVLjAAAAQEICgAyCMFF0vKl"}
00426{"flow_id":53,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1056,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":890423,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0a99AACwGvMXLzZeiwKgBZwG702WgJJlnRIM86oAQAHh\/dgAAAQEICkXS8rgAMgh4"}
02347{"flow_id":53,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1057,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":891120,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIa+BAACwGtzDLzZeiwKgBZwG702WgJJlnRIM86oAQAHjJKwAAAQEICkXS8rgAMgh4FgMDAF0CAABZAwO6Hvtdy1\/xZryZSrWnJv06Ixk4sze\/ipN5ogdELbGC3iBB4xlOjKoTkDpNNo30AWaSGj1BD\/4+Gt6DSefvkE2ybsAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1057,"source":"wechat.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":6,"flow_first_seen":1492167695237,"flow_last_seen":1492167695891,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54117,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":53,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1058,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":891176,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0M99AAEAG4WXAqAFny82XotNlAbtEgzzqoCSe+4AQAPt5DQAAAQEICgAyCMpF0vK4"}
02348{"flow_id":53,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1059,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":891511,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIa+FAACwGty\/LzZeiwKgBZwG702WgJJ77RIM86oAQAHgdSAAAAQEICkXS8rgAMgh4i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQTMALnjv1CI6dBqvm930IlFUe3V\/C8wCW3NB6ws6lDWgHVgrshZhXCAMYPCMyJtdsp2YHi0bz5SBcOeD1cncQgGBgEBAENJNkXx"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1059,"source":"wechat.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":8,"flow_first_seen":1492167695237,"flow_last_seen":1492167695891,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54117,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":53,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1060,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":891546,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0M+BAAEAG4WTAqAFny82XotNlAbtEgzzqoCSkj4AQARFzYwAAAQEICgAyCMpF0vK4"}
00780{"flow_id":53,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1061,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":895453,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4a+JAACwGu77LzZeiwKgBZwG702WgJKSPRIM86oAYAHhcPQAAAQEICkXS8rgAMgh4feQ6Vcn0UE6BcmemkY6Ordo0430PoDtYVX9m6GwDXwkGzaCOO2Gzbe4AwIrm62nAnuTE0S0voJRb7aKqAgjP3p20svZQfNzYyqAci9GDPKgj6zdQkU51O8\/dfE410rNl7B2DD6nwoBi9mJo0U2mlSGP4kHtBEoFl3dnNfLcipodIHbabyhDLbGkhT6vE3WjRsC38RgUnNMeSNBOR5BO6f5ONA9GXgx3RvvLzkVjT+V6c5IkzPwEFJtFgrffgtkUHmH7X2clDFKlVH0201b\/mjk2ldCjJRZ4mmIdDtsDPLQTJf\/aTjZzq7n3WznPbQKGOe0TnPxbVHWxTFJwWAwMABA4AAAA="}
00426{"flow_id":53,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1062,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":895490,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0M+FAAEAG4WPAqAFny82XotNlAbtEgzzqoCSlk4AQAShyRwAAAQEICgAyCMtF0vK4"}
00597{"flow_id":53,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1063,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167695,"pkt_ts_usec":898151,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyM+JAAEAG4OTAqAFny82XotNlAbtEgzzqoCSlk4AYASjrZwAAAQEICgAyCMxF0vK4FgMDAEYQAABCQQSgcQkhpYBqxsWEPHktP0k8izPTqUSj9ROt3P17Sb4OurP3igt7AufsSwowITXBD8by7tEbKHMCkKg7GYIewnsOFAMDAAEBFgMDACgAAAAAAAAAANVXHcZh1PNP4Ws7cUlEUzBicQuIF4rr96Z6Ktw582DW"}
00496{"flow_id":53,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1064,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167696,"pkt_ts_usec":221356,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABna+NAACwGvI7LzZeiwKgBZwG702WgJKWTRIM9aIAYAHj3SwAAAQEICkXS8wsAMgjMFAMDAAEBFgMDAChJm4P16SeP6FgI3Hv4durktyyM51LBC+292O9xkavh1ZNN3Ku3a02s"}
02019{"flow_id":53,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1065,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167696,"pkt_ts_usec":222771,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATEM+NAAEAG3NHAqAFny82XotNlAbtEgz1ooCSlxoAYASjgUgAAAQEICgAyCR1F0vMLFwMDBIsAAAAAAAAAAd4YiuA6crhZEh9MHzL226\/uM4VKhthOyB3b35BkJStiV0vrwfgwOH2DF8uDE1W3vjnO8+sv+13JDkzXGfCsoRqE4+7jbAcSkl7soie42gPgtn1HRNFpueSKfCc0QLgo2CXeITV3LyUyp7YNiZhviF3UM1z66gWzS9KvElQ409EAxHiVua\/KZA8zrPUKpcLPvo\/EsSAzOaaKuIoNhGnPDNKZ1aoyOZ7Py5RP6e1kEIVU0zGW\/rKsKRPJEESL5737sZYfUqLJEsSQdm\/c1xkLZCVRgTnug43R64U3cpo4qlCz8Qyr+G4d1aP8fe\/CZGgIFm+9LqCLd1fauc3UJbHMRFcXgOk3zjEv9AVAn3rg1MntS+wy80PA\/vD6Z8r0ky3MElH1nVYUMPoHHKkAyNKcGDCXNQUW8jn6faYa0p1Br1krM+aaL4rSJ7W5RVOKFhS4XYwjaTVuzMf1jPujRDwEx9hIyqSiyxzpoEEEapvP2IPqnKqmEvIsbhsYI929bP\/mbFc81dkMJ\/EsH2+mZUb116COm0V0znIYPYr9bJ3ML4pIUurDs3FNGBw2u7L5jYxhrcqLQAATjWHNFJPY5IdOsDdCdVebEb6GB3BmBK7zp\/uqEeNv3Xx+ku9Qb\/WpyVsYAhMv4CDiJlZ02tptP+3E8CVZPOpkWrmh7LN\/bTL5RegkGt5XHQVzOstwCwgGFN0PAr4iFYb\/7GiXspbD8zQ6erLVU\/DchF7QnDZga1WCEMU28zn1HoyFeQxfBNJQ9GcJk\/oc\/q3sDo7Ho1mRFOXqZRzASPJF3RVYSn7cLEp1Hg9VdgJbBPIeU7G6CWa2xUTEV8oDnyUuUskL37nb4jcHUS9J2W5ncKhGLJ34BTeH3KXJ1Ne19trufVL+XBQAWwvTEktEF\/OUV33b1rv1FrGttH8YUZerR7TkvDHTnwWzxKvi6s\/UgXuPYWA4ghhsRwPay+WVssmWglpa4mC7dkldqdVuWXw7F0WE2wRyNdVdZhTfTBMOW6CjeBIGI1k1NQYRZKYUzrsFFBjqAAC7js4clBsz0qOociEExNQ8OlcNObgoX59bCsasMSowWoBXTPtZi7n6WOyF6tNF9wWLJe3nB9UJX6KsLttq7TgUSkxcOGEEnoNzHb3I1Uhzdwnjtpg1aTCbiREcfY\/Ry36qVYIC8seoVwUlflPH5IKmhutuqaFj85\/GRruZFZ+4WjX1gNi+HPrspys757qyol4e5GRM5kNZ8rF4pppGxtlKYwx\/CB1TgNDStDPKBj6iBhXZJD42vO4e\/h\/QUIFFo2RFRQZfv67ix4fJMWhQdQNCXSolQNWx47IAWiYKyOSHUwNTgQIUaDFkmVGXOElFE9xQmcvqTGqMmUKs\/Ht4C3WEQ14MTv\/c48C1v8BOtf9bTBeDHJSP9ir\/Cfo6MVjQTgKtFhs\/ajHutVnNaFC4NOphiE6Wr3n08LWew9+HFiohXV+BTqJIPlwFmKGSR+BwAG5MeX+Tr3MLR1rGGcsyTBVoiPlLhqRyQ+YLNF4lntqH3g9Lp6sD7FnNrg=="}
01074{"flow_id":53,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1066,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167696,"pkt_ts_usec":225954,"pkt_caplen":538,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":538,"pkt_l4_len":504,"pkt":"8IQvSpdgeJKcD6iOCABFAAIMM+RAAEAG34jAqAFny82XotNlAbtEg0H4oCSlxoAYASibSwAAAQEICgAyCR5F0vMLFwMDAdMAAAAAAAAAArkrV1zvitrGB2a5vw5h\/Hh+6TUs5RVQeU\/lAG7a2Wg7ivQTK0IHIg+J6PYWMbVhDsZ4xTGj\/eMsgHf2kpk8kkpsjG7D4G1UeznkANmSdGAdnEYUkS4kabsCiM6Rn9TtFDcDgDINT8agOdLN3ZNaNxk2kiZehiZGeMt8r1wA4NBhc2FOoJcrQM4VcBxTZxFhll6\/ualLRPFfSeBGhMhEc6pmUxBbmEv2sn61jIeVfE0B7siQCPnobB\/a1N0tPZWhc1NXjzzbhndL704pAA0k+NgIIxtLv592YQvcQC5IxR5Tih7LDulgYfvOWRL\/HGiIB+etm+NQxFEPpMfNzFtcv8u2Y\/HX5rI6lyYIo6WYp5W9z8+FPDsD8T5b\/H8LL0Zgi5FTWHleM9BWDJDawaQisaJXZMGXE\/UYkIXBi6G\/v22J5OAxIhLJoDId9i8YF8osxyGK6SHyWVjwYrwwv95uvJcVT\/1kIbYms8nJp7FrD0aegg3\/QXFhqiAnypstQgF0FY6FWA1sDuWA+4xFEinfVchp\/3GZU8myHYOrRNz8yB9md2NWiBHJfya94KGyzU6OrexCFmcpBEuH4pug3YCbLQA6kEXQ9xzfbCm7Lw=="}
00751{"flow_id":54,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1070,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167696,"pkt_ts_usec":636507,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEixuZAAEAGTXDAqAFny82XotNmAbsIrs6Dmix84YAYAOUVZQAAAQEICgAyCYVF0vKlFgMBAOkBAADlAwMlUfNTDYjhvRdeF23CS9txxbOTIA6V\/rqxhzXUPkoC0SBB4xlOjKoTkDpNNo30AWaSGj1BD\/4+Gt6DSefvkE2ybgAgKirMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8+voAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIWloAHQAXABhaWgABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1070,"source":"wechat.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":4,"flow_first_seen":1492167695488,"flow_last_seen":1492167696636,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54118,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00423{"flow_id":54,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1075,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":2676,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0jyRAAC0GmIDLzZeiwKgBZwG702aaLHzhCK7PcYAQAHhJJwAAAQEICkXS88UAMgmF"}
02343{"flow_id":54,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1077,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":5590,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIjyVAAC0GkuvLzZeiwKgBZwG702aaLHzhCK7PcYAQAHi76gAAAQEICkXS88UAMgmFFgMDAF0CAABZAwPwWVmlXoWMDzfeHC3LUIazLTAckz4lU+GUmYVSYaKh6iAVSEeMY2IvjCMgDjKK8SiyT+W1aOjnLn\/Q4fRxYvFJEsAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1077,"source":"wechat.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":6,"flow_first_seen":1492167695488,"flow_last_seen":1492167697005,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54118,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00423{"flow_id":54,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1078,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":5638,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0xudAAEAGTl3AqAFny82XotNmAbsIrs9xmiyCdYAQAPtCtAAAAQEICgAyCeFF0vPF"}
02346{"flow_id":54,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1079,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":6161,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIjyZAAC0GkurLzZeiwKgBZwG702aaLIJ1CK7PcYAQAHiMGwAAAQEICkXS88UAMgmFi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQwesuQP\/R5JUXKknaWveOWxsm4rrj+cJNNS5JRVNd0UdVSwSWTMdhCeKFK875+pX7PD7VQQRRx\/iPjIChftbhrBgEBAB+tPhP6"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1079,"source":"wechat.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":8,"flow_first_seen":1492167695488,"flow_last_seen":1492167697006,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54118,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00423{"flow_id":54,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1080,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":6203,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0xuhAAEAGTlzAqAFny82XotNmAbsIrs9xmiyICYAQARE9CgAAAQEICgAyCeFF0vPF"}
00781{"flow_id":54,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1081,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":7058,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4jydAAC0Gl3nLzZeiwKgBZwG702aaLIgJCK7PcYAYAHhBRAAAAQEICkXS88UAMgmFoaiGCpS8oOjYacuydkQHgtPbP3DyrCSx4AGIoU3SQ6w6IlQLXR0jRvKahfxAvfRWK4NS0Ud2bL\/NEmEXTmcgYJtVpdEEZ51CAdmCnjdG5uJ1io+QU7gh0ieRKl0oDcMLrFtpE76p373nVzBc+KAsPd0s1oTigooRcerywIagM\/X4e2qLIZotZ7PkDFvtdRlU5qU+VC\/opMNw23\/weduPQHLssSRe9AcC5CbkN7\/nJMVWUhmp5xJ9EwyLnKx0P1muAOMxhsWDKq3MatVtiLYKjr3EcpIUBHqpmvyfA5M\/azGCndkdBUn+QYSjYkP7wL71mSayS2cuuL7yVrEWAwMABA4AAAA="}
00424{"flow_id":54,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1082,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":7106,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0xulAAEAGTlvAqAFny82XotNmAbsIrs9xmiyJDYAQASg77wAAAQEICgAyCeFF0vPF"}
00598{"flow_id":54,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1083,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":9689,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyxupAAEAGTdzAqAFny82XotNmAbsIrs9xmiyJDYAYASiq3gAAAQEICgAyCeJF0vPFFgMDAEYQAABCQQS8+ivPYczW5+rJfLWUbP9rYqvXhfuC\/MWdEmcduZ5+9OMejhS0CyUEgMZsROleG8h7Nz3jzyX4sLzYdOP9rh\/7FAMDAAEBFgMDACgAAAAAAAAAAKPW9XXS+swNXytRtShV\/jCFnWvlpb2CiYLduqAyR2n3"}
00499{"flow_id":54,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1087,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":374064,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnjyhAAC0GmEnLzZeiwKgBZwG702aaLIkNCK7P74AYAHhaPQAAAQEICkXS9CEAMgniFAMDAAEBFgMDAChGxQBTa4I\/dQQi68l11IGtmusE372V+0\/B329iOZuMQCrZ\/RynVkvv"}
00437{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1088,"source":"wechat.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1492167697384,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00409{"flow_id":55,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1088,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":384234,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAWeJKcD6iOCABGwAAoAABAAAECQerAqAFn4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00469{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1088,"source":"wechat.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1492167697384,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00427{"flow_id":54,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1089,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167697,"pkt_ts_usec":412244,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0xutAAEAGTlnAqAFny82XotNmAbsIrs\/vmiyJQIAQASg6fAAAAQEICgAyCkdF0vQh"}
00438{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1090,"source":"wechat.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1492167697384,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00437{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1090,"source":"wechat.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1492167690433,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1090,"source":"wechat.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":26,"flow_first_seen":1492167617248,"flow_last_seen":1492167640200,"flow_tot_l4_data_len":8877,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":341,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54111,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1090,"source":"wechat.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":9,"flow_first_seen":1492167617498,"flow_last_seen":1492167640214,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54112,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1090,"source":"wechat.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":9,"flow_first_seen":1492167617498,"flow_last_seen":1492167640214,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54112,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":12,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1110,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167712,"pkt_ts_usec":488239,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePlAAEAGFxbAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO0cXQAAAQEICgAyGQCFokCr"}
00426{"flow_id":12,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1111,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167712,"pkt_ts_usec":557412,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0fTIAACsGZz1A6ae8wKgBZxRsjLFKrVv6utDMqYAQAWXTwgAAAQEICoWi8KsAL7Ej"}
00426{"flow_id":54,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1120,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167717,"pkt_ts_usec":375812,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0jylAAC0GmHvLzZeiwKgBZwG702aaLIlACK7P74ARAHgnogAAAQEICkXTB6oAMgpH"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1127,"source":"wechat.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1492167720101,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54119,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":56,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1127,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":101930,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8R8JAAEAGzXrAqAFny82XotNnAbsR+WetAAAAAKACchBBBgAAAgQFtAQCCAoAMiBvAAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1128,"source":"wechat.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":1,"flow_first_seen":1492167720353,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54120,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":57,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1128,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":353253,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8TqBAAEAGxpzAqAFny82XotNoAbuP9m4OAAAAAKACchC8ZwAAAgQFtAQCCAoAMiCuAAAAAAEDAwc="}
00437{"flow_id":56,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1131,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":458117,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG702cUBmdaEflnrqASN8gU+wAAAgQFoAQCCApFrqVHADIgbwEDAwc="}
00425{"flow_id":56,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1132,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":458175,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8NAAEAGzYHAqAFny82XotNnAbsR+WeuFAZnW4AQAOV6PQAAAQEICgAyIMhFrqVH"}
00752{"flow_id":56,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1133,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":458584,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiR8RAAEAGzJLAqAFny82XotNnAbsR+WeuFAZnW4AYAOXtRgAAAQEICgAyIMhFrqVHFgMBAOkBAADlAwO4FYiIFcG2NJgznPgifBfdh+y\/SP3z7w7BFwt\/H9iuDCAVSEeMY2IvjCMgDjKK8SiyT+W1aOjnLn\/Q4fRxYvFJEgAgurrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8iooAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIGhoAHQAXABiamgABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1133,"source":"wechat.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":4,"flow_first_seen":1492167720101,"flow_last_seen":1492167720458,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54119,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00438{"flow_id":57,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1135,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":700672,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG702hvZooej\/ZuD6ASN8iscAAAAgQFoAQCCApF0wrqADIgrgEDAwc="}
00425{"flow_id":57,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1136,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":700737,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0TqFAAEAGxqPAqAFny82XotNoAbuP9m4Pb2aKH4AQAOURtQAAAQEICgAyIQVF0wrq"}
00425{"flow_id":56,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1137,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":811434,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0wsRAAC0GZODLzZeiwKgBZwG702cUBmdbEflonIAQAHh5ZAAAAQEICkWupZ8AMiDI"}
02346{"flow_id":56,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1138,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":812106,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIwsVAAC0GX0vLzZeiwKgBZwG702cUBmdbEflonIAQAHjRMAAAAQEICkWupaAAMiDIFgMDAF0CAABZAwPzDOTXC6KtCwmAH31DtzK9aym9BCB5iswExo8YrNMyqCBgvGDUb62G4Do9NReMfS8YxaGk\/NAEyDLFergV\/vcvscAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1138,"source":"wechat.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":6,"flow_first_seen":1492167720101,"flow_last_seen":1492167720812,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54119,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00426{"flow_id":56,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1139,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":812140,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8VAAEAGzX\/AqAFny82XotNnAbsR+WicFAZs74AQAPty9AAAAQEICgAyISBFrqWg"}
02347{"flow_id":56,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1140,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":812783,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIwsZAAC0GX0rLzZeiwKgBZwG702cUBmzvEflonIAQAHiUmAAAAQEICkWupaAAMiDIi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQkTF+sAw\/uxWrVpMX6NHO5xk6RN7KKbfl+6q8GwdCCYJ7vQtUdziuDO8rZMmVw2WVREYHbirJRTh13oX98fb4SBgEBAEtPLmCv"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1140,"source":"wechat.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":8,"flow_first_seen":1492167720101,"flow_last_seen":1492167720812,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54119,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":56,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1141,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":812808,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8ZAAEAGzX7AqAFny82XotNnAbsR+WicFAZyg4AQARFtSQAAAQEICgAyISFFrqWg"}
00779{"flow_id":56,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1142,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":813116,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4wsdAAC0GY9nLzZeiwKgBZwG702cUBnKDEflonIAYAHiyYQAAAQEICkWupaAAMiDIXbQxaJ2fFnFfbCcl3eWZA4KQcgYqei0zO7LNcQCdFQyLb01pe0mx1YK\/OdasYs2XXJ6FWYhWMzVI4hoUfrese2MaWRGjf0auoZW9P1BkH8gvLIQ7wG0+NaEJiXPpbQm8PF9CV52kt9qDZ3ZzwwkqqIdndfc86RSeO9gYopVBeEpUmxKXfYXBHQcJZejVDsQhyQhPUlehGUJfqUlmEnnt9CChBsB6XTIMbTmf\/+aSo686TrrM6SnHTTuGo2lCeoJwHuf2uuAhIPpSTwgonOuqQg76fZkP6iQuUsERZbLFTyX60WdV2sl7tzCfCxqE1hLc+6Yfy3GGkZSc2ioWAwMABA4AAAA="}
00426{"flow_id":56,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1143,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":813142,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8dAAEAGzX3AqAFny82XotNnAbsR+WicFAZzh4AQAShsLgAAAQEICgAyISFFrqWg"}
00599{"flow_id":56,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1144,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167720,"pkt_ts_usec":815532,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyR8hAAEAGzP7AqAFny82XotNnAbsR+WicFAZzh4AYASj2kwAAAQEICgAyISFFrqWgFgMDAEYQAABCQQQMBT429+T3gJw\/GUNezVyChj+c1x+DtajLaHHg9em79qmtUtJQ6em1QCrHiT9yqRq4lfQrJBrb6CRpF0BS0WfUFAMDAAEBFgMDACgAAAAAAAAAAEHorowN4PW3Vw9i7\/bEAIswMK3LX39IRH+UpA1+UKb8"}
00496{"flow_id":56,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1145,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167721,"pkt_ts_usec":178683,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnwshAAC0GZKnLzZeiwKgBZwG702cUBnOHEflpGoAYAHiJEAAAAQEICkWupfsAMiEhFAMDAAEBFgMDACjUSe3W9MPyIyQY8HS96Nr4xBVh+YPRTs9WGTp33NcYdV0Q8ABXyzio"}
02113{"flow_id":56,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1146,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167721,"pkt_ts_usec":180006,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMR8lAAEAGyKPAqAFny82XotNnAbsR+WkaFAZzuoAYASiXPQAAAQEICgAyIXxFrqX7FwMDBNMAAAAAAAAAAcddmFtL9s8aHhZ1QRj6q+EieTKnw\/oKGvdRzTouO+r2faahjix5EtI4tgzmV50yCJRXSKM\/lvhwFP1BLB38bpucmiJZvl3P66tr3r5XRfwvfX2umLXhuw4L6MEh1bMT2UKn6zSaO5f4Sd13xvbwyyp0luvNUKLScYKfsZ9JkElHc8Bo7lnmYgaTzh8DZBNwV6F4SBRNlZF8AmJneJAvi0Hip40BhgY\/MUGsVRyubnFFZVs49Hm4hrsZc69+mCCOKRwHoHHvdeqf3a32azqjyAhMELNokr9EgAoAcEtQS9mieHRF1Qax75dJbjS07hLnlygZU\/gNvLbKbd66mvczq4WzL+sHKaUhD2ui\/HZKNXua9CGa3eYvfXDHKPgYKp3FhfEz5HIp6aV8tADNM78QWeijawyvDy72jRVOUwc\/AbjoRvgc7PLCShdNm4C4M4FRTC6gpGMoTQQ4Hn5nV4mXnoO41SGPwZM7heqN\/RygoJSwO\/ejVr5IfwDfOXUbIVClDxKL5wDpRGYn17BlOJ9yX6Wiwi+jK9Hn47Oz8VqZ4gMtazqFbKwjaMeTM1jKQ6ecEyIXMqjdS+2oTqywN8JKWrZEAaJhIVeKEUhj7vrhcxt4ifseFKMgd9DsYo5eN8jp+r04c1vlVOGX41Eox4ZRn0\/LtdbBkflponxlb1NRWHudRb7iPJ50Yq6X5Brd64dYwcNkDcj2P1vkft57SDQXg4YJsptxvn1DwCHwTzBv41TDs0eT3mghv2PLceiam4QrsE+eVZyBDep8U496q2aRyANnXAB07e25CorTXMPecOQjaCPDfTyyuRGM4ABQpyXWLAtl01QUg+2v8iximZZ13Q4+vVzlnSKAjsSLhGmRLWcLQgt7mXaroGtKuRqvcfemQQneJ\/PQXOtxVDSOZq3t+ncFUFwVv8cKt6E482cN9c9lO6L7W2wfOBsqjLqIhTeLeU+ICSSwQNo\/+xgDnUedBRYqbieKjzKD7PZX5WMDpWdf7SIgDa\/1B7APKi1NHqkxjEOrMsOVk\/6uvK02pwswzrfe9HuI620qNjhDKSNOp79kIiDDYggzBaaADhQF1\/5On4STrraXeRqd5\/f29nO2o4bnUSzPPDZojB+27WpzKwH6DVBccSoxm5gvGZHmaCWB+XrLsgMuX6gHwxc3BnnOwGKrnBTNkLcW\/BECVb2tc4y+T8qKPHof5NsY7KbQ1vQaga7U\/3sZUsR7XMlUA9QzxgY0LMH4I8O3LIz9ZgcmY9byYqICy+BkrvvONj3CVVilHOzV0NMvMvatT1U165+x1X4PD2EMnVbStQRl0oIP4Jrl8cCxm+Ay7hnq3syGPMmw99Cpr\/UhJ8dcC8GD1\/L62OghUxlT\/pWZgvRJ5U7zB6CVXF2\/0SAJEA0X9ZMOPlsZQkUq1ybPOMHAeUyViUZI13fMta2IYTK3cpVFqr9uT+GRRE+hHOMjnABdhndlTcemQJRow7T5YKl3kChfD+t\/YMx15asUrPvn17UimieqR3l\/xzmkhIceaVByZ\/8cH4b8UZiGilGZjU3BRBZsh5mSnEkSDtwkrtg6UmdndENLsop4\/x1cZntmyI1Qs3SHolCZK2ZUZi8sy2G68rThIDuD8BiLmS7XoV0VrUoDwg=="}
01075{"flow_id":56,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1147,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167721,"pkt_ts_usec":185603,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPR8pAAEAGy5\/AqAFny82XotNnAbsR+W3yFAZzuoAYASjW8QAAAQEICgAyIX5FrqX7FwMDAdYAAAAAAAAAAmll4Z\/nAI5PtOkc+WmgTBFLWxMTDcMnrIR3FvSDg7qQtfcoUVUZ7eqfkgkX6mJrPSwQTYKMhd0In7w0gRme3wT0RFhsn7udpy\/Owt+2L6HKVLW3qHVilPAQxOuPMpKUiZSjhZmOUoZ3rp6UDZp7nUN7EzZJiWko1D91A443wUOzwadSAOJ4eZmCSzH9OkY+oX5ZY2haLm6X\/\/2mluiyHJTvC+hXrFP2A\/t0Z1S+RfU1QMpajaJwNIiiylBU9czWpoa4\/YoZ3Kn+yLlZR+9thY2kk05ZEwFctYiKsyUROThi41BXlOyBExCuuBNqBja2FuI6K7riDQ93kclHglPLfthZrYjFDWZTlu+qx8BikkByw\/UKKsvj6HYnYOrygQWOBCEqXdcTxU7z43wKd4dweM3S397DssjUxyuwBEVVkf2QouvTKQiQxhxXL\/7DOShwNsiQX3SGy0fBlrUZRKNxc\/OtnJObu9LAMUlPLHiOySyDHmztEPoXcbwz+2qGk1Z3twNHzs9sYyhrP2IhW1JS4iyDBlTVudFXwkkU+tei8bPskG+7FEf+uMq1Ol2XyFPoS9bkrbQJKdB4WSr0fJrrWuOpUnyIEXlMpLKwK3HAvg=="}
00752{"flow_id":57,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1159,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":10515,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiTqJAAEAGxbTAqAFny82XotNoAbuP9m4Pb2aKH4AYAOXLQgAAAQEICgAyIkxF0wrqFgMBAOkBAADlAwPB\/pJ6BvhHBq\/4TId1UjdeYYD0wwj82jOL+qyjL+5dzCBgvGDUb62G4Do9NReMfS8YxaGk\/NAEyDLFergV\/vcvsQAgysrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8mpoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI+voAHQAXABh6egABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1159,"source":"wechat.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":4,"flow_first_seen":1492167720353,"flow_last_seen":1492167722010,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54120,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00437{"flow_id":57,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1163,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":70985,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC0GJ53LzZeiwKgBZwG702hvZooej\/ZuD6ASN8iqwgAAAgQFoAQCCApF0wxBADIhBQEDAwc="}
00424{"flow_id":57,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1164,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":71030,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0TqNAAEAGxqHAqAFny82XotNoAbuP9m79b2aKH4AQAOUPcQAAAQEICgAyIltF0wrq"}
00428{"flow_id":57,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1165,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":363463,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0hpVAAC0GoQ\/LzZeiwKgBZwG702hvZoofj\/Zu\/YAQAHgOTQAAAQEICkXTDIoAMiJM"}
02348{"flow_id":57,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1166,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":364483,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIhpZAAC0Gm3rLzZeiwKgBZwG702hvZoofj\/Zu\/YAQAHiTcAAAAQEICkXTDIoAMiJMFgMDAF0CAABZAwMLb\/bjahqipXDIAq7z\/zsCBoMKS82TWpulAU+Vb+o17yCLvNA70NWnnOkivxA3NtxTObgLtgPDGlVnUKXVA0Y5mcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1166,"source":"wechat.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":8,"flow_first_seen":1492167720353,"flow_last_seen":1492167722364,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54120,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":57,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1167,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":364537,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0TqRAAEAGxqDAqAFny82XotNoAbuP9m79b2aPs4AQAPsH3QAAAQEICgAyIqVF0wyK"}
02705{"flow_id":57,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1168,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":365024,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMhpdAAC0GmnXLzZeiwKgBZwG702hvZo+zj\/Zu\/YAYAHgsPgAAAQEICkXTDIoAMiJMi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRtFBJY2kTMiaaZFBuHN1c\/TNaqoxPpEk+Ku1B1KEIVp9iiNYDhXExDe\/OLl+n7vutXvft2uLIvAiGvAgswYqAWBgEBADySyo4fGlLduZomBkniwg2borttFJi0Oi8px0PnsWBARwmabT+FwpxGJ0A+ZahbBQMood1nI\/TB8n2CdmrmnL1Bk5F0S96\/wFegDfXCO8EsRKN4ZgeMWZfYsmVTCGxUHcNIhokgWfF675hNEqEB6Eqgl2XcR5+G564QhbW4oXb2QKjvGyinK1o4uXi+ED\/8gdfzUnO+YVe\/Mx0VLJ8Uvda3+x89Lbatfrmy1IoZVmz\/pSi1PF86Y1Xk19VU7egMTrW1k2mM1+E14GZuenX5NuFicscWj5HXhMlWuYpslHC5T\/B3H0EU6qKFDZ4rWzkEC9XEEh6++1mL6ne6wdgz+h4WAwMABA4AAAA="}
01314{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1168,"source":"wechat.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":10,"flow_first_seen":1492167720353,"flow_last_seen":1492167722365,"flow_tot_l4_data_len":3698,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54120,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00427{"flow_id":57,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1169,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":365067,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0TqVAAEAGxp\/AqAFny82XotNoAbuP9m79b2aWS4AQARUBKwAAAQEICgAyIqVF0wyK"}
00599{"flow_id":57,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1170,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":367752,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyTqZAAEAGxiDAqAFny82XotNoAbuP9m79b2aWS4AYARX9lQAAAQEICgAyIqVF0wyKFgMDAEYQAABCQQSh+pnFGxxwzvrDsA0C+\/OV0hT8QxymxVSdVOzIK8Ts7xEtLYwEBepfGTQ4O02ZU78gXkUfB2wRx9JbEX7l0swBFAMDAAEBFgMDACgAAAAAAAAAAG4Yn7256L3yejklVAHqL0q7mw3v5ZM4LG\/C12DTIoZs"}
00498{"flow_id":57,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1175,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":717710,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnhplAAC0GoNjLzZeiwKgBZwG702hvZpZLj\/Zve4AYAHhVfQAAAQEICkXTDOIAMiKlFAMDAAEBFgMDACg7VmUMZZIKzA5NcQ\/AxiIDUBx1HTnigQytG0dHQHqNZy6HR+dvlZb5"}
00427{"flow_id":57,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1176,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167722,"pkt_ts_usec":756211,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0TqdAAEAGxp3AqAFny82XotNoAbuP9m97b2aWfoAQARX\/vwAAAQEICgAyIwdF0wzi"}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1178,"source":"wechat.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":73,"flow_first_seen":1492167639887,"flow_last_seen":1492167667658,"flow_tot_l4_data_len":41563,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":569,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54113,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":57,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1198,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167742,"pkt_ts_usec":718478,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0hppAAC0GoQrLzZeiwKgBZwG702hvZpZ+j\/Zve4ARAHjs0wAAAQEICkXTIGoAMiMH"}
00510{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1216,"source":"wechat.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":9,"flow_first_seen":1492167648494,"flow_last_seen":1492167695538,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43851,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}}
00490{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1216,"source":"wechat.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":9,"flow_first_seen":1492167648494,"flow_last_seen":1492167695538,"flow_tot_l4_data_len":212,"flow_min_l4_data_len":20,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43851,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1216,"source":"wechat.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":9,"flow_first_seen":1492167640138,"flow_last_seen":1492167695550,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54114,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1216,"source":"wechat.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":9,"flow_first_seen":1492167640138,"flow_last_seen":1492167695550,"flow_tot_l4_data_len":312,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54114,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":12,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1216,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167757,"pkt_ts_usec":556271,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePpAAEAGFxXAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO1AWQAAAQEICgAyRQOFovCr"}
00426{"flow_id":12,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1217,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167757,"pkt_ts_usec":610750,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA05AsAACsGAGRA6ae8wKgBZxRsjLFKrVv6utDMqYAQAWUjtgAAAQEICoWjoLcAL7Ej"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1218,"source":"wechat.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1492167765155,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60356,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":58,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":155968,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8EUFAAEARpLrAqAFnwKgB\/uvEADUAKLhvU\/MBAAABAAAAAAAAA3dlYgZ3ZWNoYXQDY29tAAABAAE="}
00633{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1218,"source":"wechat.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1492167765155,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60356,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00867{"flow_id":58,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1219,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":432548,"pkt_caplen":391,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":391,"pkt_l4_len":357,"pkt":"eJKcD6iO8IQvSpdgCABFoAF5AABAAEARtB7AqAH+wKgBZwA168QBZQj\/U\/OBgAABAAMABAALA3dlYgZ3ZWNoYXQDY29tAAABAAHADAAFAAEAAAJYAAcEd2ViMcAQwCwAAQABAAACWAAEy82Tq8AsAAEAAQAAAlgABMvNl6LALAACAAEAAU8CAA0HbnMtdGVsMQJxccAXwCwAAgABAAFPAgAKB25zLWNuYzHAZ8AsAAIAAQABTwIACQZucy1vczHAZ8AsAAIAAQABTwIACgducy1jbW4xwGfAjgABAAEAAAFuAAS4ac55wI4AAQABAAABbgAEy82TmMCOAAEAAQAAAW4ABMvNsDrAjgABAAEAAAFuAARnBx7vwKMAAQABAAANPgAEtv5vZMCjAAEAAQAADT4ABLfoeDvAowABAAEAAA0+AAS2\/hBmwHgAAQABAAABmAAEb6Frw8B4AAEAAQAAAZgABG+haBHAXwABAAEAAAFuAAS2jLiMwF8AAQABAAABbgAEtwK6mQ=="}
00665{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1219,"source":"wechat.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1492167765155,"flow_last_seen":1492167765432,"flow_tot_l4_data_len":397,"flow_min_l4_data_len":40,"flow_max_l4_data_len":357,"flow_avg_l4_data_len":198,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60356,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"web.wechat.com","num_queries":1,"num_answers":18,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"203.205.147.171"}}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1220,"source":"wechat.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1492167765433,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":59,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1220,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":433146,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA88RZAAEAGKB3AqAFny82Tq+K0AbvYTb2iAAAAAKACchDtIAAAAgQFtAQCCAoAMky0AAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1221,"source":"wechat.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1492167765657,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58037,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":60,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1221,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":657286,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8ZwNAAEAGsjDAqAFny82Tq+K1Abs3CyvvAAAAAKACchAf3gAAAgQFtAQCCAoAMkzsAAAAAAEDAwc="}
00437{"flow_id":59,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1222,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":701156,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rSlk19z2E29o6ASN8g4AQAAAgQFoAQCCApF8qRxADJMtAEDAwc="}
00425{"flow_id":59,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1223,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":701236,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA08RdAAEAGKCTAqAFny82Tq+K0AbvYTb2jpZNfdIAQAOWdWQAAAQEICgAyTPdF8qRx"}
00750{"flow_id":59,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1224,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":701869,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEi8RhAAEAGJzXAqAFny82Tq+K0AbvYTb2jpZNfdIAYAOUfdwAAAQEICgAyTPdF8qRxFgMBAOkBAADlAwN2f14Oc5hAS77GsYiJJWuQsbu0wB7\/AFxtEPxKO0DQmSCLvNA70NWnnOkivxA3NtxTObgLtgPDGlVnUKXVA0Y5mQAgenrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8WloAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIenoAHQAXABgKCgABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1224,"source":"wechat.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":4,"flow_first_seen":1492167765433,"flow_last_seen":1492167765701,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58036,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00437{"flow_id":60,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1225,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":933685,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rU+QocNNwsr8KASN8h9cwAAAgQFoAQCCApFrtG3ADJM7AEDAwc="}
00425{"flow_id":60,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1226,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":933797,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZwRAAEAGsjfAqAFny82Tq+K1Abs3CyvwPkKHDoAQAOXiyQAAAQEICgAyTTFFrtG3"}
00425{"flow_id":59,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1227,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":972098,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0+8BAAC8GLdvLzZOrwKgBZwG74rSlk1902E2+kYAQAHiclQAAAQEICkXypLQAMkz3"}
02346{"flow_id":59,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1228,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":976298,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI+8FAAC8GKEbLzZOrwKgBZwG74rSlk1902E2+kYAQAHibjQAAAQEICkXypLYAMkz3FgMDAF0CAABZAwOdxUs6xI9qr\/nfcp+Skd122UOXK9okRp5CiHhQWbutICBDtbBAnWnGygM6P1AG0j+Q0vm5\/VvsmvPTT+HjfnB2iMAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1228,"source":"wechat.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":6,"flow_first_seen":1492167765433,"flow_last_seen":1492167765976,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58036,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":59,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1229,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":976336,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA08RlAAEAGKCLAqAFny82Tq+K0AbvYTb6RpZNlCIAQAPuWNwAAAQEICgAyTTxF8qS2"}
02350{"flow_id":59,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1230,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":976846,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI+8JAAC8GKEXLzZOrwKgBZwG74rSlk2UI2E2+kYAQAHjMCAAAAQEICkXypLYAMkz3i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQOPn8DbeEidIQj32f9HhBMwbyWUdcDE+\/3Vi5ux\/\/7BA5A6A6MIrjGmV8u5FKtYYwAhBykuyrmGYrHmGhNKH1NBgEBAH\/yIGov"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1230,"source":"wechat.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":8,"flow_first_seen":1492167765433,"flow_last_seen":1492167765976,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58036,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":59,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1231,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":976881,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA08RpAAEAGKCHAqAFny82Tq+K0AbvYTb6RpZNqnIAQARGQjQAAAQEICgAyTTxF8qS2"}
00783{"flow_id":59,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1232,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":977209,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4+8NAAC8GLNTLzZOrwKgBZwG74rSlk2qc2E2+kYAYAHjbvgAAAQEICkXypLYAMkz3vzSRAATJF5Ub4moHzwyV4aCffI9oBbi9oX6NyyE2mrm1ZVHbh8j6P4dLWkpBXUzFwjR\/MzxCp+3ICjlWJmYTDYpb3Ky+WlXnOxMeiY4zehdJIBH2kmIF+ZiWG+QuRxqRFpUrkavP\/MgD8MYFF+d0oAicK39skPTNThYTL3KePhO2ztkbZt+wRQNy6g3mY+SqpJkfhq+P7RpmlH\/TsEtt6r6jGE\/8Nj59DNjcU8X2RYCQgY9UdxUkK1sLN1YPrrRjDdK8znFnq4KtudJ4qF8IGzNnGJ7b5vhAkWZkfWWQx2\/aTR8DGFtAx87PcruS7\/4l7eDUnr4I+5QdhBwWAwMABA4AAAA="}
00426{"flow_id":59,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1233,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":977242,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA08RtAAEAGKCDAqAFny82Tq+K0AbvYTb6RpZNroIAQASiPcgAAAQEICgAyTTxF8qS2"}
00597{"flow_id":59,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1234,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167765,"pkt_ts_usec":979750,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACy8RxAAEAGJ6HAqAFny82Tq+K0AbvYTb6RpZNroIAYASjeiQAAAQEICgAyTTxF8qS2FgMDAEYQAABCQQQbsQkjZ8nG+G3tfEfZXtcxiAZo2Zo0eCMu9wEzcQaqEOnnj2+VEmdyNLCfd703CPi7AvTtbdyFi3QXIMp5pGKTFAMDAAEBFgMDACgAAAAAAAAAANGEg2RP21kloYbSnOD1PFyuJVViGOVwMG7ZUa3E4ebt"}
00499{"flow_id":59,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1235,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167766,"pkt_ts_usec":251707,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn+8RAAC8GLaTLzZOrwKgBZwG74rSlk2ug2E2\/D4AYAHizQwAAAQEICkXypPoAMk08FAMDAAEBFgMDAChUWQ8rRDGKDrrxdb27\/tlT8ba1TPAe6hFCARlxgjc9\/SlhAZI7L9++"}
02012{"flow_id":59,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1236,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167766,"pkt_ts_usec":252880,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATE8R1AAEAGI47AqAFny82Tq+K0AbvYTb8PpZNr04AYASgJiQAAAQEICgAyTYFF8qT6FwMDBIsAAAAAAAAAAWD6F2JuwOOjrhy6bMJh8\/+FPWeAY5\/yLrexu8no7mi4dAiwZSzTxZsiuoDsksmBElqJURh33xuaBFQFcKhVXo6Y96BnB4VCYP7yXcEz54+uMfdPjrmMlDXvgeEFH5ZvSwc5xC5uIWjJjSvdj8Ph1KKf\/Beok78B1kadAi\/1yPKvGxasVfkmdb7N4Ax1JtLZSGFgUzSB9cF09PSTQdhBI\/Rzrzc19JB\/qHP4D08\/XEBD22E2MUFFtGuPr+v6zfNwsNTs+QDBAulqFl1RuXIoRL7QtRzMz6DwMvcHwl42Jtwt99RNyojiyhIqjpHJGaQEkU7XD410J5sphE5a1wf145njMVjf2toY9Ws1HlEHFfxcobqVCPVHfTJuiz\/DPQogB8JyW2erQgZpW3ca9zwMnhxd7GQ7rRzd3aZ9FuK0xvlASJEVsVf66jagN6sVl7e\/m9kRjgTBiZg4++GCDQuYsaq2R2r7jZXita0qqi9j6Belj0S0+tGDFzTy4FSZCx+OMT4x+XMBo7xvmUbGQ0KfvblLDYrvw3TPKdlRIiyU1aK43DvIR7uzL4gx9QjYSvQdXDIkp7f2D4hJ9tjyJSt05JS1wDuU5TTz3UsfdF9+84CGzEVQ+LcpkHnkc7lK3tjepvvOZ+lK9RH3FbW2+FuiyVcO+kD7yKREpWT9qYw7ARThtnm9Vrtaz3XcomILd0Z2qJSZ5xxbcyctFoGbiUhEMaTc\/OEmW2vDeYOkI4rasI3NOwk0\/osaqvdyl0sYrkYbeqEnQSg1tWXGG8O8BiszZKzk0oGcDvRb8+Ln5QzVIa7WVbUttXK5RM8ZxFGIhyZZzAMkbstBFuhag4OhBzmbJqhw5UANBqa9fpEw6xArXSeNRulNpepWPCDetQOKMTHFU\/qQLZR2GpUEyiGWqK3e20nf0sEaAD8fOezZ0s+fY4Kxlo6bFEIO6M\/m1Kmklzwvt+wCN43E7cFAKkH1wLRSsj+vV3a0IMHNqyLQ7lIhfgeyTUpo3RsamrrwEKgnLYzQx31k+CKxjBl3rfRnrtZcREqb5FyOPn8iU5O2Q1xz5aP+CGqZFDgej0hOqtaKkb6ngzO0RujY\/FCUXAm+gWOs5jiTwtcO52P4saMaPqzMAcmQN7gRQEgBZnan4W2MRrDzRkJ5sgrdCo+m7N1XF\/Wd61mvorfI8tpNv\/3qSVvz62RDq+oCt1lGT7inBjLKfBAEOXg2JWvt8skQ7oHKn2PxQXBI0WY3g0ATHJBYv\/Mg7wpIGeS2G8eLpu12D4igHRst723JL8YMEDToZk25zwxI\/oWivwsV3MpnRNKqL+MM+S8zar\/l0Z5it351NICLDExDPGfKA8m+nkfyTgnUlRAZGztCzDSYDvMKiqwThAlf2vZJgYpakISl96HsMJ+7fhiwIE1v5CzTYMzdAgk6cfISQYtb3WinTnODp9bdqLYDedKOx++SbPXPjRN7nhKnRQfw58woJFjLJalqmb5qrqNRC7u2SFb9ED6fT5GmZyw5GFDbKTbM+\/C9genbRSmJSLmEQLFknQ=="}
01096{"flow_id":59,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1237,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167766,"pkt_ts_usec":256128,"pkt_caplen":556,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":556,"pkt_l4_len":522,"pkt":"8IQvSpdgeJKcD6iOCABFAAIe8R5AAEAGJjPAqAFny82Tq+K0AbvYTcOfpZNr04AYASj4fgAAAQEICgAyTYFF8qT6FwMDAeUAAAAAAAAAArGSK6vg4V6ONkIANrXoEA1w3amtVbYxWsrGNXZufnMHgT3aK4D6qCJ8210x1aPb0HbyqC9c01TxW5rWyFwXYobrMkjPEacdcqbimPaI6BCCfrTlbWku4HfJUoqLcqhgMtJb7g+i9acBTQG2a\/V\/qBDYGiSabuSBeJZeC0h\/tu3F4xKKB61VH66psng67pca\/F601HoUhmZb+XOL6WIWIA5AXCRyH75myXxQoD5W5Xk+ZyfPUU8qS0CWqqlw9di5Hf2R54L+E6Ves+FAo2kDDtSA2UlgzkY0NqbNPzp8bCOOz9p\/srEymVv8IpNVQx9DmwakY\/Paf02pzFvOJPfBVE\/QrIVZ5CBGTlYukyDD8Xpx9YvRn4C3tcrFcximnIGa84eTXNIYnOLxpoCyFfDBNj1xNMMw\/zR44OHc1rel7N0tHOkTSEr4zFshHyoKNWcDGH9Ya\/uCYkQe5ctc3EFo\/hOZ7qI8ARWsjsRaAWG7UdjBU6LQZzzj0g+CK477vfzAeMYVd+VGOFLeYCs+RWIbY8HnyzsQBvQ5wajvJIIpovnoJSJdBjfvtc+LhGcZut83EYoJ1qdKo\/g1eCNMo+NHa9YlfJBIkW4Uq4esnCarOPr1TAjUF56Hxj3ceBC0qw=="}
00437{"flow_id":60,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167767,"pkt_ts_usec":274060,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rU+QocNNwsr8KASN8h73QAAAgQFoAQCCApFrtMIADJNMQEDAwc="}
00425{"flow_id":60,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167767,"pkt_ts_usec":274119,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZwVAAEAGsjbAqAFny82Tq+K1Abs3CyvwPkKHDoAQAOXhegAAAQEICgAyToBFrtG3"}
00426{"flow_id":60,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1257,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167776,"pkt_ts_usec":953723,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZwZAAEAGsjXAqAFny82Tq+K1Abs3CyvwPkKHDoARAOXYBQAAAQEICgAyV\/RFrtG3"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1258,"source":"wechat.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1492167776953,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58038,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":61,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1258,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167776,"pkt_ts_usec":953879,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8k9VAAEAGhV7AqAFny82Tq+K2AbuZa8QhAAAAAKACchAaQgAAAgQFtAQCCAoAMlf0AAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1259,"source":"wechat.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1492167777204,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58039,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":62,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1259,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":204515,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8XvpAAEAGujnAqAFny82Tq+K3Abv08QbJAAAAAKACchB71AAAAgQFtAQCCAoAMlgzAAAAAAEDAwc="}
00437{"flow_id":61,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1260,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":220516,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rYX2Lh9mWvEIqASN8j8PgAAAgQFoAQCCApF00IlADJX9AEDAwc="}
00425{"flow_id":61,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1261,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":220585,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0k9ZAAEAGhWXAqAFny82Tq+K2AbuZa8QiF9i4foAQAOVhlwAAAQEICgAyWDdF00Il"}
00425{"flow_id":60,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1262,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":220877,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0VEVAAC8G1VbLzZOrwKgBZwG74rU+QocONwsr8YARAHDNcQAAAQEICkWu3L8AMlf0"}
00426{"flow_id":60,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1263,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":220927,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ZwdAAEAGsjTAqAFny82Tq+K1Abs3CyvxPkKHD4AQAOXMuQAAAQEICgAyWDdFrty\/"}
00750{"flow_id":61,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1264,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":221018,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEik9dAAEAGhHbAqAFny82Tq+K2AbuZa8QiF9i4foAYAOUtNAAAAQEICgAyWDdF00IlFgMBAOkBAADlAwO7CPpUAi5ji1WrIUUoJckLyw+WP0iTwMQC+JpZ0PHlhCBDtbBAnWnGygM6P1AG0j+Q0vm5\/VvsmvPTT+HjfnB2iAAgurrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8+voAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAICgoAHQAXABhaWgABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1264,"source":"wechat.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":4,"flow_first_seen":1492167776953,"flow_last_seen":1492167777221,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58038,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00438{"flow_id":62,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1265,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":476493,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74reza+A99PEGyqASN8j\/yAAAAgQFoAQCCApFrtz+ADJYMwEDAwc="}
00425{"flow_id":62,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1266,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":476579,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XvtAAEAGukDAqAFny82Tq+K3Abv08QbKs2vgPoAQAOVlIAAAAQEICgAyWHdFrtz+"}
00425{"flow_id":61,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1267,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":492766,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0+hdAAC8GL4TLzZOrwKgBZwG74rYX2Lh+mWvFEIAQAHhg0gAAAQEICkXTQmkAMlg3"}
02346{"flow_id":61,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1268,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":494071,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXI+hhAAC8GKe\/LzZOrwKgBZwG74rYX2Lh+mWvFEIAQAHhv+gAAAQEICkXTQmkAMlg3FgMDAF0CAABZAwMMdZZFC+a\/dtCPgB6zd6eEL1mqS0ty8xuhCtoWZrw+ICAMsBFok8j6ktN3mDNfYh89ubRYR7QbnhPUZ8eCwdphM8AvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1268,"source":"wechat.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":6,"flow_first_seen":1492167776953,"flow_last_seen":1492167777494,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58038,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":61,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1269,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":494128,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0k9hAAEAGhWPAqAFny82Tq+K2AbuZa8UQF9i+EoAQAPtadwAAAQEICgAyWHtF00Jp"}
02702{"flow_id":61,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1270,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":494665,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbM+hlAAC8GKOrLzZOrwKgBZwG74rYX2L4SmWvFEIAYAHgoRwAAAQEICkXTQmkAMlg3i6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQboshvxbTukiMimVQa2YbqP6iCCo5p7IPPYwOxUDOVm+iIWtRrqCuB2B\/s6Aeg0tRNXQX1KdroNbGN\/5qs8Z8bBgEBAFkL\/ex+jsqCBE+xXTsicXe+iS+maDDG5QgxIY9bYMVVBHj8fOVbMJQgoASCmJzIoErqKMPAhy+2syGGRA\/NWeMmSYBYh8Jg3kV2sAQwn8MTC\/J0DROx1oSBL8rfC\/F6Wc\/LtfmHtl3Mim0ah6fL4AqyNpveeiHUPigKWJdeodQFcXYgPwU13ZYq9tVM\/3b7yys5dswaSYlvqIGfG2hsuke2MIrIpvLc45hjLSJusMMnf7h2gbo16ncLTUCtrqUeOqSgQJEa9K14mMn1J0YfCPt1IBVAlhxyeII3LTKHEgjmKweWZVlB5iuFZ3WXRsYPTlYzVjcI+LOwK0zCLoafoy8WAwMABA4AAAA="}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1270,"source":"wechat.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":8,"flow_first_seen":1492167776953,"flow_last_seen":1492167777494,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58038,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":61,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1271,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":494700,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0k9lAAEAGhWLAqAFny82Tq+K2AbuZa8UQF9jEqoAQARVTxQAAAQEICgAyWHtF00Jp"}
00601{"flow_id":61,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1272,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":497640,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyk9pAAEAGhOPAqAFny82Tq+K2AbuZa8UQF9jEqoAYARWqOwAAAQEICgAyWHxF00JpFgMDAEYQAABCQQTKZanQFrSBWAGE7Lsy2NW8K6\/OvO32APvUx0zuyCdPie5U73QgBOPH2dgHei7rc7\/TCiKYRNjFNX\/xQHylg2LQFAMDAAEBFgMDACgAAAAAAAAAAOOqsDRMItC6TsbKzpaz8E0fEnlRnpFbFqVoK\/49cCbL"}
00496{"flow_id":61,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1273,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":766434,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABn+htAAC8GL03LzZOrwKgBZwG74rYX2MSqmWvFjoAYAHihWgAAAQEICkXTQq0AMlh8FAMDAAEBFgMDAChye55KBmqR+mMBsNTBYkeoYWUd1mB13FUml8ygNJsw+gHbUh7R9AGL"}
02113{"flow_id":61,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1274,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":767270,"pkt_caplen":1306,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1306,"pkt_l4_len":1272,"pkt":"8IQvSpdgeJKcD6iOCABFAAUMk9tAAEAGgIjAqAFny82Tq+K2AbuZa8WOF9jE3YAYARWkiAAAAQEICgAyWL9F00KtFwMDBNMAAAAAAAAAAcHvuiA9RjF4n1DAZsfhFaYgxB0NT4YjRv8dVTl+b6DlurYETj0jJCqM7JyVLpodTapM3Yrffho8xQRMt0WeLfq87JRtDecyPkqe+ZI4FGDPMDkD87fMhcKqaf3lpi6Cn2\/nJ+55zpa1i3kPgEAuOi9PnWfRJeg19WoahNY77G0lapreucwEHvsN4Ie5DV8A\/UqNx3zpCxyD8aPV\/ily8DMhNV\/Yw+1HmrMbWxILWvWx7WItkVUqjf3wowJ7NNU1lk+AkE1h9XMFAbvPeyDCnV2RN8rzfbVnuLtsZ3SJqlrX\/vmI1z1oEM7B\/K3IttWUYSr7ycCNmkKkky79vq2t2hzalKCs5b4Ei\/QusRiVOlnPkKxZXhQRuqH45qFIJND149KuVlhcfOFyM7jrAUZdio6MQulW0o6Cjyjaspil9rAF10p05YJ8wF7ZJwztraQyGQ9mkFigBrjKmFeUAn8d0U0OfFgomRI1yj+0c9KeyhY3n9M9zroICMIMfU3eEl9F3ok5ZhF6Iun6zyefw3+P8jLibewXrn\/TFjoxWJOXnuWeo2xse4EqFVpWkOeGIMfbbb9GSDQUtpYyK1wgMRknW0NmLFH75qjiMchqZPDe4u\/Kjjw23MUX05s\/4R0tmrmQlOWmCF5eLXTh5oVQ6\/O0gmXTPqcr5FP8SQv\/I93TgBVPywtkleR1IMblmnh9iSqXQOCf9hm7IGHyPEzDSEQrjUA9n7Vj2+DAGIHzv4xOTRo63cIy7QQj3XW\/SGTC11Y4CtUCg2aP7EUim2BRL7hytQfMkfPN1fsooorPUdxbIbAc\/y+rAIqCY+FTIBlG2+HwfqII5Hh+Ev74VcaUM8jPx1K7+zG1gYaUxsVv1Z7Q1cE5eOGdwwiCOaj7RkVLo9YWbyGyKCHfIsUHURqchi8cqNzU\/6+eUKSiJFiaaUlSTlrVccVq6p2xCDJCOUzbPnmyuOl41yO8Zwx8OotaeHsnUunf2T\/U4yhGBMPODACwIaPQB67lnq\/svynl5Vht1bXibz8eiRJK8mL\/urNudN7EUFazwf\/WkxilrcNtaOvFzlP7a5a37HkDW7WJlZpdSNsv2xizVRyf0Yj7qngVszJD0P3hcyXtw5mB3MPINro3lWdO2W6vBkyYujoF4tGpCYscoXPXWu34F3sTM7U69CbtKkMSR1GyCsWdpCe7jo44ipHeUZdT3ArOJjZBwOZKfyvupc7QblY8k0Wh9GdWsQS6pIt+v9seSrs0311rppnQcxhNGBMAsWr3vaq0q1DlnfNNuGNUy8EtGTtX9r9jYqmKLii2wahPRQgZWzf\/69BqfAgRsMzZ9+KO\/wA4Q1PUWH4xbZbNgEd0k9HyPBRkviFNRfXAWeTvqAslD+L4+K+tK218SX7V1aaHSQVDqKj2UXa+mDwSRQNeW8M\/R1h9nzGvX6c0pnW2qQmT0ymvmB8QYc01DfrQ4n1Mn\/1VrEeSbLh7HXjl\/MoyMoHXyQ6QGIg2N1CjmvQRT7QQ+3MrDTVw3pYqNIxCp0Gkc0L+sTN+8z+foMzq7n9kAw0UxZDzCdgCJ+BqcSHrro+sOH+5qh0rbBObyzEDPiyI8sK3zQdan4\/G4wrnl3xPY6Eu1ETpgjeU5j9znGvC53N4RQLpXg=="}
01071{"flow_id":61,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1275,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167777,"pkt_ts_usec":770487,"pkt_caplen":541,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":541,"pkt_l4_len":507,"pkt":"8IQvSpdgeJKcD6iOCABFAAIPk9xAAEAGg4TAqAFny82Tq+K2AbuZa8pmF9jE3YAYARXo6wAAAQEICgAyWMBF00KtFwMDAdYAAAAAAAAAAiJw5AlDILIVinlub3KJpNa9n2V80+SM1f2MB1PS9s2Ra41u8lXPsaN8WZtufrLBnmL7KvQziCZxyD\/3CqwEmmNpjIVCAjQoDTctrhxPb2B3azM1flmVNB0SfvxDdxFp3lbJ8EGUNqHtciAbgO9nxmcrxZgL63rpZTDUYU3IA7sS5gDMlBW7AiEKodAvM7tKv8QuEinZW\/J+hN4ekW6SCGjv17dcWCVIkR1I5ShNVm0KIq7Y3mESfvmpCo9pBcvSYbSpBcJrIUX7ub9eKRAgcIlegtULx0UFrpT0xPd3lfbxWDCsz5Kh5CkZZPwT510SgkPLFE2wBtygOsgMmdLOd+1YLx+k1MFYzlDmt4Kq8n3V6Qp2cYJ7TJ+DYXnMMkQy5LoQGMlNiWAMgBztImcDr9O8f7sT+K3Si0MloKZVAqlWzV8F2yqd7x4LTIus7GgMOtCzv6kdz4GGHmckXBCeMHd7d\/Srp9D5hd1\/Fmer36+7b9zUmVoP7P3jtsww0o9w4usouU1lFbQK84ztu1bgEky6Kjs1OatjUcTt\/02OJ9ZYFq1X74Tii3IeU\/aKUXXjBMOPNoChi8WcM2fn2xkezNusTEv569tDKpozSDoOvQ=="}
00427{"flow_id":61,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1276,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167778,"pkt_ts_usec":47855,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0+hxAAC8GL3\/LzZOrwKgBZwG74rYX2MTdmWvMQYAQAJ9MCAAAAQEICkXTQvQAMli\/"}
02189{"flow_id":61,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1277,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167778,"pkt_ts_usec":77569,"pkt_caplen":1371,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1371,"pkt_l4_len":1337,"pkt":"eJKcD6iO8IQvSpdgCABFoAVN+h1AAC8GKmXLzZOrwKgBZwG74rYX2MTdmWvMQYAYAJ9ZmAAAAQEICkXTQvsAMli\/FwMDBRRye55KBmqR+7W+mX2WSBoXCfEt7a9yVY9bggIEuNK1OGX2j1eGqkvZKP173fEwPLkiCk74zkonaHPtm6jcrByVapgBL\/JDdAyjVqE61ZNlKqmARHqs5XyLVvoruLA3CAw+koAqAXdpH3mEK7b7PNkgkHBM\/aIYtllLdk6JCdwGvci9sJzmLPoL4dQQW54IHkbMQ0bFGEZfehChEvq8CxgAro+ah0\/AOyuAct0R\/aqbSba\/ueUDgZGeK2eE9u9EQz4G2X8j0csLSF8IsUO5C3tIzhrm+21ny5IMnROaGya1meu2T8h4Pz37gYrj1B2+kcqatxqg\/8BduU4PIMkvmj6df2IGpzkfS5sce4rdtXfsJ015aRVTG9Ll3xQJmF0w\/SUtgAyGfvfn6U37QQTcZHX0J39LdRZUUGfEGPpn3fOiwpBYbZaXnEZQhA1Y2Kv6hSasfHwzBqDMQ1bohAWRtrYjs6fvHeci9hqig2QpRVZnWKGDy6PLmIVzV036Nn5qW7CoQ1P+XVjo1gYqYJdfcS4JoZdZA8wRtxpURWFGk1zKmWqe5AFCInXT0z2Yk6Gvh0Qbk4iXV75doVjM6eMUgdcwo50xo+nkefBpe5yN6cA\/mRmSvBvfYzOLA33IL3HLF1+1A4DGZY65G18NiPwiYORxNHow1SH73qUYafd0lquafYK1ynVnBUFem6wdl6rBGlEOjE6P+49g7XXmN65HJfb9TfPcoalbrKlk4NiinrAr9K4C6Kqv8njs+cMzBNB3wAKQJvZ7ejqlNBJyjHyIRuPuC9haRxxY9GSfHy0Avq6YRQNewKdluDCh7VX\/mKfh1pvy15fuQrdIGf6FKsNSeIzlonXxoBLiqLSnoFbIgSjNxlImSOLGrxAx5POyCnqodztftkM+wDw+EpluSG8Zh3IlcsMDHnv+cIwRwVObjN+NMSBS2c9Z8vMeCEjNCYFYL5JORE1+kRZ8YwhK5navhOkQGT0EdHZ6s58DVin+7XMBaP3SXVx+9mJOu5kHTFTyMDloLNRngT0lhs2pgdNyxq+nVOQazT+BCRR1t7lx1kExKwxtQ88oDxMOCKCs1N2vdcnGetuTfNWglzAi5U\/73qXzdZ\/\/psLxarAQEqJjc7\/WvDTRNutKb2EhKlKvGv+l4pO8gxv5zCZscPBlSsHcBeV0A5M1FEjNWQQHum59ujRLmhcBR+QwuZwNUH+APvr76HhCUi7HTSxsdAzsnyUFNRYsPnISVPGtVJwtGe8esiSPF3dOKgtQzfMNNiqwZrPPYPb2geyiEf2PytKwgc6IKb6fXa7PtHcalcuZzLFT7ZPIkqvhzQx75hPvO5ePV\/CLG4g8Mo9+sLRMTBFhhlUVLGFr2MZMTvCei8HF5hTeBjrpEuNrEpdL9UFCFhByJQ2vxeak2kwbh4apTGy0x95\/DJ7fr5zGvtJIkVPfrsPxsXhYpPl4SmNNwUyQf9i+n7yJJk\/ncOkhwVSt8L48Z95JFTYTxUEe3dDljGYtrXrcjwsF2ZT0JrDyN\/58R46OiugDRlaTF+bPCchtnHK3qeYbNc0gcFSkM29aPxP6M0RCxQ4ACwdtzQBazkGEXIRRBoubjOPvSG7BUgGpRsF0Bzpu7DyfYI2gb1nYCckHwQDey3ugFo0GzQ+tDm9FW4JfWeIKcygjOwUp8+IEJHYscEab709rOM4Wk1CF+uG2G4mrBklh0vuIfSFXRa2L8MgYPJSeS+ek45oq"}
00437{"flow_id":62,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1293,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167778,"pkt_ts_usec":905220,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74reza+A99PEGyqASN8j+HgAAAgQFoAQCCApFrt5kADJYdwEDAwc="}
00426{"flow_id":62,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1294,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167778,"pkt_ts_usec":905291,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XvxAAEAGuj\/AqAFny82Tq+K3Abv08QbKs2vgPoAQAOVjuwAAAQEICgAyWdxFrtz+"}
00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":24,"flow_first_seen":1492167648277,"flow_last_seen":1492167720406,"flow_tot_l4_data_len":7958,"flow_min_l4_data_len":20,"flow_max_l4_data_len":3450,"flow_avg_l4_data_len":331,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.158.34","src_port":43850,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":36,"flow_first_seen":1492167695237,"flow_last_seen":1492167720429,"flow_tot_l4_data_len":13739,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":381,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54117,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":18,"flow_first_seen":1492167695488,"flow_last_seen":1492167720468,"flow_tot_l4_data_len":4123,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54118,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1492167788126,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00449{"flow_id":63,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167788,"pkt_ts_usec":126900,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPYcAAAER2HrAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00550{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1327,"source":"wechat.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1492167788126,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1328,"source":"wechat.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1492167788128,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_id":64,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1328,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167788,"pkt_ts_usec":128365,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00559{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1328,"source":"wechat.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1492167788128,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00449{"flow_id":63,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1346,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":152054,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPhsAAAER1+bAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1347,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":153443,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":63,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1348,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":154719,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPiIAAAER19\/AqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00449{"flow_id":63,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1349,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":155970,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPiMAAAER197AqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1350,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":157362,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00477{"flow_id":64,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1351,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167789,"pkt_ts_usec":158750,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00449{"flow_id":63,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1358,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167790,"pkt_ts_usec":174880,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPlkAAAER16jAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1359,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167790,"pkt_ts_usec":176385,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00449{"flow_id":63,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1360,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167792,"pkt_ts_usec":220612,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEPrkAAAER10jAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1361,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167792,"pkt_ts_usec":221994,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1362,"source":"wechat.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1492167795087,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":54124,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00433{"flow_id":65,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1362,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":87741,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"AQBeAAD80CeIF3AECABFoAA4QcoAAAER1ELAqAFk4AAA\/NNsFOsAJPA+T9YAAAABAAAAAAAACmxiamFtd3B0eHoAAAEAAQ=="}
00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1362,"source":"wechat.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1492167795087,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":54124,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1363,"source":"wechat.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1492167795088,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":49832,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00431{"flow_id":66,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1363,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":88948,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AQBeAAD80CeIF3AECABFoAA2QcsAAAER1EPAqAFk4AAA\/MKoFOsAIsj\/\/HMAAAABAAAAAAAACGNhbnNhcWNxAAABAAE="}
00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1363,"source":"wechat.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1492167795088,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":49832,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1364,"source":"wechat.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1492167795090,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":57401,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00429{"flow_id":67,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1364,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":90107,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AQBeAAD80CeIF3AECABFoAA2QcwAAAER1ELAqAFk4AAA\/OA5FOsAIm9WRGIAAAABAAAAAAAACG1jenRtcGtjAAABAAE="}
00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1364,"source":"wechat.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1492167795090,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":57401,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1365,"source":"wechat.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1492167795091,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50440,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00458{"flow_id":68,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1365,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":91471,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":90,"pkt_l4_len":36,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACQRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADxQgU6wAk8ypP1gAAAAEAAAAAAAAKbGJqYW13cHR4egAAAQAB"}
00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1365,"source":"wechat.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1492167795091,"flow_last_seen":0,"flow_tot_l4_data_len":36,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50440,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1366,"source":"wechat.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1492167795092,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":49195,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00458{"flow_id":69,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1366,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":92845,"pkt_caplen":88,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":88,"pkt_l4_len":34,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACIRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADwCsU6wAiwAT8cwAAAAEAAAAAAAAIY2Fuc2FxY3EAAAEAAQ=="}
00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1366,"source":"wechat.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1492167795092,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":49195,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1367,"source":"wechat.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1492167795095,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50577,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00458{"flow_id":70,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1367,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":95742,"pkt_caplen":88,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":88,"pkt_l4_len":34,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACIRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADxZEU6wAifoZEYgAAAAEAAAAAAAAIbWN6dG1wa2MAAAEAAQ=="}
00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1367,"source":"wechat.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1492167795095,"flow_last_seen":0,"flow_tot_l4_data_len":34,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50577,"dst_port":5355,"l4_proto":"udp","ndpi": {"proto":"LLMNR","breed":"Acceptable","category":"Network"}}
00434{"flow_id":65,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1368,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":96889,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"AQBeAAD80CeIF3AECABFoAA4Qc0AAAER1D\/AqAFk4AAA\/NNsFOsAJPA+T9YAAAABAAAAAAAACmxiamFtd3B0eHoAAAEAAQ=="}
00458{"flow_id":68,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1369,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":98225,"pkt_caplen":90,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":90,"pkt_l4_len":36,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACQRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADxQgU6wAk8ypP1gAAAAEAAAAAAAAKbGJqYW13cHR4egAAAQAB"}
00429{"flow_id":67,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1370,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":99442,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AQBeAAD80CeIF3AECABFoAA2Qc4AAAER1EDAqAFk4AAA\/OA5FOsAIm9WRGIAAAABAAAAAAAACG1jenRtcGtjAAABAAE="}
00433{"flow_id":66,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1371,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":100641,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"AQBeAAD80CeIF3AECABFoAA2Qc8AAAER1D\/AqAFk4AAA\/MKoFOsAIsj\/\/HMAAAABAAAAAAAACGNhbnNhcWNxAAABAAE="}
00459{"flow_id":70,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1372,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":102006,"pkt_caplen":88,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":88,"pkt_l4_len":34,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACIRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADxZEU6wAifoZEYgAAAAEAAAAAAAAIbWN6dG1wa2MAAAEAAQ=="}
00459{"flow_id":69,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1373,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":103351,"pkt_caplen":88,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":88,"pkt_l4_len":34,"pkt":"MzMAAQAD0CeIF3AEht1gAAAAACIRAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAQADwCsU6wAiwAT8cwAAAAEAAAAAAAAIY2Fuc2FxY3EAAAEAAQ=="}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1374,"source":"wechat.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1492167795292,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00471{"flow_id":71,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1374,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":292702,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQdAAAIARc3vAqAFkwKgB\/wCJAIkAOgI3\/v8BEAABAAAAAAAAIEVNRUNFS0VCRU5GSEZBRkVGSUZLQ0FDQUNBQ0FDQUFBAAAgAAE="}
00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1374,"source":"wechat.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1492167795292,"flow_last_seen":0,"flow_tot_l4_data_len":58,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","ndpi": {"proto":"NetBIOS","breed":"Acceptable","category":"System"}}
00471{"flow_id":71,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1375,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":294066,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQdEAAIARc3rAqAFkwKgB\/wCJAIkAOgw8\/wABEAABAAAAAAAAIEVORURGS0ZFRU5GQUVMRURDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1376,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167795,"pkt_ts_usec":295354,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQdIAAIARc3nAqAFkwKgB\/wCJAIkAOio7\/wEBEAABAAAAAAAAIEVERUJFT0ZERUJGQkVERkJDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1377,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":111890,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQy0AAIARch7AqAFkwKgB\/wCJAIkAOgI3\/v8BEAABAAAAAAAAIEVNRUNFS0VCRU5GSEZBRkVGSUZLQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1378,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":113315,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQy4AAIARch3AqAFkwKgB\/wCJAIkAOio7\/wEBEAABAAAAAAAAIEVERUJFT0ZERUJGQkVERkJDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1379,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":114640,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABOQy8AAIARchzAqAFkwKgB\/wCJAIkAOgw8\/wABEAABAAAAAAAAIEVORURGS0ZFRU5GQUVMRURDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1380,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":726273,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABORSAAAIARcCvAqAFkwKgB\/wCJAIkAOgI3\/v8BEAABAAAAAAAAIEVNRUNFS0VCRU5GSEZBRkVGSUZLQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1381,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":727578,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABORSEAAIARcCrAqAFkwKgB\/wCJAIkAOgw8\/wABEAABAAAAAAAAIEVORURGS0ZFRU5GQUVMRURDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00471{"flow_id":71,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1382,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167796,"pkt_ts_usec":728951,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoABORSIAAIARcCnAqAFkwKgB\/wCJAIkAOio7\/wEBEAABAAAAAAAAIEVERUJFT0ZERUJGQkVERkJDQUNBQ0FDQUNBQ0FDQUFBAAAgAAE="}
00426{"flow_id":62,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1383,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167799,"pkt_ts_usec":176993,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0PplAAC8G6wLLzZOrwKgBZwG74reza+A+9PEGyoARAHBO\/gAAAQEICkWu8i8AMlnc"}
00425{"flow_id":62,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1384,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167799,"pkt_ts_usec":180222,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Xv1AAEAGuj7AqAFny82Tq+K3Abv08QbKs2vgP4AQAOU6vAAAAQEICgAybalFrvIv"}
00426{"flow_id":12,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1387,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167802,"pkt_ts_usec":608250,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0ePtAAEAGFxTAqAFnQOmnvIyxFGy60MyoSq1b+oAQAO1kTQAAAQEICgAycQKFo6C3"}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1389,"source":"wechat.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":50,"flow_first_seen":1492167720101,"flow_last_seen":1492167748133,"flow_tot_l4_data_len":29265,"flow_min_l4_data_len":32,"flow_max_l4_data_len":2888,"flow_avg_l4_data_len":585,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54119,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1389,"source":"wechat.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":18,"flow_first_seen":1492167720353,"flow_last_seen":1492167748129,"flow_tot_l4_data_len":4131,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54120,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00436{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1395,"source":"wechat.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1492167815567,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00405{"flow_id":72,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1395,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167815,"pkt_ts_usec":567817,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":50,"pkt_l4_len":12,"pkt":"AQBeAAAB8IQvSpdgCABGoAAkj9sAAAEC8bDAqAH+4AAAAZQEAAARZOybAAAAAAIAAAA="}
00468{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1395,"source":"wechat.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1492167815567,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00412{"flow_id":30,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1396,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167818,"pkt_ts_usec":25453,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoTS4AAAECNN\/AqAFk4AAAFpQEAAAiAOwDAAAAAQIAAADv\/\/\/6"}
00409{"flow_id":30,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1397,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167819,"pkt_ts_usec":459029,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoTTIAAAECNNvAqAFk4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00437{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1398,"source":"wechat.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1492167820408,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00409{"flow_id":73,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1398,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167820,"pkt_ts_usec":408257,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAWeJKcD6iOCABGwAAoAABAAAECQerAqAFn4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00469{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1398,"source":"wechat.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1492167820408,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00410{"flow_id":30,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1399,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167820,"pkt_ts_usec":484228,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoTTQAAAECNNnAqAFk4AAAFpQEAAAiAPsBAAAAAQIAAADgAAD8"}
00413{"flow_id":30,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1400,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167822,"pkt_ts_usec":531112,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoTUkAAAECNMTAqAFk4AAAFpQEAAAiAOwAAAAAAQIAAADv\/\/\/9"}
00438{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1492167820408,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00437{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1492167815567,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":26,"flow_first_seen":1492167765433,"flow_last_seen":1492167776953,"flow_tot_l4_data_len":10634,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":409,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":8,"flow_first_seen":1492167765657,"flow_last_seen":1492167777220,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58037,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00491{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":8,"flow_first_seen":1492167765657,"flow_last_seen":1492167777220,"flow_tot_l4_data_len":280,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58037,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00449{"flow_id":63,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1401,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167837,"pkt_ts_usec":279361,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABETnwAAAERx4XAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00449{"flow_id":63,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1402,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167837,"pkt_ts_usec":280685,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABETn0AAAERx4TAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1403,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167837,"pkt_ts_usec":282035,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00477{"flow_id":64,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1404,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167837,"pkt_ts_usec":283427,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":63,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1405,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167838,"pkt_ts_usec":303365,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEUDIAAAERxc\/AqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00477{"flow_id":64,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1406,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167838,"pkt_ts_usec":304806,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":63,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1409,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167840,"pkt_ts_usec":351414,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEUk8AAAERw7LAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":64,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1410,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167840,"pkt_ts_usec":352767,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00425{"flow_id":62,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1412,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167844,"pkt_ts_usec":200258,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Xv5AAEAGuj3AqAFny82Tq+K3Abv08QbJs2vgP4AQAOUOxgAAAQEICgAymaBFrvIv"}
00426{"flow_id":62,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1413,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167844,"pkt_ts_usec":485906,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0W3NAAC8GzijLzZOrwKgBZwG74reza+A\/9PEGyoAQAHAO8gAAAQEICkWvHm4AMm2p"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1416,"source":"wechat.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1492167848542,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00675{"flow_id":74,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1416,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167848,"pkt_ts_usec":542496,"pkt_caplen":243,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":243,"pkt_l4_len":209,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoADlWmgAAIARWkzAqAFkwKgB\/wCKAIoA0eSKEQ7\/A8CoAWQAigC7AAAgRUhFSkVQRkdFQkVPRU9FSkNORkFFRENBQ0FDQUNBQ0EAIEZIRVBGQ0VMRUhGQ0VQRkZGQUNBQ0FDQUNBQ0FDQUJPAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAAIQAAAAAAAAAAAOgDAAAAAAAAAAAhAFYAAwABAAAAAgAyAFxNQUlMU0xPVFxCUk9XU0UADwCA\/AoAR0lPVkFOTkktUEMAAAAAAAYBAxIFAA8BVaoA"}
00555{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1416,"source":"wechat.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1492167848542,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
00451{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1417,"source":"wechat.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1492167849769,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00438{"flow_id":75,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1417,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167849,"pkt_ts_usec":769805,"pkt_caplen":70,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":70,"pkt_l4_len":16,"pkt":"MzMAAAACuHgu4toHht1gCKryABA6\/\/6AAAAAAAAACEKj86KGbFv\/AgAAAAAAAAAAAAAAAAAChQD\/swAAAAABAbh4LuLaBw=="}
00485{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1417,"source":"wechat.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1492167849769,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::2","l4_proto":"icmp6","ndpi": {"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
00472{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1418,"source":"wechat.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1492167851002,"flow_last_seen":0,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00808{"flow_id":76,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1418,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167851,"pkt_ts_usec":2688,"pkt_caplen":342,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":342,"pkt_l4_len":308,"pkt":"\/\/\/\/\/\/\/\/uHgu4toHCABFAAFI3+EAAP8R2sMAAAAA\/\/\/\/\/wBEAEMBNOAUAQEGADPq6ioAAAAAAAAAAAAAAAAAAAAAAAAAALh4LuLaBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjglNjNQEDNwcBeQMGD3f8OQIF3D0HAbh4LuLaBzIEwKgBajMEAHanAAwOaVBob25lZGlNb25pY2H\/AAAAAAAA"}
00551{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1418,"source":"wechat.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1492167851002,"flow_last_seen":0,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","ndpi": {"proto":"DHCP","breed":"Acceptable","category":"Network"},"dhcp": {"fingerprint":"1,121,3,6,15,119,252"}}
00439{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1419,"source":"wechat.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1492167851203,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ff86:6c5b","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00459{"flow_id":77,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1419,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167851,"pkt_ts_usec":203580,"pkt_caplen":86,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":86,"pkt_l4_len":32,"pkt":"MzP\/hmxbuHgu4toHht1gAAAAACA6\/wAAAAAAAAAAAAAAAAAAAAD\/AgAAAAAAAAAAAAH\/hmxbhwDa5wAAAAD+gAAAAAAAAAhCo\/OihmxbDgE+iVJ12j4="}
00473{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1419,"source":"wechat.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1492167851203,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ff86:6c5b","l4_proto":"icmp6","ndpi": {"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
00424{"flow_id":75,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1420,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167851,"pkt_ts_usec":204799,"pkt_caplen":62,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":62,"pkt_l4_len":8,"pkt":"MzMAAAACuHgu4toHht1gCL93AAg6\/\/6AAAAAAAAACEKj86KGbFv\/AgAAAAAAAAAAAAAAAAAChQDCHwAAAAA="}
00452{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1421,"source":"wechat.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1492167852023,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00490{"flow_id":78,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1421,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167852,"pkt_ts_usec":23021,"pkt_caplen":110,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":62,"pkt_len":110,"pkt_l4_len":48,"pkt":"MzMAAAAWuHgu4toHht1gAAAAADgAAf6AAAAAAAAACEKj86KGbFv\/AgAAAAAAAAAAAAAAAAAWOgABAAUCAACPAPHlAAAAAgQAAAD\/AgAAAAAAAAAAAAL\/tFRbBAAAAP8CAAAAAAAAAAAAAf+GbFs="}
00486{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1421,"source":"wechat.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1492167852023,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::16","l4_proto":"icmp6","ndpi": {"proto":"ICMPV6","breed":"Acceptable","category":"Network"}}
00473{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1422,"source":"wechat.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1492167851002,"flow_last_seen":0,"flow_tot_l4_data_len":308,"flow_min_l4_data_len":308,"flow_max_l4_data_len":308,"flow_avg_l4_data_len":308,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1422,"source":"wechat.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1492167848542,"flow_last_seen":0,"flow_tot_l4_data_len":209,"flow_min_l4_data_len":209,"flow_max_l4_data_len":209,"flow_avg_l4_data_len":209,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00440{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1422,"source":"wechat.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1492167851203,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":0,"l3_proto":"ip6","src_ip":"::","dst_ip":"ff02::1:ff86:6c5b","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00453{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1422,"source":"wechat.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1492167852023,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::16","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":62,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1425,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167865,"pkt_ts_usec":974865,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Xv9AAEAGujzAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXNQQAAAQEICgAyruNFrx5u"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1426,"source":"wechat.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1492167865975,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58040,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":79,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1426,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167865,"pkt_ts_usec":975033,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8cVZAAEAGp93AqAFny82Tq+K4AbvAQN+1AAAAAKACchCA5wAAAgQFtAQCCAoAMq7jAAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1427,"source":"wechat.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1492167866226,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58041,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":80,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1427,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":226283,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8hOdAAEAGlEzAqAFny82Tq+K5AbuucSvFAAAAAKACchBGZwAAAgQFtAQCCAoAMq8iAAAAAAEDAwc="}
00437{"flow_id":79,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1428,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":243313,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rhfZ1wawEDftqASN8iGUwAAAgQFoAQCCApFrzOuADKu4wEDAwc="}
00425{"flow_id":79,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1429,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":243399,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cVdAAEAGp+TAqAFny82Tq+K4AbvAQN+2X2dcG4AQAOXrqwAAAQEICgAyryZFrzOu"}
00749{"flow_id":79,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1430,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":243873,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEicVhAAEAGpvXAqAFny82Tq+K4AbvAQN+2X2dcG4AYAOUGhQAAAQEICgAyryZFrzOuFgMBAOkBAADlAwM6MRNk3EmFJ9vIXCbdCkO3vP+WoKpqLBvgL+NdCbhfqyAMsBFok8j6ktN3mDNfYh89ubRYR7QbnhPUZ8eCwdphMwAgOjrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8GhoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIOjoAHQAXABhqagABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1430,"source":"wechat.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":4,"flow_first_seen":1492167865975,"flow_last_seen":1492167866243,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58040,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00437{"flow_id":80,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1431,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":495347,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rl6NAw+rnErxqASN8iAowAAAgQFoAQCCApFrzPtADKvIgEDAwc="}
00425{"flow_id":80,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1432,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":495436,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0hOhAAEAGlFPAqAFny82Tq+K5AbuucSvGejQMP4AQAOXl+wAAAQEICgAyr2VFrzPt"}
00426{"flow_id":79,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1433,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":513757,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0b+pAAC8GubHLzZOrwKgBZwG74rhfZ1wbwEDgpIAQAHjq5wAAAQEICkWvM\/EAMq8m"}
02346{"flow_id":79,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1434,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":514555,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIb+tAAC8GtBzLzZOrwKgBZwG74rhfZ1wbwEDgpIAQAHifDwAAAQEICkWvM\/IAMq8mFgMDAF0CAABZAwNdJVXKZAQ6L0HFxCp+fVehSoRoXpTG0NPHVWuOn9SnCCC9CRO8qTdKdBx1vFCAUpGqkrrbgAZaFdgU9IvXLwqN\/MAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1434,"source":"wechat.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":6,"flow_first_seen":1492167865975,"flow_last_seen":1492167866514,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58040,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":79,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1435,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":514612,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cVlAAEAGp+LAqAFny82Tq+K4AbvAQOCkX2dhr4AQAPvkiwAAAQEICgAyr2pFrzPy"}
02348{"flow_id":79,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1436,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":514947,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIb+xAAC8GtBvLzZOrwKgBZwG74rhfZ2GvwEDgpIAQAHi2AgAAAQEICkWvM\/IAMq8mi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRPE\/g5q0vKNFqOQ8jDNX+U+KzfnGvIriLht8OOkBrvm3QdAnDj0nIpXAvz+ZzT+4Dlze6VtyjPc8CUqfVrM432BgEBAATq8z4m"}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1436,"source":"wechat.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":8,"flow_first_seen":1492167865975,"flow_last_seen":1492167866514,"flow_tot_l4_data_len":3366,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":420,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58040,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":79,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1437,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":514997,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cVpAAEAGp+HAqAFny82Tq+K4AbvAQOCkX2dnQ4AQARHe4QAAAQEICgAyr2pFrzPy"}
00785{"flow_id":79,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1438,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":515940,"pkt_caplen":326,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":326,"pkt_l4_len":292,"pkt":"eJKcD6iO8IQvSpdgCABFoAE4b+1AAC8GuKrLzZOrwKgBZwG74rhfZ2dDwEDgpIAYAHhjgwAAAQEICkWvM\/IAMq8mH8OtgucgtUA7PijryUnPiWyN1eNHGVt9PvidK0Kq\/DwczjZ+O0xK484Ewx2zKwDclwSi+Q1QCZ\/b3OVV\/O7TAMvy3oLlTYECM2iCz+kcJi62AmMoUaEN2v+6jidm2qj5Lvbz7fl35JpJTLqZaNBx+\/+2Pnig\/xR+k4OEpLf1l3KgzTw3uaUKSjTPBRH9lD8EjyPlDiZ9k9aHYiAr8AEy2zQ44UlrefG4HZ0Fo9XeZEmY\/ClVJFi8G7BInSN6S0qiTzHQ84nscFW1PATeZBPhwYYIB387B2Rff4BvPAY9b0SHHLmHmhzv9np7vfAuT6RzK834RMCbfHg\/7CMWAwMABA4AAAA="}
00426{"flow_id":79,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1439,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":515966,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0cVtAAEAGp+DAqAFny82Tq+K4AbvAQOCkX2doR4AQASjdxgAAAQEICgAyr2pFrzPy"}
00598{"flow_id":79,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1440,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":518754,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACycVxAAEAGp2HAqAFny82Tq+K4AbvAQOCkX2doR4AYASgW2QAAAQEICgAyr2tFrzPyFgMDAEYQAABCQQRsOBC80u7GYj06nZEke0QYx2JsJKUCJ9\/Wp7W0Y+2Ft2zgBgNv8RYT9jRpjKM0UKVeCB8yjF2uevVVSzGYZbCDFAMDAAEBFgMDACgAAAAAAAAAAHoJFD9O9YrXBcTXxVu0uYVAFP97oR49ibSlMsQgAYLe"}
00426{"flow_id":62,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1441,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":580273,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XwBAAEAGujvAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXMqQAAAQEICgAyr3tFrx5u"}
00497{"flow_id":79,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1442,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":789037,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnb+5AAC8GuXrLzZOrwKgBZwG74rhfZ2hHwEDhIoAYAHgIaAAAAQEICkWvNDYAMq9rFAMDAAEBFgMDACg4\/FLdEKRbQJQLOtpgu7AlCKoSDK4K0CrXEiD8eE1QZcmbkSXz0Im3"}
02028{"flow_id":79,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1443,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":790169,"pkt_caplen":1246,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1246,"pkt_l4_len":1212,"pkt":"8IQvSpdgeJKcD6iOCABFAATQcV1AAEAGo0LAqAFny82Tq+K4AbvAQOEiX2doeoAYASj68QAAAQEICgAyr69FrzQ2FwMDBJcAAAAAAAAAAc+HOmOQpaqD4yWZtqg9ZokyqmrQ48mbUPT41aGTj6LA1qbtAk+ACvBnfMfxaqmWqMNpan9iglku4KPd17MZQQ5t\/ZYnYgEmA0+\/zEcBdowl5ANKztpjIdykoDiIeUXgvNdw7+o2Ed5BxSex4bNh3EjA9m\/BNRnSKVnT9U8TSduI6dyii9G3Euak3C3oRQmloV+H1vtO8T4i7j90B7pxgtdDgsNsDmWpUW8xU+Md286I3i5J4vMHLbTsQPft1+bGM1ncYxciWDBEmQrGpZtgBpUlTQ8k7zX8JyiLheoSQ7HL7nO7ap6AuxxjUeUjWgv8s+0XkqJ+50tkkez6MgYacmDbHCbBD08hJ6LjFRJDm+VEjRFi7TCmKX4v5vE3Gqf58L7UGZZA3qp08louWytPgRiFZrSodYga4WunzPJ9MGWF9lS+NKAio0ua+ZsbJ8EOxANTFnl1IR\/QIj\/MZIzpWJFX3MP1IBHmD+hNSf4JX0jfWap2S62Neb6N95NKNbaF\/8QvzO8BRuXS5hnu9WNDPUlg2rnAAJDd8+rbd9tOjYypepwhv2RCUTioBFdooFS91MslO4\/VqSbObCDm8LQIKYbQg5m1QKbeZ9BrlVVPfaxvvstT5dKO0otcKab2xbCjDijyQ+rd16PORXNfhBfAcfr7DLHqXUlubwRxTZ4d03B8ZwKPFjqQtBlEs7O\/yI5V8QKd6312eaktCOeOlBKHONPHp3531RBBct1gt5bhCDQrWLVgn\/sWcoxqhBcfbqDFC9efFV5+y6aoS3SZA18bJ9Eu\/ab2CQrxz2yVC\/32KBG2m+WJ7VwFtFXOs94ihoQdpRMc565XNZQjHtBuLp+lBvPeBy9nm9hLvCtWJvzbWQX1kO+ECHKC0D907TYzo\/LFbggP4Pfj1qz\/F9mkLgvLn6M8hxkblLONtFenScJ5LZtSkWx7wELoHxYBic1OTYTwAeMNnnjtSeF8lO8b0as11ByINUdfSEO25KErNmOVqymb+0adIH43VsDRUQuEhPZ4FFezKNNNBPKWhHfPugG+nIy\/G\/J3QImPoODlf4+smCeC+ok4BVNvgy+lqwF83Qo8FQjssuY9pg+QeiRH9DZmHEredHqK3ELCINDXzpZ60O4aS7KVFc0tcEWpeNUxGLj5tSSb4lfqeQ2UWfzA9H\/1nWpC4F8e+FJWwuUd28GauaPL4KMeVlgVu0CHuXVi275AAs4pwNf7yj+Db\/Y5KUEmtmhQWmFS3UeLutRZJLEmEmpcEjBral7Irpo1p3yBL7Kp0ZNCNF2C0krF8O2RiA\/N61A3CHzSXiF+sb99pHy6Rgd79pE6Fzq9dIAhaaFGqLkU+nKWMTLlkmlyRDgWl0nhtUcLH5uPjqrDErr4XB7q3+0hSBD3mKWVSrJTYV+ULKUhSgEycDNv2KASVNULyBxVVr+lTwGW9ItyP9tR3U2c7WL9J8MgQ\/6lUrPUzkyQ3p\/vaQQKN8PYlWZmnuBe+d8M0xt7r9E2MYYXXf40ST5q+xQTTnpZaL4Y5SXvxUrXXkZM5SCqPU+6BZOk7SKFjP2qwg=="}
02357{"flow_id":79,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1444,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167866,"pkt_ts_usec":790333,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"8IQvSpdgeJKcD6iOCABFAAXIcV5AAEAGoknAqAFny82Tq+K4AbvAQOW+X2doeoAQASiY\/AAAAQEICgAyr69FrzQ2FwMDHOYAAAAAAAAAApwtQdHFk\/llC7c++7YkdJCOc0t9O1PTJzkmfie2JH2QFwExhiAud4jbdn+iIUqX4UgBJtIm4nAXgjoIxq5YcKHSNLcCfoBH6MW4o4q5ozJOLbF1nYcIsG0RzWeeXlp08QJCDDMNuSY5LP0ubPezQHz9173tpLe09iZYIYbVzMedX7ZHMzBedByRc+Wl5immY3yq6+1GpxGXvQhtMhWdVP6Vo8r25tRFUBbIwgqDLLm1N3eOkpaO5ngdRgHNZVo5R5FGr4KJ+wwaYsP0zXNPOXpkNQFeNe6OEDxNR9MaIxhkRf0O5dwy4UTlW3Co5fbwbrr1OySbi9aK\/mOSL\/un\/L8qg2Mq1Gntguur8Lew5mdPS0ZxNSv7PAw369QqxKVp1XwFlHPY\/5DhuUgPuXrB5A5gN1paFv8Z32r+7TmdglaBBgLQVZmHGOcaJeaNzxIxAayIeLddC2BtDsCZgBvEsmmqYhfDA+7FhqZHGiMnHk8VS6HjYwLnQ5UJD0ZQHy3ZEBMKfIEn1lumyFLE6TdMCbxK8k4ejsza65d3rD5CLQdP5TsQmIdagleey\/W3iMj1SsJpPA1FrDkeQLoayAst1agoMbweBdry7Ah5SCHq74aS3mm6b0u9b2yAgZSthtk6FVKUgcXbnqWkIZbya1s9VBXAmgJAt1B2gOhCeK0qZIxHA8dbP7kVwJOeoUws1oAt6VbfoqYqCG5xhzPKjMjo8y\/xUwQDedN3u9HJ5ke1F\/TF2hNK+yh5lp2Y+W3ba7czSXoIaeT9n+SGlQAIrJNh7htpdEKqAYfVn9SUhlkPDVN1DGXg\/AeQhK21TgMngPUeCmILSzpWWvrCGy4GvBMdhEpwwYoSvvRH1uYvctjphKe3QxwqnZOqg7gSSNpzxEoja9jT7DtG3CB94DVjlBLD1amr201L8d7JuvJlkjaQOflYzEXa4mdNNw7FzK7lkT+9NGdWN0QxQBtniFeEf5nXZvuVcHPDL+Urh5cB4US47SoOY8QcY+LvYQ35UDO7J7crjh6EEMSCRqCRY2WAkE\/M+00zlty3Jjg+wC25mS53XOcg1IJ5MEkiosA9q71MCvpc4ekplVHVIfzAjHbnFA6XmrcxgZ7Y7Gafkf8WeOccj4gGX\/xsmlmEntWyUSy\/74ytdlvSSM+xcy8nPGJTApetMdY4qxOaS70e74blhPfnsAbkk1OYdM16dLqVi\/Bi7AcLMN3Q8J8K0WmMWFuJogBGcjHkwo8WdRlO+tN+dOb5\/Ey5m0JS2+xGxEsTZ3Nv5VTuxJx48o1JZChNe1Jvm6pxdXz+Y+t\/NdnXI7TdvWHiQIEIPst+T3FdLCYnsg\/hlslaUhmMWGLZfn4homYTSEuXpVILwm5\/Hdk8qbF1iyIaZeEDlq3LLVvsXK7z7uA00QmFN1V8dhnUPh+HL7kDvAShkc4jh0rnrg3qZV5SvGJ51TKUxbbYfo5J52nkYtma2hEyLjhEn6TkHWRx72zmdfvKxyfgge7foJkasrJBUbPATsMPFNSC5hZZT9r9mzkHJE+u21rBcK11KVBymcxyG1y0Bdpwanr2STw6cV7atdEYoeJEEcKnFeSwY697aJCyinSRDT08Mn9R0aWkHICZq+Lzi\/m1uDhEchUU4BHBmzi8YMR9QiqEvp0qnSk7CtVlOfukryxw7KFf5NYgjhumpE5HpI2uD4h9UsYnwAYqqIyM7vnkKivrH+e1vDrKJUriAdmVQbh7SG9DKpDQ6MRWpThbdeqT6qDDqOwAfayI2ocv23Km4egp3azmhJFg2HtyjcV6ktl+Wg3s8rAhVPlFiDYg9\/Hw49Y9NLB8y7lOmTAXYC+A\/zacjG7V8HsbNRk9MYJbYLRcR+anrrfpsLzLjWDUuEDeax0Czb0g"}
00426{"flow_id":62,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1455,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167867,"pkt_ts_usec":396258,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XwFAAEAGujrAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXL3QAAAQEICgAysEdFrx5u"}
00438{"flow_id":80,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1456,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167867,"pkt_ts_usec":786741,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rl6NAw+rnErxqASN8h\/HQAAAgQFoAQCCApFrzUwADKvZQEDAwc="}
00425{"flow_id":80,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1457,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167867,"pkt_ts_usec":786787,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0hOlAAEAGlFLAqAFny82Tq+K5AbuucSvGejQMP4AQAOXkuAAAAQEICgAysKhFrzPt"}
00425{"flow_id":62,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1467,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167869,"pkt_ts_usec":32245,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XwJAAEAGujnAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXKRAAAAQEICgAyseBFrx5u"}
00749{"flow_id":80,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1478,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":50375,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEihOpAAEAGk2PAqAFny82Tq+K5AbuucSvGejQMP4AYAOWxhwAAAQEICgAys9hFrzPtFgMBAOkBAADlAwOZa2bywhmdZUX58olJRmXCZ7SuNmlIRPbIU98uRUk9bCC9CRO8qTdKdBx1vFCAUpGqkrrbgAZaFdgU9IvXLwqN\/AAgmprMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8amoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIamoAHQAXABj6+gABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1478,"source":"wechat.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":6,"flow_first_seen":1492167866226,"flow_last_seen":1492167871050,"flow_tot_l4_data_len":454,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58041,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00427{"flow_id":80,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1483,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":322390,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0OUxAAC8G8E\/LzZOrwKgBZwG74rl6NAw\/rnEstIAQAHjcUQAAAQEICkWvOKMAMrPY"}
02346{"flow_id":80,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1484,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":323158,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIOU1AAC8G6rrLzZOrwKgBZwG74rl6NAw\/rnEstIAQAHj5IwAAAQEICkWvOKQAMrPYFgMDAF0CAABZAwMHSGBwYPf7AadFMOvOUBo51DwZ7SpKe2ppZoE6um1h4CAXdM3iNMSeSRYu5rAL4uxt+WZ\/oboN6SP4aeC7pGEeFcAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1484,"source":"wechat.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":8,"flow_first_seen":1492167866226,"flow_last_seen":1492167871323,"flow_tot_l4_data_len":1946,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":243,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58041,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":80,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1485,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":323215,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0hOtAAEAGlFDAqAFny82Tq+K5AbuucSy0ejQR04AQAPvV9QAAAQEICgAytBxFrzik"}
02703{"flow_id":80,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1486,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":323625,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMOU5AAC8G6bXLzZOrwKgBZwG74rl6NBHTrnEstIAYAHgoRwAAAQEICkWvOKQAMrPYi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQRPedl8rEGeVAPWuweixwLkUSzzvXlYc5p6md2+DuC6SsLqnlXPMLhf8AdJlsnHntUs8TfqCs4Ci\/\/C3S\/cM1ndBgEBAIk5n1ZCkb5BmAP6rtagvLrJsAyJBUF5gjhDLGukisJYMPBO847\/DDdQHujLQiLupmfebevl4plQW3mHGJhCl4OFNvpPeXUgyEEj53\/L3yoPBeLu7gHjH2aXPoyiJ+GvXrGdYtE6sH0BReG1OhbwdSLPjwXp2aIDb6r6dHKK9D2mHcqj\/4PMbh2Zt\/+ZpgLjf48dduSp8MErjyxbgFk0aCUU6yw7qMVrQhao8pADxLdpo5dlWBJi7HOleqb1AnpYRwJBuWPY\/BdB0N2BQGCDmIxYDXI6WOHG3vCyJq6BuULE3lS6uJy93lGxavermoUJ8Z56jl8STO3nLJK5KunMg7oWAwMABA4AAAA="}
01314{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1486,"source":"wechat.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":10,"flow_first_seen":1492167866226,"flow_last_seen":1492167871323,"flow_tot_l4_data_len":3698,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":369,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58041,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00427{"flow_id":80,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1487,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":323666,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0hOxAAEAGlE\/AqAFny82Tq+K5AbuucSy0ejQYa4AQARXPQwAAAQEICgAytBxFrzik"}
00602{"flow_id":80,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1488,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":325825,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyhO1AAEAGk9DAqAFny82Tq+K5AbuucSy0ejQYa4AYARVuHQAAAQEICgAytB1FrzikFgMDAEYQAABCQQSr0kOEGHE4WGKpY\/5aqefcAOavEkG2UwlG\/o9vNro3sWuojxfAR0juUwuvlIB\/hiM60Im9ShghIL3TNYMM\/pDQFAMDAAEBFgMDACgAAAAAAAAAAESRiMLSeBmuWadzIpsriOQh7WdCxs+OM1uhoR\/hEEj3"}
00497{"flow_id":80,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1493,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":595572,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnOVBAAC8G8BjLzZOrwKgBZwG74rl6NBhrrnEtMoAYAHhBewAAAQEICkWvOOgAMrQdFAMDAAEBFgMDACjHKmy6psvZGILTp4ph5Y6tIPXU4KRvT96PWbBU01pudPAOEleI\/ppz"}
00426{"flow_id":80,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1494,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167871,"pkt_ts_usec":632231,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0hO5AAEAGlE3AqAFny82Tq+K5AbuucS0yejQYnoAQARXOAAAAAQEICgAytGpFrzjo"}
00426{"flow_id":62,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1496,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167872,"pkt_ts_usec":304268,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XwNAAEAGujjAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXHEgAAAQEICgAytRJFrx5u"}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1497,"source":"wechat.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":59,"flow_first_seen":1492167776953,"flow_last_seen":1492167815112,"flow_tot_l4_data_len":27722,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":469,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58038,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":62,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1497,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167878,"pkt_ts_usec":856255,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0XwRAAEAGujfAqAFny82Tq+K3Abv08QbKs2vgP4ARAOXArAAAAQEICgAyu3hFrx5u"}
00426{"flow_id":80,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1500,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167891,"pkt_ts_usec":596756,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0OVFAAC8G8ErLzZOrwKgBZwG74rl6NBiernEtMoARAHi7FAAAAQEICkWvTHAAMrRq"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1513,"source":"wechat.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1492167905310,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58042,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":81,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1513,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":310934,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8Y7pAAEAGtXnAqAFny82Tq+K6AbsLFrb3AAAAAKACchA4ZAAAAgQFtAQCCAoAMtVNAAAAAAEDAwc="}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1514,"source":"wechat.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1492167905561,"flow_last_seen":0,"flow_tot_l4_data_len":40,"flow_min_l4_data_len":40,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58043,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_id":82,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1514,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":561959,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"8IQvSpdgeJKcD6iOCABFAAA8gtZAAEAGll3AqAFny82Tq+K7AbsB+ldaAAAAAKACchCg3QAAAgQFtAQCCAoAMtWMAAAAAAEDAwc="}
00437{"flow_id":81,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1515,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":585622,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rpcdpBKCxa2+KASN8jmJgAAAgQFoAQCCApFr1oYADLVTQEDAwc="}
00425{"flow_id":81,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1516,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":585722,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Y7tAAEAGtYDAqAFny82Tq+K6AbsLFrb4XHaQS4AQAOVLfQAAAQEICgAy1ZJFr1oY"}
00750{"flow_id":81,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1517,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":586242,"pkt_caplen":304,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":304,"pkt_l4_len":270,"pkt":"8IQvSpdgeJKcD6iOCABFAAEiY7xAAEAGtJHAqAFny82Tq+K6AbsLFrb4XHaQS4AYAOUEvAAAAQEICgAy1ZJFr1oYFgMBAOkBAADlAwOpwzJj9zQUL7FTARxwe22aWmPjNgjLbbTXUoctVXlwQCAXdM3iNMSeSRYu5rAL4uxt+WZ\/oboN6SP4aeC7pGEeFQAgqqrMqcyozBTME8ArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAAB8OjoAAP8BAAEAAAAAEwARAAAOd2ViLndlY2hhdC5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAIysoAHQAXABhqagABAA=="}
00723{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1517,"source":"wechat.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":4,"flow_first_seen":1492167905310,"flow_last_seen":1492167905586,"flow_tot_l4_data_len":382,"flow_min_l4_data_len":32,"flow_max_l4_data_len":270,"flow_avg_l4_data_len":95,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58042,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}}
00438{"flow_id":82,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1518,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":858313,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rtG\/8zAAfpXW6ASN8gnXAAAAgQFoAQCCApFr1pdADLVjAEDAwc="}
00426{"flow_id":82,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1519,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":858383,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0gtdAAEAGlmTAqAFny82Tq+K7AbsB+ldbRv\/MwYAQAOWMrQAAAQEICgAy1dZFr1pd"}
00425{"flow_id":81,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1520,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":863511,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0yhRAAC8GX4fLzZOrwKgBZwG74rpcdpBLCxa35oAQAHhKtQAAAQEICkWvWl8AMtWS"}
02345{"flow_id":81,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1521,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":866052,"pkt_caplen":1494,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1494,"pkt_l4_len":1460,"pkt":"eJKcD6iO8IQvSpdgCABFoAXIyhVAAC8GWfLLzZOrwKgBZwG74rpcdpBLCxa35oAQAHjgMAAAAQEICkWvWl8AMtWSFgMDAF0CAABZAwOGR3vz0c7leVL88y7BanT+M1sdUTQh9zjBhl2LkZBBuyCM2+8zdEEEnStdC0Le952Lqq9eharacfOBD8t\/DxmAgMAvAAARAAAAAP8BAAEAAAsABAMAAQIWAwMKagsACmYACmMABgowggYGMIIE7qADAgECAhAw0VtVOfZrLt7UNL9vJ0R7MA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMR0wGwYDVQQDExRHZW9UcnVzdCBTU0wgQ0EgLSBHMzAeFw0xNTA5MjEwMDAwMDBaFw0xODA5MjAyMzU5NTlaMG8xCzAJBgNVBAYTAkhLMREwDwYDVQQIEwhIb25nS29uZzERMA8GA1UEBxQIV2FuIENoYWkxITAfBgNVBAoUGFRlbmNlbnQgTW9iaWxpdHkgTGltaXRlZDEXMBUGA1UEAxQOd2ViLndlY2hhdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOKLCU12ARBCRlKli7V796N1s9bfDDDp36hVnOckXCCtd1EICzDOMCShPpSy6mvuoSPYBr2kWWo99zbB1a21uYKdVpQmanSw53I2i\/nT9Ba10GRLm5DHrUpDUEij+mkz50Z2gx4CFdsKkRaGEZPO+as9uZ5K0vR1Ij1SUq7qYvK\/o8FWohsRDN8NCmoaUDyOkjivmoxwF9B\/OolimvW\/aejHHbaF7KhHMDTMj3pM9w5Z2Pb22IeJh85lDZOl6rH+yOl8HX0\/8DT5oJOmZoGq0Ovth7OnIKiNK8RoWM02mbl0XitpMl\/rj\/RLaSgD7DwrZYmXrRrFMnwlkx7CD4EfJfAgMBAAGjggLHMIICwzCCAT4GA1UdEQSCATUwggExghN3ZWJwdXNoMS53ZWNoYXQuY29tghJ3ZWJwdXNoLndlY2hhdC5jb22CFGxvZ2luLndlYi53ZWNoYXQuY29tghZ3ZWJwdXNoLndlYi53ZWNoYXQuY29tghN3ZWJwdXNoMi53ZWNoYXQuY29tghd3ZWJwdXNoLndlYjIud2VjaGF0LmNvbYIUZmlsZS53ZWIyLndlY2hhdC5jb22CD3dlYjEud2VjaGF0LmNvbYITZmlsZS53ZWIud2VjaGF0LmNvbYIUbG9naW5wb2xsLndlY2hhdC5jb22CD3dlYjIud2VjaGF0LmNvbYIQbG9naW4ud2VjaGF0LmNvbYIVbG9naW4ud2ViMi53ZWNoYXQuY29tgg5yZXMud2VjaGF0LmNvbYIOd2ViLndlY2hhdC5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL2duLnN5bWNiLmNvbS9nbi5jcmwwgZ0GA1UdIASBlTCBkjCBjwYGZ4EMAQICMIGEMD8GCCsGAQUFBwIBFjNodHRwczovL3d3dy5nZW90cnVzdC5jb20vcmVzb3VyY2VzL3JlcG9zaXRvcnkvbGVnYWwwQQYIKwYBBQUHAgIwNQwzaHR0cHM6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9yZXBvc2l0b3J5L2xlZ2FsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBTSb\/eW9IU\/cjwwfSPahXibo3xafDBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nbi5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9nbi5zeW1jYi5jb20vZ24uY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQAZA+6JF4lvu2XJwUfeUSiNqeNdtX0tN26N"}
00780{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1521,"source":"wechat.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":6,"flow_first_seen":1492167905310,"flow_last_seen":1492167905866,"flow_tot_l4_data_len":1874,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":312,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58042,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","alpn":"h2,http\/1.1"}}
00425{"flow_id":81,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1522,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":866087,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Y71AAEAGtX7AqAFny82Tq+K6AbsLFrfmXHaV34AQAPtEWAAAAQEICgAy1dhFr1pf"}
02701{"flow_id":81,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1523,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":866538,"pkt_caplen":1754,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1754,"pkt_l4_len":1720,"pkt":"eJKcD6iO8IQvSpdgCABFoAbMyhZAAC8GWO3LzZOrwKgBZwG74rpcdpXfCxa35oAYAHgoRwAAAQEICkWvWl8AMtWSi6AhOArffz9dJXvub9aMTE9m7GKRKeFA\/Frtrp0XYhX6JqYW8b5etQL4tC009s8jG\/TuF8dFm+8Qnv4WGTbK3wvSPN1JnNDQWe+joFVsTCgLSjZxmTivYWk1MKykcC3vkTLWMDBQxUwZd+bVuFy+Hg8Wo2jQzS71Re20zkF2fEkUE+GnA3Ez8ZEoMIVFfuZJTLyMwnZDYqRXtmKQLIXy6PQpFijtmZoXa3RaUholNnff2hQGO8247PV9f6R3KrjtNTdvAtNV8PNXxSymO5xp1cn7ghlbtsUCsdT2arvzaytmF1NYKThZAARTMIIETzCCAzegAwIBAgIDAjpvMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9iYWwgQ0EwHhcNMTMxMTA1MjEzNjUwWhcNMjIwNTIwMjEzNjUwWjBEMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEdMBsGA1UEAxMUR2VvVHJ1c3QgU1NMIENBIC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjvn4KhqPPa209K6GXrUkkTdd3uTR5CKWeop7eRxKSPX7qGYax6E89X\/fQp3eaWx8KA7UZU9ulIZRpY51qTJEMEEe+EfpshiW3qwRoQjgJZfAU2hme+msLq2LvjafvY3AjqK+B89FuiGdT7BKkKXWKp\/JXPaKDmJfyCn3U50NuMHhiIllZuHEnRaoPZsZVP\/oyFysxj0ag+mkUfJ2fWuLrM04QprPtd2PYw5703d95mnrU7t7dmszDt6ldzBE6B7tvl6QBI0eVH6N3+liSxsfQvc+TGEK3fveeZerVO8rtrMVwof7UEJrwEgRErBpbeFBFV0xvvYDLgVwts7x2oR5lAgMBAAGjggFKMIIBRjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQU0m\/3lvSFP3I8MH0j2oV4m6N8WnwwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAQYwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2cxLnN5bWNiLmNvbS9jcmxzL2d0Z2xvYmFsLmNybDAvBggrBgEFBQcBAQQjMCEwHwYIKwYBBQUHMAGGE2h0dHA6Ly9nMi5zeW1jYi5jb20wTAYDVR0gBEUwQzBBBgpghkgBhvhFAQc2MDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuZ2VvdHJ1c3QuY29tL3Jlc291cmNlcy9jcHMwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNTM5MA0GCSqGSIb3DQEBCwUAA4IBAQCg1Pcs+3QLf2TxzUNqn2JTHAJ8mJCi7k9o1CAacxI+d7NQ63K87oi+fxfqd4+DYZVPhKHLMk9sIb7SaZZ9Y73cK6gf0BOEcP72NZWJ+aZ3sEbIu7cT9clgadZM\/tKO79NgwYCA4ef7i28heUrg3Kkbwbf7w0lZXLV3B0TUl\/xJAIlvBk4BcBmsLxHA4uYPL4ZLjXvDuacu9PGsFj45SVGeF0tPEDpbpaiSb\/361gsDTUdWVxnzy2v189bPsPX1oxHSIFMTNDcFLENaY9+NQNaFHlHpURceA1bJ8TCt55sRornQMYGbaLHZ6PPmlH7HrhMvh+3QJbBo+d4IWvMpzNSSFgMDAU0MAAFJAwAXQQQ+NK41ixEUObF\/3wwVLRrssuZeijCkksicej1\/Sx8C5ARXD80M8aRC6U8JdjqN1HKBxMtCXnykiIOSxU1e6KpqBgEBACNEMauUjlXDuGcmU7v0Y7L6woqS6NDbjOoc6mMw13fm7ufdTq4Z30913nkuSW9dkpbWUAm+fX5nF7kRGQYImxxLiW7PVyNXoV\/ddOqOVSPaqip19Bwb8\/6edEgD5X3nfDiRMK3lsQPaOOUrRe3DjDh9qDuabMUjk5wYb8KvRwwjYUBK4HhjbvDZ5++GWc7TtELpilMN5K8jRuXhDR59nmIYXUGzWtnZHceHZk40KtR8Nd5AuI\/yAt9aS2kTPyov1KfgrMTJ7EkGj29rGGCSQaaqh1Bv\/Aao+UgMKBf0LdVi\/Xlo1Cqf+2GF9h68PhuxKvFndXZa34PU7yFN5myS2ZAWAwMABA4AAAA="}
01313{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1523,"source":"wechat.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":8,"flow_first_seen":1492167905310,"flow_last_seen":1492167905866,"flow_tot_l4_data_len":3626,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":453,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58042,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"},"tls": {"version":"TLSv1.2","client_requested_server_name":"web.wechat.com","server_names":"webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com","ja3":"e330bca99c8a5256ae126a55c4c725c5","ja3s":"699a80bdb17efe157c861f92c5bf5d1d","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3","issuerDN":"C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com","alpn":"h2,http\/1.1","fingerprint":"4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1"}}
00425{"flow_id":81,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1524,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":866569,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Y75AAEAGtX3AqAFny82Tq+K6AbsLFrfmXHacd4AQARU9pgAAAQEICgAy1dhFr1pf"}
00600{"flow_id":81,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1525,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167905,"pkt_ts_usec":869166,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"8IQvSpdgeJKcD6iOCABFAACyY79AAEAGtP7AqAFny82Tq+K6AbsLFrfmXHacd4AYARWmBwAAAQEICgAy1dlFr1pfFgMDAEYQAABCQQTFXprh3YJ93AWRwR3pfe8hZl\/9VhymPzf8yZmxmLFk8oQoEE4juHOvk\/KqBpoFfa55jrDEUOw4rYqBMszUv4UcFAMDAAEBFgMDACgAAAAAAAAAAHyPtAxCXHRR8n7rWdRimt5+aaWiHMjIYP\/FkrajzDKM"}
00497{"flow_id":81,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1526,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167906,"pkt_ts_usec":137422,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"eJKcD6iO8IQvSpdgCABFoABnyhhAAC8GX1DLzZOrwKgBZwG74rpcdpx3Cxa4ZIAYAHhR5QAAAQEICkWvWqMAMtXZFAMDAAEBFgMDACijiklPzEj8zwLVeuyKBmF4cNJuE3ZbayEdla3mYV\/Uv1ZfYkclU5ln"}
02019{"flow_id":81,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1527,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167906,"pkt_ts_usec":138666,"pkt_caplen":1234,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1234,"pkt_l4_len":1200,"pkt":"8IQvSpdgeJKcD6iOCABFAATEY8BAAEAGsOvAqAFny82Tq+K6AbsLFrhkXHacqoAYARUXKgAAAQEICgAy1hxFr1qjFwMDBIsAAAAAAAAAAQLHa5NT4\/JSsXQQBBLwDu24iD5x2bM7PURSGo4PDGwgpn8bhOW8PJc9ex2tCe+jaGPM8Ko2D+4lKO\/qughTYhoUEqMVYcbRdGqPSORSemZdJq2vExSwy2t313RfO39mZ\/sIKtZMHi\/pZO6D\/T2M4ac89C99xzeVkZpIa8ZBp6APNByAvhXHIwYhmDwVEn4f+bA+7IUSgUCF7OkmCPN6oJYkvu\/b9AfUh6qxL76nv3MWiEdiXVLKRA7LyrNmZL1emdAYDfAztnx5uzLlUMKW2xc1qkdLcN4jy0VzKJg0lBonRqg3dfakfR\/ANGjmxyVVBPrt0DSi+PoRxCOpDxXmYCehgpsjBJONYEZlsIFwlwW+Ln4J6SE8c6fwmOFKYdt4EKsv0gwrZEeDUWV+FwzFUFkUYnDpnWdlb9nLuoYBqQy7W8oPXiO5iOAwfwmHCLEPHT+xG5Incw6efYGE+kIPPrP6rnGd4G7yRbwg7HtYUVGpHb1A08SqLRkfTROm7wWHlle0J6\/eFDxiZv7JKZzVC+1Xwe\/1ffEFuIi0+teNzXbX53LODhPwudU7rXa8jCA7qUbJ9cAIexqQskVAZ9+dCIg33YGkyS9tlSbRGKdTaLkLYUvfCJ6sinYMNFIhR4R+Bn9xpOF2ln97upLpSkfNnZpULhzNzLLP9XAGOUKr7Qi6Mh5Ox38aDP4BiitvXdBJwAu\/ppDglHEiQyAdcl\/+gYMDNnOmcSZfT5TFu0TgeOM5nmdYedJ8KOcLRGw0CdRUX60y7AoiQ6TIAfE27TIeXAWldp+KGorvFk4NsZj5Pn\/WOQO\/bSL3vL3DTY4iNKxoNhkwvOF9qsdwfopqIy74mKEFBM5BZLKM+W38U+DC8VyWa1e34g+I\/yRJ6xGf6d0EAZQq+tgZQunEzMzQLCJR4uP\/bUWbGpWX8\/vnpG5Cx9z6m8uy9Gog2P5Lfui85UjvFu89EmzvC0qpfgev41OTOrl1cupPiLRId2PNBc\/Aqt+Zp+gxocIx3GW7cprLVkM8W55dN2HAjHZ8JY1egKrfW1rW8elbZ5tRCVAs5\/XaXw5GjFVnWyNYkZSOu\/xANZ\/IkhAzR061nof1KgtG4nn8PXmJ+Vgg9GwPVdQLdl5sQu2wIdCi5muCvG7Tf369JJvaDS3ZMujv+fs4RdJ2VDgQ4aeDJh4QyjuRy44iogNkfuv2\/bQ1fPT52el0gQ2+jmC+dIBYskzDHY5FPqghNM6iqizlooII1l7BqDyrQjw9XwFaBFjC7VIUGZPGbjf4r8j6x1IkSHHpUp0dIp+lxqtHf7tzMkfubBQimw8s5gmlOncs9utYUE6k\/SnVmsVG\/NMqI47jWtjv1MALkCXwP+HhippKij3pomB+yBwxcB5YKBj\/4O0IpAg8n6+1B6U4EUOifj\/ptWXoINNYKb0jEsu5YAEEmJWQtZcU7jsXIZKmoFykrasCOdAxLpFX\/DPLG2EbAsAagScNvzdWhtovTqVp5c1cK+TyOSe2u2PS\/iWEaX2Wh4IWHN1iui4vYb3+j9PTmJYk4A=="}
01062{"flow_id":81,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1528,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167906,"pkt_ts_usec":141910,"pkt_caplen":535,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":535,"pkt_l4_len":501,"pkt":"8IQvSpdgeJKcD6iOCABFAAIJY8FAAEAGs6XAqAFny82Tq+K6AbsLFrz0XHacqoAYARU0CgAAAQEICgAy1h1Fr1qjFwMDAdAAAAAAAAAAApoyUHYHSOToJZJ820ibLfz3fGN9syaByqFLJ6VgBb4skM1gm4nfa7CxPjYuvT8B\/bNWndQyUQ4LDwnevLa0I6azqHNdn0JaIix8LuEKkq36eWvslsdgAtSCeapECdwDZNvx91xrowQQhu26rMaDU4gv2oRBVNCLohGvNisHUIxp8csZLzZ7a2xjapCmKnxD+BH3XblXAXdEyTBbLoUU5CEvhabKVFwsET6UMZ9Mx2V3pNiXV+L1trkgU3vJrYUG4dehdEx2kL2ytD9kF6DoCpVQUAgOftsEmu9Hxp6U3a76eCmzXZZdcJ\/7wtvGcEJ9OaPPL4R6cn7YUnJ9btkJGZeogI93iUXBSyoBBOKR5uZrkT8smEI89HvcMzeTA84iHJbdWkYR5YqON1AQ9i8Q8aePl7or\/qVVZsS3qEYTEMrT6MXuJL+iF9B3UVIxHjMDzP8gHYiIn4EKgLs6y31Gc8I2YLP7JDCilo+ZkOVVx1v9ocaQ3aMYDWT++IZsGJ8doPVDv1SP5mY+\/cXnc3doOvJ8Lz6KQZ3Ig5TLcm+t+xTtB0r5JJN08fOrhLuS1upQ6emru3WAGNZ0y+isQPty0Lj1VAOhdIl\/7w=="}
00426{"flow_id":81,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1529,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167906,"pkt_ts_usec":419257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"eJKcD6iO8IQvSpdgCABFoAA0yhlAAC8GX4LLzZOrwKgBZwG74rpcdpyqCxa+yYAQAJ02OQAAAQEICkWvWuoAMtYc"}
00741{"flow_id":81,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1531,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167906,"pkt_ts_usec":487005,"pkt_caplen":297,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":297,"pkt_l4_len":263,"pkt":"eJKcD6iO8IQvSpdgCABFoAEbyhpAAC8GXprLzZOrwKgBZwG74rpcdpyqCxa+yYAYAJ30iQAAAQEICkWvWvsAMtYcFwMDAOKjiklPzEj80F\/vYdM4YXXqyaoEZLuAeaV17\/vv0Cnj1Mr5PtIb+doPYwxHcNrO53LWRaQJ68KYWHZ3Hy86DfolGcZOiHotADtaSay\/VOsQ152bkCsorbcnMVx7a1e1c0p0QPlY8mMY8elRX80wFIeDiWIhahrQVOhKuvVHMm89dI9ciOdGi9TAK1HXToBrS5jNNHRm+zw\/WgW8QLowQl5ZrhVgFpQ3kvS3vJJZHY8r4aiHZiBEmR6flZlWVepdPRI7uuz3zCoZ0BG84qds++Uxy2tUCGN4xfjr1QoKAbqlpjFm"}
00438{"flow_id":82,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1540,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167907,"pkt_ts_usec":207381,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"eJKcD6iO8IQvSpdgCABFoAA8AABAAC8GKZTLzZOrwKgBZwG74rtG\/8zAAfpXW6ASN8glwAAAAgQFoAQCCApFr1uvADLV1gEDAwc="}
00426{"flow_id":82,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1541,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167907,"pkt_ts_usec":207433,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0gthAAEAGlmPAqAFny82Tq+K7AbsB+ldbRv\/MwYAQAOWLXAAAAQEICgAy1ydFr1pd"}
00450{"flow_id":63,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1542,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167908,"pkt_ts_usec":138569,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEYOMAAAERtR7AqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00450{"flow_id":63,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1543,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167908,"pkt_ts_usec":139768,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEYOQAAAERtR3AqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":64,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1544,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167908,"pkt_ts_usec":141193,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00478{"flow_id":64,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1545,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167908,"pkt_ts_usec":142616,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":63,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1546,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167909,"pkt_ts_usec":162596,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEYPUAAAERtQzAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":64,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1547,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167909,"pkt_ts_usec":163978,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":63,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1548,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167911,"pkt_ts_usec":210632,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD70CeIF3AECABFoABEYSkAAAERtNjAqAFk4AAA+xTpFOkAMOibAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00478{"flow_id":64,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1549,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492167911,"pkt_ts_usec":211986,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD70CeIF3AEht1gAAAAADARAf6AAAAAAAAAkfk983Q2bNb\/AgAAAAAAAAAAAAAAAAD7FOkU6QAw3CsAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":2,"flow_first_seen":1492167795095,"flow_last_seen":1492167795102,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50577,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":40,"flow_first_seen":1492167338426,"flow_last_seen":1492167781907,"flow_tot_l4_data_len":1920,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":2,"flow_first_seen":1492167795088,"flow_last_seen":1492167795100,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":49832,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00452{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":11,"flow_first_seen":1492167443647,"flow_last_seen":1492167822531,"flow_tot_l4_data_len":176,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":2,"flow_first_seen":1492167795087,"flow_last_seen":1492167795096,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":54124,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":9,"flow_first_seen":1492167795292,"flow_last_seen":1492167796728,"flow_tot_l4_data_len":522,"flow_min_l4_data_len":58,"flow_max_l4_data_len":58,"flow_avg_l4_data_len":58,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":2,"flow_first_seen":1492167795092,"flow_last_seen":1492167795103,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":49195,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":17,"flow_first_seen":1492167777204,"flow_last_seen":1492167918120,"flow_tot_l4_data_len":568,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58039,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":17,"flow_first_seen":1492167777204,"flow_last_seen":1492167918120,"flow_tot_l4_data_len":568,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58039,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00497{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":49,"flow_first_seen":1492167865975,"flow_last_seen":1492167896999,"flow_tot_l4_data_len":22802,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1460,"flow_avg_l4_data_len":465,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58040,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":18,"flow_first_seen":1492167866226,"flow_last_seen":1492167897002,"flow_tot_l4_data_len":4131,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":229,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58041,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":22,"flow_first_seen":1492167905310,"flow_last_seen":1492167916848,"flow_tot_l4_data_len":8772,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1720,"flow_avg_l4_data_len":398,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58042,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00518{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":5,"flow_first_seen":1492167905561,"flow_last_seen":1492167907207,"flow_tot_l4_data_len":184,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58043,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":5,"flow_first_seen":1492167905561,"flow_last_seen":1492167907207,"flow_tot_l4_data_len":184,"flow_min_l4_data_len":32,"flow_max_l4_data_len":40,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58043,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00523{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":20,"flow_first_seen":1492167352068,"flow_last_seen":1492167892851,"flow_tot_l4_data_len":640,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":36017,"dst_port":5228,"l4_proto":"tcp","ndpi": {"proto":"Google","breed":"Tracker\/Ads","category":"Web"}}
00493{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":20,"flow_first_seen":1492167352068,"flow_last_seen":1492167892851,"flow_tot_l4_data_len":640,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":36017,"dst_port":5228,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":34,"flow_first_seen":1492167342893,"flow_last_seen":1492167478295,"flow_tot_l4_data_len":7525,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1450,"flow_avg_l4_data_len":221,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.22.14","src_port":38657,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":179,"flow_first_seen":1492167353674,"flow_last_seen":1492167907140,"flow_tot_l4_data_len":70870,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":395,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54058,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":179,"flow_first_seen":1492167353674,"flow_last_seen":1492167907140,"flow_tot_l4_data_len":70870,"flow_min_l4_data_len":32,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":395,"midstream":1,"l3_proto":"ip4","src_ip":"203.205.151.162","dst_ip":"192.168.1.103","src_port":443,"dst_port":54058,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":14,"flow_first_seen":1492167788126,"flow_last_seen":1492167911210,"flow_tot_l4_data_len":672,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":40,"flow_first_seen":1492167338426,"flow_last_seen":1492167781907,"flow_tot_l4_data_len":1920,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":2,"flow_first_seen":1492167342857,"flow_last_seen":1492167342893,"flow_tot_l4_data_len":298,"flow_min_l4_data_len":60,"flow_max_l4_data_len":238,"flow_avg_l4_data_len":149,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53734,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_first_seen":1492167351026,"flow_last_seen":1492167351061,"flow_tot_l4_data_len":234,"flow_min_l4_data_len":41,"flow_max_l4_data_len":193,"flow_avg_l4_data_len":117,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":55862,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":2,"flow_first_seen":1492167648243,"flow_last_seen":1492167648277,"flow_tot_l4_data_len":542,"flow_min_l4_data_len":39,"flow_max_l4_data_len":503,"flow_avg_l4_data_len":271,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":19041,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":13,"flow_first_seen":1492167350385,"flow_last_seen":1492167350562,"flow_tot_l4_data_len":6394,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":491,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":51507,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":2,"flow_first_seen":1492167765155,"flow_last_seen":1492167765432,"flow_tot_l4_data_len":397,"flow_min_l4_data_len":40,"flow_max_l4_data_len":357,"flow_avg_l4_data_len":198,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60356,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1492167350333,"flow_last_seen":1492167350372,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":41,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":46078,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00463{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":2,"flow_first_seen":1492167849769,"flow_last_seen":1492167851204,"flow_tot_l4_data_len":24,"flow_min_l4_data_len":8,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::842:a3f3:a286:6c5b","dst_ip":"ff02::2","l4_proto":"icmp6","flow_datalink":1,"flow_max_packets":15}
00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":2,"flow_first_seen":1492167650311,"flow_last_seen":1492167650345,"flow_tot_l4_data_len":241,"flow_min_l4_data_len":41,"flow_max_l4_data_len":200,"flow_avg_l4_data_len":120,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":60562,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":13,"flow_first_seen":1492167351067,"flow_last_seen":1492167352398,"flow_tot_l4_data_len":4370,"flow_min_l4_data_len":36,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":336,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.198.46","src_port":57591,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00488{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":2,"flow_first_seen":1492167795090,"flow_last_seen":1492167795099,"flow_tot_l4_data_len":68,"flow_min_l4_data_len":34,"flow_max_l4_data_len":34,"flow_avg_l4_data_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.252","src_port":57401,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00495{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":10,"flow_first_seen":1492167650348,"flow_last_seen":1492167650467,"flow_tot_l4_data_len":3632,"flow_min_l4_data_len":38,"flow_max_l4_data_len":1358,"flow_avg_l4_data_len":363,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"172.217.23.67","src_port":35601,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":14,"flow_first_seen":1492167788128,"flow_last_seen":1492167911211,"flow_tot_l4_data_len":672,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":2,"flow_first_seen":1492167795091,"flow_last_seen":1492167795098,"flow_tot_l4_data_len":72,"flow_min_l4_data_len":36,"flow_max_l4_data_len":36,"flow_avg_l4_data_len":36,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::91f9:3df3:7436:6cd6","dst_ip":"ff02::1:3","src_port":50440,"dst_port":5355,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":6,"flow_first_seen":1492167377896,"flow_last_seen":1492167468048,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.142","src_port":49787,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":6,"flow_first_seen":1492167377896,"flow_last_seen":1492167468048,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.142","src_port":49787,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1492171154216,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
02044{"flow_id":83,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1553,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171154,"pkt_ts_usec":216266,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYpoxAAEAGahTAqAFny82XotOnAbtQhl2xjWp\/PoAYBaSJeAAAAQEICgA\/OhBF4BL0FwMDBJ8AAAAAAAAAk06IK7tTPaQ0tnXGeqHKil75lMj6OyIERVlvQ89pkJ\/5uFrYubJHeJqSrynvitkot5qunWtMUvVbyI8vjd8zycM9IsUAAB\/fKHCxwAngzbmC6gdk\/UoKTL4MIPiK4NVVPRz1DsYhuoql6sqmFMKJKaM6NXpyBkCtYpvlazDCWxllWCP\/i12XdKQQMbcGYN2wvAB3a6vg6oJPIx+XXkk4cY\/+EENsi+PDerl+pB2IlJMObTfaJBhM\/rJFUKMd1xriphMBzgM9PCE+gKKP\/k+AYg8NddY\/gnJX\/+unfAflhC1NZ1nFt2\/\/Y9gesYC0uhG0uLLlbtLmKF2MPjllgxHAEeq6L2rXw2szIJL4yllp+t9tcKCYfzVRzCQkgUtQQaP0YiRh1NQtDTvnuPpM8CS6YfFOx17PkSNzepokWNsrLXMtr9p2nc9zczirZ\/D9H9Xey3Xx0qFAN\/MVzWUXfWpSlTWrXzNWP5kDdvTYBf19VGMPfxtzLKYTLOd\/rVswJ6OAUsAdfTYAu7j6c4KJubGecouom8T9brd1TJm6pyXignKkiQR+nvp0U\/G\/NxhEcnKV91SvFM0mQxh+hfK10svoh9dj1Bq8+PvXaAQljscptiwRlr+X\/V1zPyapTZcrW9A2fGrnzKqVYJASiCPQWyYD8Mn6pda0e6knRW3Ae28WpLnmyjMKx4\/7dOqugSoKa3q7BQRxbcpbcOXlPFfrjt+CwbA3KCTzFvdocE4QeSDn8FuJ85HFummmQOxK7tDtjljV+L\/2nbiMgjTy6jJzYFwXGw6xLdoXOupF5XjIfHUSMeB+R0BhUmtVxXEWPPHfAVdVJcBt8uO5QMhp9jxrSrOX54VXB+P7Qj0VmSag75Jhz20k8Z3uI27cFcp7OjdlKhlEBtlzESNSQ8FGkqCxygPJSf0REdvr2uQA0ApTgzzF+s6YbdeH3vy1SJOH2fQsH4IeYeRjAPrh1RmlhN066XBLLeGtIiz1LEJx17TCB8c1JpUan\/1+JYoV0SCzXlaZWYybCxcBBIz\/2EdpG8hJzN4rtTVwf\/3OYFkhRTMbe1PHW9T5IfuTuKU76wWlDp+aujzjWp1vvFdq4bUrI6AdEquAU5C3BTnuLB9tqzlOb5nzcQjb4fPQCkUUcvHBPPLW9qrLyB05aTRG1W9ShnsibG\/AerW39YgPMVulkynnwtbGsYcGZs7KelCQXCLt3D6RU08N5SulLgw+o5aYItue0wJaW5VDEXxAVhsE4KU4+QsEuXkbd9rTsMt9Gf+Td49H8NzJEXxlYX\/ThtsZsn5doQpcdUcGVMiJrwpHQzTDWZLiBcd51axsLca9fP61xaeKb48j0Kb0TeXy0DcAfEDH4Sy29YAuNi7N4uKdxMrzHsqaQhCFI\/jmx6CqCWjy1zA6Ijzjpx6KTEeNxn3m7OTzuxckZQeS0ArKR7BX7UnCFIAenlvKt7e\/DzO9W1DndidXP+Qwf3XzvB+qvenTl6HWA0XtGBky3MCwBE5b++HXnyFlygjOvbY7LPZovuQtASvUqwAHPkuONuar\/2ZEP2TwCB+AOJYrpZq+HLOc"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1554,"source":"wechat.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1492171154792,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":84,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1554,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171154,"pkt_ts_usec":792257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0MxpAAEAGXPXAqAFnQOmnvNO9AbuA1BLzAh8CfoAQAT0MFQAAAQEICgA\/OqCGKY\/Q"}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1492171154216,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1492171154216,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1492171154792,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1492171154792,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1492171164904,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":85,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1555,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171164,"pkt_ts_usec":904228,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRVAAEAG2hjAqAFnX2UiIpknAFAjQjGZFOMj7IAQBf7IcQAAAQEICgA\/RIBwfIhZ"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1556,"source":"wechat.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1492171166312,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00429{"flow_id":86,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1556,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171166,"pkt_ts_usec":312260,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/65AAEAG93\/AqAFnX2UiIYi0AFB\/4ffk18M9+4AQCyPvSAAAAQEICgA\/ReBr6XAp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1557,"source":"wechat.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1492171166440,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":87,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1557,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171166,"pkt_ts_usec":440257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqRAAEAGaIrAqAFnX2UiIYi3AFBZ1tlh3d8I5IAQBaRnrgAAAQEICgA\/RgBr6XCp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1558,"source":"wechat.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1492171166696,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":88,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1558,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171166,"pkt_ts_usec":696233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R7pAAEAGr3TAqAFnX2UiIYi4AFDlnJrhImFMS4AQCdyNBgAAAQEICgA\/RkBr6XGp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1559,"source":"wechat.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":89,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1559,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171168,"pkt_ts_usec":104237,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00nhAAEAGJLXAqAFnX2UiIpk\/AFBMVGJPaE9vZoAQBU7AugAAAQEICgA\/R6BwfJTZ"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1560,"source":"wechat.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":90,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1560,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171168,"pkt_ts_usec":104293,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkNAAEAG0OvAqAFnX2UiIYilAFA23DHngeAL9oAQBaSDAQAAAQEICgA\/R6Br6Xcq"}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1561,"source":"wechat.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1492171169377,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"193.204.114.233","src_port":37578,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00457{"flow_id":91,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1561,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171169,"pkt_ts_usec":377549,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"8IQvSpdgeJKcD6iOCABFEABMYzZAAEAR4JXAqAFnwcxy6ZLKAHsAOA7KIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANybOCEWgBhs"}
00508{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1561,"source":"wechat.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1492171169377,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"193.204.114.233","src_port":37578,"dst_port":123,"l4_proto":"udp","ndpi": {"proto":"NTP","breed":"Acceptable","category":"System"}}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1562,"source":"wechat.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1492171171688,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
02044{"flow_id":92,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1562,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171171,"pkt_ts_usec":688264,"pkt_caplen":1254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1254,"pkt_l4_len":1220,"pkt":"8IQvSpdgeJKcD6iOCABFAATYpo1AAEAGahPAqAFny82XotOnAbtQhl2xjWp\/PoAYBaR4aAAAAQEICgA\/SyBF4BL0FwMDBJ8AAAAAAAAAk06IK7tTPaQ0tnXGeqHKil75lMj6OyIERVlvQ89pkJ\/5uFrYubJHeJqSrynvitkot5qunWtMUvVbyI8vjd8zycM9IsUAAB\/fKHCxwAngzbmC6gdk\/UoKTL4MIPiK4NVVPRz1DsYhuoql6sqmFMKJKaM6NXpyBkCtYpvlazDCWxllWCP\/i12XdKQQMbcGYN2wvAB3a6vg6oJPIx+XXkk4cY\/+EENsi+PDerl+pB2IlJMObTfaJBhM\/rJFUKMd1xriphMBzgM9PCE+gKKP\/k+AYg8NddY\/gnJX\/+unfAflhC1NZ1nFt2\/\/Y9gesYC0uhG0uLLlbtLmKF2MPjllgxHAEeq6L2rXw2szIJL4yllp+t9tcKCYfzVRzCQkgUtQQaP0YiRh1NQtDTvnuPpM8CS6YfFOx17PkSNzepokWNsrLXMtr9p2nc9zczirZ\/D9H9Xey3Xx0qFAN\/MVzWUXfWpSlTWrXzNWP5kDdvTYBf19VGMPfxtzLKYTLOd\/rVswJ6OAUsAdfTYAu7j6c4KJubGecouom8T9brd1TJm6pyXignKkiQR+nvp0U\/G\/NxhEcnKV91SvFM0mQxh+hfK10svoh9dj1Bq8+PvXaAQljscptiwRlr+X\/V1zPyapTZcrW9A2fGrnzKqVYJASiCPQWyYD8Mn6pda0e6knRW3Ae28WpLnmyjMKx4\/7dOqugSoKa3q7BQRxbcpbcOXlPFfrjt+CwbA3KCTzFvdocE4QeSDn8FuJ85HFummmQOxK7tDtjljV+L\/2nbiMgjTy6jJzYFwXGw6xLdoXOupF5XjIfHUSMeB+R0BhUmtVxXEWPPHfAVdVJcBt8uO5QMhp9jxrSrOX54VXB+P7Qj0VmSag75Jhz20k8Z3uI27cFcp7OjdlKhlEBtlzESNSQ8FGkqCxygPJSf0REdvr2uQA0ApTgzzF+s6YbdeH3vy1SJOH2fQsH4IeYeRjAPrh1RmlhN066XBLLeGtIiz1LEJx17TCB8c1JpUan\/1+JYoV0SCzXlaZWYybCxcBBIz\/2EdpG8hJzN4rtTVwf\/3OYFkhRTMbe1PHW9T5IfuTuKU76wWlDp+aujzjWp1vvFdq4bUrI6AdEquAU5C3BTnuLB9tqzlOb5nzcQjb4fPQCkUUcvHBPPLW9qrLyB05aTRG1W9ShnsibG\/AerW39YgPMVulkynnwtbGsYcGZs7KelCQXCLt3D6RU08N5SulLgw+o5aYItue0wJaW5VDEXxAVhsE4KU4+QsEuXkbd9rTsMt9Gf+Td49H8NzJEXxlYX\/ThtsZsn5doQpcdUcGVMiJrwpHQzTDWZLiBcd51axsLca9fP61xaeKb48j0Kb0TeXy0DcAfEDH4Sy29YAuNi7N4uKdxMrzHsqaQhCFI\/jmx6CqCWjy1zA6Ijzjpx6KTEeNxn3m7OTzuxckZQeS0ArKR7BX7UnCFIAenlvKt7e\/DzO9W1DndidXP+Qwf3XzvB+qvenTl6HWA0XtGBky3MCwBE5b++HXnyFlygjOvbY7LPZovuQtASvUqwAHPkuONuar\/2ZEP2TwCB+AOJYrpZq+HLOc"}
00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1492171169377,"flow_last_seen":0,"flow_tot_l4_data_len":56,"flow_min_l4_data_len":56,"flow_max_l4_data_len":56,"flow_avg_l4_data_len":56,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"193.204.114.233","src_port":37578,"dst_port":123,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1492171171688,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00487{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1492171171688,"flow_last_seen":0,"flow_tot_l4_data_len":1220,"flow_min_l4_data_len":1220,"flow_max_l4_data_len":1220,"flow_avg_l4_data_len":1220,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.151.162","src_port":54183,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1492171166312,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1492171166312,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1492171166440,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1492171166440,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1492171166696,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1492171166696,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1492171164904,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1492171164904,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1492171168104,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1492171175912,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":93,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1563,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171175,"pkt_ts_usec":912251,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0iE1AAEAGSqnAqAFn2DrNg+MfAbtA+v0fFZsbqIAQAT54MgAAAQEICgA\/T0Ay2r7t"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1564,"source":"wechat.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":94,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1564,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772041,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BdAAEAGIxbAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvX7AAAAQEICgA\/UBZwfB+e"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1565,"source":"wechat.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":95,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1565,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772128,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/69AAEAG937AqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPlEAAAAQEICgA\/UBZr6XAp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1566,"source":"wechat.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":96,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1566,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772209,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqVAAEAGaInAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRdlQAAAQEICgA\/UBdr6XCp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1567,"source":"wechat.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":97,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1567,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772262,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R7tAAEAGr3PAqAFnX2UiIYi4AFDlnJriImFMS4ARCdyDLQAAAQEICgA\/UBdr6XGp"}
00474{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1568,"source":"wechat.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":98,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1568,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772297,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRZAAEAG2hfAqAFnX2UiIpknAFAjQjGaFOMj7IARBf682AAAAQEICgA\/UBdwfIhZ"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1569,"source":"wechat.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00426{"flow_id":99,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1569,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772333,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0251AAEAGiP7AqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJf1WAAAAQEICgA\/UBcc0iJk"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1570,"source":"wechat.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":100,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1570,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772430,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e59AAEAGnZzAqAFny82Tq+NyAbsh7o58Fu1nsYARAOW08AAAAQEICgA\/UBdF3\/Tx"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1571,"source":"wechat.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":101,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1571,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772473,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkRAAEAG0OrAqAFnX2UiIYilAFA23DHogeAL9oARBaR6iAAAAQEICgA\/UBdr6Xcq"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1572,"source":"wechat.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":102,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1572,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772519,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00nlAAEAGJLTAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU64QQAAAQEICgA\/UBdwfJTZ"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1573,"source":"wechat.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":58165,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":103,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1573,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171176,"pkt_ts_usec":772726,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABE+U9AAEARvKPAqAFnwKgB\/uM1ADUAMHLoUUIBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1573,"source":"wechat.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":58165,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"webpush.web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00424{"flow_id":94,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1574,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":4255,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BhAAEAGIxXAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvXsQAAAQEICgA\/UFFwfB+e"}
00425{"flow_id":98,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1575,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":12212,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRdAAEAG2hbAqAFnX2UiIpknAFAjQjGaFOMj7IARBf68nAAAAQEICgA\/UFNwfIhZ"}
00427{"flow_id":95,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1576,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":24209,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7BAAEAG933AqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPk0AAAAQEICgA\/UFZr6XAp"}
00425{"flow_id":97,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1577,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":24244,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R7xAAEAGr3LAqAFnX2UiIYi4AFDlnJriImFMS4ARCdyC7gAAAQEICgA\/UFZr6XGp"}
00427{"flow_id":102,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1578,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":28203,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00npAAEAGJLPAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU64AQAAAQEICgA\/UFdwfJTZ"}
00426{"flow_id":101,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1579,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":32205,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkVAAEAG0OnAqAFnX2UiIYilAFA23DHogeAL9oARBaR6RwAAAQEICgA\/UFhr6Xcq"}
00425{"flow_id":96,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1580,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":40261,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqZAAEAGaIjAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRdUgAAAQEICgA\/UFpr6XCp"}
00425{"flow_id":99,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1581,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":40294,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0255AAEAGiP3AqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJf1FQAAAQEICgA\/UFoc0iJk"}
00426{"flow_id":94,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1582,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":240240,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BlAAEAGIxTAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvXdgAAAQEICgA\/UIxwfB+e"}
00426{"flow_id":98,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1583,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":252250,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRhAAEAG2hXAqAFnX2UiIpknAFAjQjGaFOMj7IARBf68YAAAAQEICgA\/UI9wfIhZ"}
00426{"flow_id":97,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1584,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":276282,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R71AAEAGr3HAqAFnX2UiIYi4AFDlnJriImFMS4ARCdyCrwAAAQEICgA\/UJVr6XGp"}
00428{"flow_id":95,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1585,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":280257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7FAAEAG93zAqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPkkAAAAQEICgA\/UJZr6XAp"}
00428{"flow_id":102,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1586,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":284244,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00ntAAEAGJLLAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU63wQAAAQEICgA\/UJdwfJTZ"}
00427{"flow_id":101,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1587,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":292249,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkZAAEAG0OjAqAFnX2UiIYilAFA23DHogeAL9oARBaR6BgAAAQEICgA\/UJlr6Xcq"}
00426{"flow_id":96,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1588,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":308260,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqdAAEAGaIfAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRdDwAAAQEICgA\/UJ1r6XCp"}
00426{"flow_id":99,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1589,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":308326,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0259AAEAGiPzAqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJf00gAAAQEICgA\/UJ0c0iJk"}
00428{"flow_id":100,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1590,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":380269,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e6BAAEAGnZvAqAFny82Tq+NyAbsh7o58Fu1nsYARAOW0WAAAAQEICgA\/UK9F3\/Tx"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1591,"source":"wechat.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1492171177429,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43317,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":104,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1591,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":429365,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABE+fFAAEARvAHAqAFnwKgB\/qk1ADUAMHHYjFIBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1591,"source":"wechat.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1492171177429,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43317,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"webpush.web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00426{"flow_id":94,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1592,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":712245,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BpAAEAGIxPAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvXAAAAAQEICgA\/UQJwfB+e"}
00426{"flow_id":98,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1593,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":732231,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRlAAEAG2hTAqAFnX2UiIpknAFAjQjGaFOMj7IARBf676AAAAQEICgA\/UQdwfIhZ"}
00426{"flow_id":97,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1594,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":780251,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R75AAEAGr3DAqAFnX2UiIYi4AFDlnJriImFMS4ARCdyCMQAAAQEICgA\/URNr6XGp"}
00428{"flow_id":95,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1595,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":792219,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7JAAEAG93vAqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPkEAAAAQEICgA\/URZr6XAp"}
00428{"flow_id":102,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1596,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":796227,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00nxAAEAGJLHAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU63QQAAAQEICgA\/URdwfJTZ"}
00427{"flow_id":101,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1597,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":812229,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkdAAEAG0OfAqAFnX2UiIYilAFA23DHogeAL9oARBaR5hAAAAQEICgA\/URtr6Xcq"}
00426{"flow_id":96,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1598,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":844278,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqhAAEAGaIbAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRciQAAAQEICgA\/USNr6XCp"}
00426{"flow_id":99,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1599,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171177,"pkt_ts_usec":844343,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA026BAAEAGiPvAqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJf0TAAAAQEICgA\/USMc0iJk"}
00428{"flow_id":100,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1600,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":268260,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e6FAAEAGnZrAqAFny82Tq+NyAbsh7o58Fu1nsYARAOWzegAAAQEICgA\/UY1F3\/Tx"}
00426{"flow_id":94,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1601,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":656277,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BtAAEAGIxLAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvWFAAAAQEICgA\/Ue5wfB+e"}
00426{"flow_id":98,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1602,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":692258,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRpAAEAG2hPAqAFnX2UiIpknAFAjQjGaFOMj7IARBf66+AAAAQEICgA\/UfdwfIhZ"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1603,"source":"wechat.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1492171178741,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":56367,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":105,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1603,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":741406,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABE+rRAAEARuz7AqAFnwKgB\/twvADUAMPgq0wUBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1603,"source":"wechat.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1492171178741,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":56367,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"webpush.web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00427{"flow_id":97,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1604,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":788233,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R79AAEAGr2\/AqAFnX2UiIYi4AFDlnJriImFMS4ARCdyBNQAAAQEICgA\/Ug9r6XGp"}
00428{"flow_id":95,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1605,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":820238,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7NAAEAG93rAqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPjDwAAAQEICgA\/Uhdr6XAp"}
00428{"flow_id":102,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1606,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":824231,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00n1AAEAGJLDAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU62QAAAAQEICgA\/UhhwfJTZ"}
00427{"flow_id":101,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1607,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":856224,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkhAAEAG0ObAqAFnX2UiIYilAFA23DHogeAL9oARBaR4fwAAAQEICgA\/UiBr6Xcq"}
00426{"flow_id":96,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1608,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":920224,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqlAAEAGaIXAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRbfAAAAQEICgA\/UjBr6XCp"}
00426{"flow_id":99,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1609,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171178,"pkt_ts_usec":920265,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA026FAAEAGiPrAqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJfzPwAAAQEICgA\/UjAc0iJk"}
00427{"flow_id":100,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1610,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":48223,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e6JAAEAGnZnAqAFny82Tq+NyAbsh7o58Fu1nsYARAOWxvQAAAQEICgA\/U0pF3\/Tx"}
00426{"flow_id":94,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1611,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":548257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01BxAAEAGIxHAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvUOwAAAQEICgA\/U8dwfB+e"}
00426{"flow_id":98,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1612,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":616237,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRtAAEAG2hLAqAFnX2UiIpknAFAjQjGaFOMj7IARBf65FwAAAQEICgA\/U9hwfIhZ"}
00427{"flow_id":97,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1613,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":808232,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8BAAEAGr27AqAFnX2UiIYi4AFDlnJriImFMS4ARCdx\/PAAAAQEICgA\/VAhr6XGp"}
00428{"flow_id":95,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1614,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":872249,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7RAAEAG93nAqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPhDgAAAQEICgA\/VBhr6XAp"}
00429{"flow_id":102,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1615,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":880250,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00n5AAEAGJK\/AqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU60PgAAAQEICgA\/VBpwfJTZ"}
00427{"flow_id":101,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1616,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171180,"pkt_ts_usec":944260,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JklAAEAG0OXAqAFnX2UiIYilAFA23DHogeAL9oARBaR2dQAAAQEICgA\/VCpr6Xcq"}
00425{"flow_id":96,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1617,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171181,"pkt_ts_usec":72232,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqpAAEAGaITAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRZYgAAAQEICgA\/VEpr6XCp"}
00425{"flow_id":99,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1618,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171181,"pkt_ts_usec":72282,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA026JAAEAGiPnAqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJfxJQAAAQEICgA\/VEoc0iJk"}
00428{"flow_id":100,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1619,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171183,"pkt_ts_usec":608236,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e6NAAEAGnZjAqAFny82Tq+NyAbsh7o58Fu1nsYARAOWuQwAAAQEICgA\/VsRF3\/Tx"}
00452{"flow_id":105,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1620,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171183,"pkt_ts_usec":746494,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABE\/1xAAEARtpbAqAFnwKgB\/twvADUAMPgq0wUBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00426{"flow_id":94,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1621,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":328219,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01B1AAEAGIxDAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgvQigAAAQEICgA\/V3hwfB+e"}
00426{"flow_id":98,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1622,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":464226,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HRxAAEAG2hHAqAFnX2UiIpknAFAjQjGaFOMj7IARBf61VQAAAQEICgA\/V5pwfIhZ"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1623,"source":"wechat.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1492171184747,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":33915,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":106,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1623,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":747647,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABEAC1AAEARtcbAqAFnwKgB\/oR7ADUAMLAAcuQBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1623,"source":"wechat.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1492171184747,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":33915,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"webpush.web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00427{"flow_id":97,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1624,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":848234,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8FAAEAGr23AqAFnX2UiIYi4AFDlnJriImFMS4ARCdx7SgAAAQEICgA\/V\/pr6XGp"}
00428{"flow_id":95,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1625,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":984241,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/7VAAEAG93jAqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyPdCgAAAQEICgA\/WBxr6XAp"}
00428{"flow_id":102,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1626,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171184,"pkt_ts_usec":984295,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00n9AAEAGJK7AqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU6wPAAAAQEICgA\/WBxwfJTZ"}
00427{"flow_id":101,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1627,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171185,"pkt_ts_usec":112223,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JkpAAEAG0OTAqAFnX2UiIYilAFA23DHogeAL9oARBaRyYwAAAQEICgA\/WDxr6Xcq"}
00426{"flow_id":96,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1628,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171185,"pkt_ts_usec":368262,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jqtAAEAGaIPAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaRVMAAAAQEICgA\/WHxr6XCp"}
00426{"flow_id":99,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1629,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171185,"pkt_ts_usec":368325,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA026NAAEAGiPjAqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJfs8wAAAQEICgA\/WHwc0iJk"}
00512{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1492171175912,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00478{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1492171175912,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1492171177429,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43317,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1492171176772,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":58165,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1492171184747,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":33915,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00437{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1492171203806,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00407{"flow_id":107,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171203,"pkt_ts_usec":806188,"pkt_caplen":50,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":50,"pkt_l4_len":12,"pkt":"AQBeAAAB8IQvSpdgCABGoAAkj\/YAAAEC8ZXAqAH+4AAAAZQEAAARZOybAAAAAAIAAAA="}
00469{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1630,"source":"wechat.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1492171203806,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00438{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1631,"source":"wechat.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1492171205448,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00410{"flow_id":108,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1631,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171205,"pkt_ts_usec":448234,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAWeJKcD6iOCABGwAAoAABAAAECQerAqAFn4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00470{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1631,"source":"wechat.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1492171205448,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00438{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1632,"source":"wechat.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1492171206877,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00410{"flow_id":109,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1632,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171206,"pkt_ts_usec":877899,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoL+EAAAECUizAqAFk4AAAFpQEAAAiAPsCAAAAAQIAAADgAAD7"}
00470{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1632,"source":"wechat.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1492171206877,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00413{"flow_id":109,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1633,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171208,"pkt_ts_usec":516256,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoL+IAAAECUivAqAFk4AAAFpQEAAAiAOwDAAAAAQIAAADv\/\/\/6"}
00413{"flow_id":109,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1634,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171210,"pkt_ts_usec":973939,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAW0CeIF3AECABGoAAoL+UAAAECUijAqAFk4AAAFpQEAAAiAOwAAAAAAQIAAADv\/\/\/9"}
00438{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1635,"source":"wechat.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1492171211383,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.108","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00413{"flow_id":110,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1635,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171211,"pkt_ts_usec":383555,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":38,"pkt_len":54,"pkt_l4_len":16,"pkt":"AQBeAAAWACSlnnPpCABGwAAoAABAAAECQeXAqAFs4AAAFpQEAAAiAOwDAAAAAQIAAADv\/\/\/6"}
00470{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1635,"source":"wechat.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1492171211383,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.108","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}}
00439{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1492171211383,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.108","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00439{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1492171205448,"flow_last_seen":0,"flow_tot_l4_data_len":16,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00438{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1492171203806,"flow_last_seen":0,"flow_tot_l4_data_len":12,"flow_min_l4_data_len":12,"flow_max_l4_data_len":12,"flow_avg_l4_data_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185368,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00489{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185368,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":5,"flow_first_seen":1492171176772,"flow_last_seen":1492171183608,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00492{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":5,"flow_first_seen":1492171176772,"flow_last_seen":1492171183608,"flow_tot_l4_data_len":160,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185112,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185112,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184984,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184984,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185368,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171185368,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184848,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184848,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184328,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184328,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184464,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00487{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184464,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00526{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184984,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00488{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":7,"flow_first_seen":1492171176772,"flow_last_seen":1492171184984,"flow_tot_l4_data_len":224,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1492171250302,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00450{"flow_id":111,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171250,"pkt_ts_usec":302344,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABESuVAAAERi7nAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00551{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1636,"source":"wechat.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1492171250302,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1637,"source":"wechat.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1492171250302,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00480{"flow_id":112,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1637,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171250,"pkt_ts_usec":302463,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00560{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1637,"source":"wechat.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1492171250302,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_googlecast._tcp.local"}}
00450{"flow_id":111,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1638,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171250,"pkt_ts_usec":302656,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABESuZAAAERi7jAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00480{"flow_id":112,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1639,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171250,"pkt_ts_usec":302684,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00450{"flow_id":111,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1640,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171251,"pkt_ts_usec":303763,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABESy5AAAERi3DAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00480{"flow_id":112,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1641,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171251,"pkt_ts_usec":303878,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00451{"flow_id":111,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1642,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171253,"pkt_ts_usec":304834,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"AQBeAAD7eJKcD6iOCABFAABES\/VAAAERiqnAqAFn4AAA+xTpFOkAMOiYAAAAAAABAAAAAAAAC19nb29nbGVjYXN0BF90Y3AFbG9jYWwAAAwAAQ=="}
00480{"flow_id":112,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1643,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171253,"pkt_ts_usec":304968,"pkt_caplen":102,"pkt_type":34525,"pkt_l3_offset":14,"pkt_l4_offset":54,"pkt_len":102,"pkt_l4_len":48,"pkt":"MzMAAAD7eJKcD6iOht1gAAAAADARAf6AAAAAAAAAepKc\/\/4PqI7\/AgAAAAAAAAAAAAAAAAD7FOkU6QAwzvQAAAAAAAEAAAAAAAALX2dvb2dsZWNhc3QEX3RjcAVsb2NhbAAADAAB"}
00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1644,"source":"wechat.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":472,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
01031{"flow_id":113,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1644,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":294504,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"8IQvSpdgeJKcD6iOCABFAAHsiFZAAEAGSOjAqAFn2DrNg+MfAbtA+v0gFZsbqIAZAT5FiAAAAQEICgA\/pcIy2r7tFwMDAVu+DrsMGADIBc3y\/EPKacgY\/\/yQnIvMDmcJvSRFqPEzGFHK1SfEZD+LW3zHqz7Qn57h7phszvLaMx08coFwWwqfC7HwO5byX8EfZX59ZxB8wie5NmTqPueQB2i63JLDDRRwIsZojgu7bb8cvUD8n10qxsHw\/TQ7hvwnvUlAMmevC0E4bShoN6nD161aFH8pJzOUZ6Inmm16pW110QaYPjjSQQTv7tNyG48jYK3I2RN01WazUewIpPm73LAS9ZABJ\/Ny8oNO\/paZaboPssOjLQcJQCoLWCEO29VIR1wHqlyW4rcdBB9JM36yEvABpD0B99LA+t3vBjUOLhPnYTS5Tg\/Xq\/y13A\/nE4U69mAQajAphd1rkHRmU5H71D9Yn3KgSrb0XGlqT0xKmBjYerOwAP2kk8Whxm\/8laMcKMQksDAjrijAvnUEJ5tIwpNFUcxgRKcVbexJ8LEa9dte0xcDAwAh3EhrcW9cp9\/WX9UiN8Kt\/CmhJWgGaSyh5LdY3zetl0V+FwMDAC1uKRpL0WFRctIQnQp7DT13au9uAW\/kc9Ado7SqH0KYC9BoecHEhGyhydVqz38="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1645,"source":"wechat.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":45366,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_id":114,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1645,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":294534,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABEJBJAAEARkeHAqAFnwKgB\/rE2ADUAMGKHk6IBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1645,"source":"wechat.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":45366,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.WeChat","breed":"Fun","category":"Chat"},"dns": {"query":"webpush.web.wechat.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1646,"source":"wechat.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":115,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1646,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":294545,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0R8tAAEAGr2PAqAFnX2UiIYi4AFDlnJriImFMS4ARCdwsYAAAAQEICgA\/puRr6XGp"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1647,"source":"wechat.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00429{"flow_id":116,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1647,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":294567,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0\/79AAEAG927AqAFnX2UiIYi0AFB\/4ffl18M9+4ARCyOM4gAAAQEICgA\/qERr6XAp"}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1648,"source":"wechat.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":117,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1648,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":294579,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA00olAAEAGJKTAqAFnX2UiIpk\/AFBMVGJQaE9vZoARBU5gFAAAAQEICgA\/qERwfJTZ"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1649,"source":"wechat.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1492171267430,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":59567,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00447{"flow_id":118,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1649,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":430597,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"8IQvSpdgeJKcD6iOCABFAABBJlBAAEARj6bAqAFnwKgB\/uivADUALYbgc9oBAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQNsYW4AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1649,"source":"wechat.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1492171267430,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":59567,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"ssl.gstatic.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1650,"source":"wechat.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1492171267576,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":119,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1650,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171267,"pkt_ts_usec":576264,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA01ChAAEAGIwXAqAFnX2UiIpkbAFBTLvPZ9eqaX4ARCgt\/PgAAAQEICgA\/qMRwfB+e"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1651,"source":"wechat.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1492171268427,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42074,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00447{"flow_id":120,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1651,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171268,"pkt_ts_usec":427945,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"8IQvSpdgeJKcD6iOCABFAABBJl5AAEARj5jAqAFnwKgB\/qRaADUALSfRFz8BAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQNsYW4AAAEAAQ=="}
00642{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1651,"source":"wechat.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1492171268427,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42074,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"ssl.gstatic.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1652,"source":"wechat.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_first_seen":1492171268472,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":121,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1652,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171268,"pkt_ts_usec":472274,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0JlRAAEAG0NrAqAFnX2UiIYilAFA23DHogeAL9oARBaQg+wAAAQEICgA\/qaRr6Xcq"}
01031{"flow_id":113,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1653,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171268,"pkt_ts_usec":600285,"pkt_caplen":506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":506,"pkt_l4_len":472,"pkt":"8IQvSpdgeJKcD6iOCABFAAHsiFdAAEAGSOfAqAFn2DrNg+MfAbtA+v0gFZsbqIAZAT5BhgAAAQEICgA\/qcQy2r7tFwMDAVu+DrsMGADIBc3y\/EPKacgY\/\/yQnIvMDmcJvSRFqPEzGFHK1SfEZD+LW3zHqz7Qn57h7phszvLaMx08coFwWwqfC7HwO5byX8EfZX59ZxB8wie5NmTqPueQB2i63JLDDRRwIsZojgu7bb8cvUD8n10qxsHw\/TQ7hvwnvUlAMmevC0E4bShoN6nD161aFH8pJzOUZ6Inmm16pW110QaYPjjSQQTv7tNyG48jYK3I2RN01WazUewIpPm73LAS9ZABJ\/Ny8oNO\/paZaboPssOjLQcJQCoLWCEO29VIR1wHqlyW4rcdBB9JM36yEvABpD0B99LA+t3vBjUOLhPnYTS5Tg\/Xq\/y13A\/nE4U69mAQajAphd1rkHRmU5H71D9Yn3KgSrb0XGlqT0xKmBjYerOwAP2kk8Whxm\/8laMcKMQksDAjrijAvnUEJ5tIwpNFUcxgRKcVbexJ8LEa9dte0xcDAwAh3EhrcW9cp9\/WX9UiN8Kt\/CmhJWgGaSyh5LdY3zetl0V+FwMDAC1uKRpL0WFRctIQnQp7DT13au9uAW\/kc9Ado7SqH0KYC9BoecHEhGyhydVqz38="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1654,"source":"wechat.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1492171268754,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43705,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00455{"flow_id":122,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1654,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171268,"pkt_ts_usec":754627,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIJm1AAEARj4LAqAFnwKgB\/qq5ADUANAzJFXEBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20DbGFuAAABAAE="}
00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1654,"source":"wechat.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1492171268754,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43705,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"webpush.web.wechat.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1655,"source":"wechat.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1492171269128,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":123,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1655,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":128269,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0HSdAAEAG2gbAqAFnX2UiIpknAFAjQjGaFOMj7IARBf5ipwAAAQEICgA\/qkhwfIhZ"}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1656,"source":"wechat.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1492171269192,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":124,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1656,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":192245,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0e7BAAEAGnYvAqAFny82Tq+NyAbsh7o58Fu1nsYARAOVarwAAAQEICgA\/qlhF3\/Tx"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1657,"source":"wechat.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1492171269383,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44063,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00447{"flow_id":125,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1657,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":383166,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"8IQvSpdgeJKcD6iOCABFAABDJn9AAEARj3XAqAFnwKgB\/qwfADUALz4De5MBAAABAAAAAAAAATEGZGViaWFuBHBvb2wDbnRwA29yZwAAAQAB"}
00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1657,"source":"wechat.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1492171269383,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44063,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.debian.pool.ntp.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00447{"flow_id":125,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1658,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":383221,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"8IQvSpdgeJKcD6iOCABFAABDJoBAAEARj3TAqAFnwKgB\/qwfADUAL2b9N5kBAAABAAAAAAAAATEGZGViaWFuBHBvb2wDbnRwA29yZwAAHAAB"}
00665{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1658,"source":"wechat.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_first_seen":1492171269383,"flow_last_seen":1492171269383,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44063,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.debian.pool.ntp.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1659,"source":"wechat.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1492171269548,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00692{"flow_id":126,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1659,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":548804,"pkt_caplen":254,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":254,"pkt_l4_len":220,"pkt":"\/\/\/\/\/\/\/\/0CeIF3AECABFoADwL\/IAAIARhLfAqAFkwKgB\/wCKAIoA3H89EQ7\/KMCoAWQAigDGAAAgRUhFSkVQRkdFQkVPRU9FSkNORkFFRENBQ0FDQUNBQUEAIEFCQUNGUEZQRU5GREVDRkNFUEZIRkRFRkZQRlBBQ0FCAP9TTUIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQAALAAAAAAAAAAAAOgDAAAAAAAAAAAsAFYAAwABAAEAAgA9AFxNQUlMU0xPVFxCUk9XU0UADACguw0AV09SS0dST1VQAAAAAAAAAAMKABAAgP4HAABHSU9WQU5OSS1QQwA="}
00556{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1659,"source":"wechat.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1492171269548,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","ndpi": {"flow_risk": {"22":"Unsafe Protocol"},"proto":"NetBIOS.SMBv1","breed":"Dangerous","category":"System"}}
00451{"flow_id":114,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1660,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171269,"pkt_ts_usec":750011,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"8IQvSpdgeJKcD6iOCABFAABEJttAAEARjxjAqAFnwKgB\/rE2ADUAMGKHk6IBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20AAAEAAQ=="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1661,"source":"wechat.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1492171270418,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42589,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00439{"flow_id":127,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1661,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171270,"pkt_ts_usec":418166,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"8IQvSpdgeJKcD6iOCABFAAA9Ju1AAEARjw3AqAFnwKgB\/qZdADUAKRuahlUBAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQAAAQAB"}
00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1661,"source":"wechat.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1492171270418,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42589,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Google","breed":"Tracker\/Ads","category":"Web"},"dns": {"query":"ssl.gstatic.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00475{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1662,"source":"wechat.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":128,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1662,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171271,"pkt_ts_usec":288269,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0jrVAAEAGaHnAqAFnX2UiIYi3AFBZ1tli3d8I5IARBaQBSAAAAQEICgA\/rGRr6XCp"}
00477{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1663,"source":"wechat.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00427{"flow_id":129,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1663,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171271,"pkt_ts_usec":288336,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0261AAEAGiO7AqAFnX2W0s8s0AFCaGNVHW3dgu4ARJJeZCwAAAQEICgA\/rGQc0iJk"}
00447{"flow_id":120,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1664,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171273,"pkt_ts_usec":433039,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"8IQvSpdgeJKcD6iOCABFAABBJ9JAAEARjiTAqAFnwKgB\/qRaADUALSfRFz8BAAABAAAAAAAAA3NzbAdnc3RhdGljA2NvbQNsYW4AAAEAAQ=="}
00455{"flow_id":122,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1665,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171273,"pkt_ts_usec":759735,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIKB1AAEARjdLAqAFnwKgB\/qq5ADUANAzJFXEBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20DbGFuAAABAAE="}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1666,"source":"wechat.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1492171274388,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42856,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00455{"flow_id":130,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1666,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171274,"pkt_ts_usec":388466,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"8IQvSpdgeJKcD6iOCABFAABHKHpAAEARjXbAqAFnwKgB\/qdoADUAMwYVU1YBAAABAAAAAAAAATEGZGViaWFuBHBvb2wDbnRwA29yZwNsYW4AAAEAAQ=="}
00648{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1666,"source":"wechat.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1492171274388,"flow_last_seen":0,"flow_tot_l4_data_len":51,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42856,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.debian.pool.ntp.org.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00455{"flow_id":130,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1667,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171274,"pkt_ts_usec":388528,"pkt_caplen":85,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":85,"pkt_l4_len":51,"pkt":"8IQvSpdgeJKcD6iOCABFAABHKHtAAEARjXXAqAFnwKgB\/qdoADUAMwU2OTUBAAABAAAAAAAAATEGZGViaWFuBHBvb2wDbnRwA29yZwNsYW4AABwAAQ=="}
00670{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1667,"source":"wechat.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_first_seen":1492171274388,"flow_last_seen":1492171274388,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42856,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"1.debian.pool.ntp.org.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1668,"source":"wechat.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1492171274755,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44346,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00456{"flow_id":131,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1668,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171274,"pkt_ts_usec":755195,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIKKBAAEARjU\/AqAFnwKgB\/q06ADUANGSfuxkBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20DbGFuAAABAAE="}
00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1668,"source":"wechat.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1492171274755,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44346,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"webpush.web.wechat.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1492171270418,"flow_last_seen":0,"flow_tot_l4_data_len":41,"flow_min_l4_data_len":41,"flow_max_l4_data_len":41,"flow_avg_l4_data_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42589,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00515{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00477{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.180.179","src_port":52020,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1492171267430,"flow_last_seen":0,"flow_tot_l4_data_len":45,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":59567,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00480{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1492171269548,"flow_last_seen":0,"flow_tot_l4_data_len":220,"flow_min_l4_data_len":220,"flow_max_l4_data_len":220,"flow_avg_l4_data_len":220,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00506{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1492171269192,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WeChat","breed":"Fun","category":"Chat"}}
00479{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1492171269192,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"203.205.147.171","src_port":58226,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1492171274755,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44346,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_first_seen":1492171268472,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_first_seen":1492171268472,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34981,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34996,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1492171271288,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":34999,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.33","src_port":35000,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1492171267576,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1492171267576,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39195,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1492171269128,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1492171269128,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39207,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","ndpi": {"proto":"HTTP","breed":"Acceptable","category":"Web"},"http": {}}
00475{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1492171267294,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"95.101.34.34","src_port":39231,"dst_port":80,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":41759,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00447{"flow_id":132,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171290,"pkt_ts_usec":232051,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"8IQvSpdgeJKcD6iOCABFAABDMahAAEARhEzAqAFnwKgB\/qMfADUAL3l8SRkBAAABAAAAAAAAATIGZGViaWFuBHBvb2wDbnRwA29yZwAAAQAB"}
00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1669,"source":"wechat.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":47,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":41759,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"2.debian.pool.ntp.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00447{"flow_id":132,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1670,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171290,"pkt_ts_usec":232080,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"8IQvSpdgeJKcD6iOCABFAABDMalAAEARhEvAqAFnwKgB\/qMfADUAL1ZyUSMBAAABAAAAAAAAATIGZGViaWFuBHBvb2wDbnRwA29yZwAAHAAB"}
00665{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1670,"source":"wechat.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":2,"flow_first_seen":1492171290232,"flow_last_seen":1492171290232,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":41759,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"2.debian.pool.ntp.org","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00478{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1671,"source":"wechat.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00428{"flow_id":133,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1671,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171290,"pkt_ts_usec":232092,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"8IQvSpdgeJKcD6iOCABFAAA0Mx1AAEAGXPLAqAFnQOmnvNO9AbuA1BLzAh8CfoAQAT2IFAAAAQEICgA\/vqCGKY\/Q"}
00476{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00456{"flow_id":134,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1492171291,"pkt_ts_usec":761740,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"8IQvSpdgeJKcD6iOCABFAABIMrNAAEARgzzAqAFnwKgB\/tELADUANPxl\/4EBAAABAAAAAAAAB3dlYnB1c2gDd2ViBndlY2hhdANjb20DbGFuAAABAAE="}
00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"webpush.web.wechat.com.lan","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}}
00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":4,"flow_first_seen":1492171250302,"flow_last_seen":1492171253304,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::7a92:9cff:fe0f:a88e","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171268600,"flow_tot_l4_data_len":944,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00494{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171268600,"flow_tot_l4_data_len":944,"flow_min_l4_data_len":472,"flow_max_l4_data_len":472,"flow_avg_l4_data_len":472,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"216.58.205.131","src_port":58143,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":2,"flow_first_seen":1492171274388,"flow_last_seen":1492171274388,"flow_tot_l4_data_len":102,"flow_min_l4_data_len":51,"flow_max_l4_data_len":51,"flow_avg_l4_data_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42856,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00451{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":3,"flow_first_seen":1492171206877,"flow_last_seen":1492171210973,"flow_tot_l4_data_len":48,"flow_min_l4_data_len":16,"flow_max_l4_data_len":16,"flow_avg_l4_data_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.100","dst_ip":"224.0.0.22","l4_proto":2,"flow_datalink":1,"flow_max_packets":15}
00477{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1492171291761,"flow_last_seen":0,"flow_tot_l4_data_len":52,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":53515,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":2,"flow_first_seen":1492171267294,"flow_last_seen":1492171269750,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":45366,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":4,"flow_first_seen":1492171250302,"flow_last_seen":1492171253304,"flow_tot_l4_data_len":192,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00490{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":2,"flow_first_seen":1492171268754,"flow_last_seen":1492171273759,"flow_tot_l4_data_len":104,"flow_min_l4_data_len":52,"flow_max_l4_data_len":52,"flow_avg_l4_data_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":43705,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":2,"flow_first_seen":1492171290232,"flow_last_seen":1492171290232,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":41759,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":2,"flow_first_seen":1492171269383,"flow_last_seen":1492171269383,"flow_tot_l4_data_len":94,"flow_min_l4_data_len":47,"flow_max_l4_data_len":47,"flow_avg_l4_data_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":44063,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":2,"flow_first_seen":1492171178741,"flow_last_seen":1492171183746,"flow_tot_l4_data_len":96,"flow_min_l4_data_len":48,"flow_max_l4_data_len":48,"flow_avg_l4_data_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":56367,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00489{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":2,"flow_first_seen":1492171268427,"flow_last_seen":1492171273433,"flow_tot_l4_data_len":90,"flow_min_l4_data_len":45,"flow_max_l4_data_len":45,"flow_avg_l4_data_len":45,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"192.168.1.254","src_port":42074,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Google","breed":"Tracker\/Ads","category":"Web"}}
00479{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1492171290232,"flow_last_seen":0,"flow_tot_l4_data_len":32,"flow_min_l4_data_len":32,"flow_max_l4_data_len":32,"flow_avg_l4_data_len":32,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.103","dst_ip":"64.233.167.188","src_port":54205,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00128{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":1672,"source":"wechat.pcap","alias":"nDPId-test"}
|