1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
00481{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"whatsappfiles.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255}
00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1519924083411,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00446{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":411187,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"XEl5dU5qkLkxKPrKCABFAABAAABAAEAG5oDAqAIduTzYNcIKAbs8JoRvAAAAALDC\/\/8eywAAAgQFtAEDAwYBAQgKKOUV+QAAAAAEAgAA"}
00440{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":501147,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"kLkxKPrKXEl5dU5qCABFAAA8AABAAFUG0YS5PNg1wKgCHQG7wgonNGFZPCaEcKASbTj4zgAAAgQFggQCCAoJITj5KOUV+QEDAwg="}
00428{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":503118,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIKAbs8JoRwJzRhWoAQCAWMQgAAAQEICijlFlQJITj5"}
00757{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":506116,"pkt_caplen":309,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":309,"pkt_l4_len":275,"pkt":"XEl5dU5qkLkxKPrKCABFAAEnAABAAEAG5ZnAqAIduTzYNcIKAbs8JoRwJzRhWoAYCAVSawAAAQEICijlFlYJITj5FgMBAO4BAADqAwPdYI75M\/7Hk5QfaVF+3jFJrn8JCAyxqJHjkbfYArYsNAAAKMAswCvAJMAjwArACcypwDDAL8AowCfAFMATzKgAnQCcAD0APAA1AC8BAACZ\/wEAAQAAAAAZABcAABRtbWctZm5hLndoYXRzYXBwLm5ldAAXAAAAIwAAAA0AFAASBAMIBAQBBQMIBQUBCAYGAQIBAAUABQEAAAAAM3QAAAASAAAAEAAwAC4CaDIFaDItMTYFaDItMTUFaDItMTQIc3BkeS8zLjEGc3BkeS8zCGh0dHAvMS4xAAsAAgEAAAoACAAGAB0AFwAY"}
00819{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_first_seen":1519924083411,"flow_last_seen":1519924083506,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":243,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":60,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mmg-fna.whatsapp.net","ja3":"107144b88827da5da9ed42d8776ccdc5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
00428{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":596769,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"kLkxKPrKXEl5dU5qCABFAAA0WA5AAFUGeX65PNg1wKgCHQG7wgonNGFaPCaFY4AQAHKSgAAAAQEICgkhOVko5RZW"}
02309{"flow_id":1,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":598208,"pkt_caplen":1464,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1464,"pkt_l4_len":1430,"pkt":"kLkxKPrKXEl5dU5qCABFAAWqWA9AAFUGdAe5PNg1wKgCHQG7wgonNGFaPCaFY4AQAHIKKQAAAQEICgkhOVoo5RZWFgMDAEoCAABGAwN2JuCvNTP6QWM9pzKD\/cxL\/UByXEXf445CpKr2ya+mhwDAKwAAHgAAAAD\/AQABAAALAAQDAAECACMAAAAQAAUAAwJoMhYDAwuSCwALjgALiwAG0DCCBswwggW0oAMCAQICEA+Bv5rm7v\/kFf2eyPNQljcwDQYJKoZIhvcNAQELBQAwcDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEvMC0GA1UEAxMmRGlnaUNlcnQgU0hBMiBIaWdoIEFzc3VyYW5jZSBTZXJ2ZXIgQ0EwHhcNMTcwNDI2MDAwMDAwWhcNMTgwNTAxMTIwMDAwWjBpMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazEXMBUGA1UEChMORmFjZWJvb2ssIEluYy4xFzAVBgNVBAMMDioud2hhdHNhcHAubmV0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKdrV937kE6LLAefsbs3VWviuzemY3ZfxQN3xRakSsoaliv7Y5GrVsw7Zpf8qD64tpv1zZyu1q8d5QYPVFraNGKOCBDIwggQuMB8GA1UdIwQYMBaAFFFo\/5CvAgd1PMzZZWRiohK4WXI7MB0GA1UdDgQWBBTOvtmcE\/Hpdw9nVhDPrrMPWW+2kzBtBgNVHREEZjBkghIqLmNkbi53aGF0c2FwcC5uZXSCEiouc25yLndoYXRzYXBwLm5ldIIOKi53aGF0c2FwcC5jb22CDioud2hhdHNhcHAubmV0ggx3aGF0c2FwcC5jb22CDHdoYXRzYXBwLm5ldDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zaGEyLWhhLXNlcnZlci1nNS5jcmwwNKAyoDCGLmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWhhLXNlcnZlci1nNS5jcmwwTAYDVR0gBEUwQzA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAIBgZngQwBAgIwgYMGCCsGAQUFBwEBBHcwdTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tME0GCCsGAQUFBzAChkFodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEySGlnaEFzc3VyYW5jZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIB8wYKKwYBBAHWeQIEAgSCAeMEggHfAd0AdQCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAVur6AdGAAAEAwBGMEQCIAdhL0JGHAwVstkFDxx5uR5tWMrXEnCfvfOAkhPvsX+vAiAtiNAjFenr8IsHyIUYNUyZMjKigiFM4zIicOvIQ5DBwQB1AFYUBpov18Ls0\/XhvUSyPsdGdrm8mRFcwO+UmFXWidDdAAABW6voCCYAAAQDAEYwRAIgDQwj0NpInNvmDAEDQ4iF6KcoHweDkWsnI4\/CZYl\/IasCIBnZc3Yh+lXUzgGhpKoW8UP5rkmTDNTqZacPZHfvsQ9AAHYA7ku9t3XOYLrhQmkfq+GeZqMPfl+wctiDAMR7iXqo\/csAAAFbq+gIGQAABAMARzBFAiA\/diVHEHyPEjw4Z8WjzlhKwA8CQfgK"}
00878{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":6,"flow_first_seen":1519924083411,"flow_last_seen":1519924083598,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1398,"flow_tot_l4_payload_len":1641,"flow_avg_l4_payload_len":273,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mmg-fna.whatsapp.net","ja3":"107144b88827da5da9ed42d8776ccdc5","ja3s":"2d1eb5817ece335c24904f516ad5da12","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
02312{"flow_id":1,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":599440,"pkt_caplen":1464,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1464,"pkt_l4_len":1430,"pkt":"kLkxKPrKXEl5dU5qCABFAAWqWBBAAFUGdAa5PNg1wKgCHQG7wgonNGbQPCaFY4AQAHIPdQAAAQEICgkhOVoo5RZW\/dcoXSxsCU5cBAIhAINpYGdpWpazDDNWkzT9AR6h8LyEDdOOiu12dnqLjpgnAHUAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFbq+gINwAABAMARjBEAiBNbuOMMijmq48wEigA3slTMwPvPBUfWU\/4HiDvX0W7twIgQbSpfsCXXKcWVWJ9SQwwLlHc5\/kWPUX+YuuSw4lvtAcwDQYJKoZIhvcNAQELBQADggEBAKQRblH81cOz2zGpLrJXKVJN+2RT6iGuRB0m8HtLDnViOFii7tA01AETzb\/L7K4HbmTAZQfoqSBnwHFSEHCADc4eWYZdR2U2Ufuolu2njjaxFekgWONG\/4xzBiNlIeRJjyflBRzXguDmsDa7zWatUfFbsv6fDRB4fAWF5JK9EfnADzrk+vI0GgTeIUkaiOnVjS8t78IFY5Hg+beLLgsLQhEz2pZSOmxwdnpYIfOgZ15tz0d1NeKorqQfcu8T77Jc\/QkRxQqfov8iS3+R602kQYkHG3B8Hd0ZwBt8kRHvwxG3ZmVmcgxu1BePoWkmVNTBeZV3W9REkaZYVGD+pjSm+UIABLUwggSxMIIDmaADAgECAhAE4eek3Fzy823AK0K4XRWfMA0GCSqGSIb3DQEBCwUAMGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJhbmNlIEVWIFJvb3QgQ0EwHhcNMTMxMDIyMTIwMDAwWhcNMjgxMDIyMTIwMDAwWjBwMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNzdXJhbmNlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALbgL8IkBshtBF\/X7wpkBrJ9IiZlFq5CQJvO3J+fdgc+wzBVhxm5T5QOWpQfVVa0wgIqr9CY7gtA18TQO3LIFJ7vkLERqa7SyLhDOtkLC9XVlfVAr8gd7U2cX1e3hlBomfWK2tLHBR+ol8ncpLGChC3GraWcxxmCpoUPXkRYKjeP\/TXxCwgnMlr1u4uepL1R0Cfi3TtCM6MFKMS7KMyarCsjDXjGe+ZecbdKPgj7gbcWFqGdIxJN5deSCKx1pJy6zReyHkQ1ZX9TJTnRHAqaYxsZknRoCjfCwlJIyzlaorbhXcHdoCC4IaKTJm8USiFBx+1tm\/JIL\/MD9aJoklMvXuMCAwEAAaOCAUkwggFFMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBLBgNVHR8ERDBCMECgPqA8hjpodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRIaWdoQXNzdXJhbmNlRVZSb290Q0EuY3JsMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMB0GA1UdDgQWBBRRaP+QrwIHdTzM2WVkYqISuFlyOzAfBgNVHSMEGDAWgBSxPsNpA\/i\/RwHUmCYaCALvY2QrwzANBgkqhkiG9w0BAQsFAAOCAQEAGIqViQPm"}
00991{"flow_id":1,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":599471,"pkt_caplen":478,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":478,"pkt_l4_len":444,"pkt":"kLkxKPrKXEl5dU5qCABFAAHQWBFAAFUGd9+5PNg1wKgCHQG7wgonNGxGPCaFY4AYAHKF1QAAAQEICgkhOVoo5RZWbd9c\/B1o6kqPg9ZRL41rRBaerGP10m5shJmLqoFxhFvtNE6wt3mSKcwtgGrwjiDheaT+A0cT6vWGyllxffQElmvTWVg9\/tMxJVwYOISj5p+C\/YxbmDFOzXieGv2Fy0mq8ieLmXL8PqrVQQva1TahvxxuR0l\/XtlIfAPZ\/YtJoJgmQkDr1pIRpGQKV1TE9R3WAl5rrO7EgJoScvpWk9f\/vzCFBjC\/C39O\/1cFnSTthcMr+6Z1qKwtFu99eSey68KdCwfqqoXTAaMgKEFZQyjSgeOq9ux7O3e2QGKABUFFAe8XBj7ewDObZ9NhLnKH5Gn8EgBXQB5w9R7JtBYDAwCUDAAAkAMAF0EExpxPVDtuBFQHuVAFHEBmpSGMKpf00BMYBiPWkLpyx+JNXrgOTd0KWUhyHFVmRn7iyER6R8bAChbG8edEynweeQUDAEcwRQIgDJYRyDjJIqHtT7MRLB7fEpcF0WqS8J4d5Lu3j7TveiICIQDlEvs2xCJNS6AkGDjgUA7kn1LXVV8M5pEZzXbiWZhoOBYDAwAEDgAAAA=="}
01247{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":8,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":8,"flow_first_seen":1519924083411,"flow_last_seen":1519924083599,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1398,"flow_tot_l4_payload_len":3451,"flow_avg_l4_payload_len":431,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mmg-fna.whatsapp.net","server_names":"*.cdn.whatsapp.net,*.snr.whatsapp.net,*.whatsapp.com,*.whatsapp.net,whatsapp.com,whatsapp.net","ja3":"107144b88827da5da9ed42d8776ccdc5","ja3s":"2d1eb5817ece335c24904f516ad5da12","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","issuerDN":"C=US, ST=California, L=Menlo Park, O=Facebook, Inc., CN=*.whatsapp.net","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1","fingerprint":"10:54:EB:4A:A2:2A:42:2F:A6:1C:E7:9C:F4:84:10:7E:30:2E:56:BB"}}
00429{"flow_id":1,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":602045,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIKAbs8JoVjJzRsRoAQB9l\/zgAAAQEICijlFrQJITla"}
00430{"flow_id":1,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":603044,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIKAbs8JoVjJzRt4oAQB9N+OAAAAQEICijlFrQJITla"}
00430{"flow_id":1,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":681986,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIKAbs8JoVjJzRt4oAQCAB9vgAAAQEICijlFwEJITla"}
00604{"flow_id":1,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924083,"pkt_ts_usec":964778,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"XEl5dU5qkLkxKPrKCABFAACyAABAAEAG5g7AqAIduTzYNcIKAbs8JoVjJzRt4oAYCADbUgAAAQEICijlGAAJITlaFgMDAEYQAABCQQRdV6wGCcOfzmkBM6UT7MLQweQglYbbBMmWC\/bTbVTeFNmERFNv6vjMpLPWUwkAgMMJDY92ziv5lE0LjXnahqCmFAMDAAEBFgMDACgAAAAAAAAAANRe9BeWafmHBmc3i\/AP4m88nQY\/ws+ghWGksOMTGrPc"}
00777{"flow_id":1,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924084,"pkt_ts_usec":60416,"pkt_caplen":324,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":324,"pkt_l4_len":290,"pkt":"kLkxKPrKXEl5dU5qCABFAAE2WBJAAFUGeHi5PNg1wKgCHQG7wgonNG3iPCaF4YAYAHI66gAAAQEICgkhOyQo5RgAFgMDAMoEAADGAAKjAADATITY1B9Ak7wZ6olRUGgkVPl3S5mgCrJekYUw0HX45Z9tQzv4rlsGmb+6NLUZ6w9Mxl3yixNtYRmbID+cqeo69nu8y0vFs1hO9HivALzzf9j40b0NikCxYoeQ0P+1UtRmYMXRNXrLprDl2bzvHQg0Zf8sEzS+f3lYmmex798boU7Lzz1Y9FphkwTwXdjo7fuWBUxelYpJv78DqNaEWn2BVLBww17aeRy+4RvBG25pGCQLky+W3IBA89xIJF673Xs6FAMDAAEBFgMDACjSpG+dn47MCFMdsvSuj5FxFTRYX6QESM80NxiP\/OYG0hUxje0vAoli"}
00541{"flow_id":1,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924084,"pkt_ts_usec":60422,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"pkt":"kLkxKPrKXEl5dU5qCABFAACFWBNAAFUGeSi5PNg1wKgCHQG7wgonNG7kPCaF4YAYAHKq7AAAAQEICgkhOyQo5RgAFwMDAEzSpG+dn47MCdcjbp4IzLg5l0yxO7j7YS34Peee5iNn2m7z9rMVpOz\/mVJ21Y6Ls0iC1tnnuAStIDHvozNy+E7SSWzXzb7BjEE8WbmQ"}
00430{"flow_id":1,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924084,"pkt_ts_usec":62704,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIKAbs8JoXhJzRu5IAQB\/t5AAAAAQEICijlGHoJITsk"}
00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":311,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1519924240121,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00448{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":311,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":121220,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"XEl5dU5qkLkxKPrKCABFAABAAABAAEAG5oDAqAIduTzYNcIiAbuCj0EnAAAAALDC\/\/+6MAAAAgQFtAEDAwYBAQgKKOd3WAAAAAAEAgAA"}
00442{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":312,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":177946,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"kLkxKPrKXEl5dU5qCABFAAA8AABAAFUG0YS5PNg1wKgCHQG7wiLPr2ypgo9BKKASbTgw1AAAAgQFggQCCAq3hjooKOd3WAEDAwg="}
00430{"flow_id":2,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":313,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":182174,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIiAbuCj0Eoz69sqoAQCAXEZQAAAQEICijnd5W3hjoo"}
01133{"flow_id":2,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":314,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":183173,"pkt_caplen":583,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":583,"pkt_l4_len":549,"pkt":"XEl5dU5qkLkxKPrKCABFAAI5AABAAEAG5IfAqAIduTzYNcIiAbuCj0Eoz69sqoAYCAWCiQAAAQEICijnd5a3hjooFgMBAgABAAH8AwNLVHn\/qWaqe3EcBfpck7lkGf95e1gm1h4KmRyfvYLGZSCx8n8z8XDJ+pVmShGZO5o0rp2h9+q5RbYekK14EkkJrwAowCzAK8AkwCPACsAJzKnAMMAvwCjAJ8AUwBPMqACdAJwAPQA8ADUALwEAAYv\/AQABAAAAABkAFwAAFG1tZy1mbmEud2hhdHNhcHAubmV0ABcAAAAjAMBMhNjUH0CTvBnqiVFQaCRU+XdLmaAKsl6RhTDQdfjln21DO\/iuWwaZv7o0tRnrD0zGXfKLE21hGZsgP5yp6jr2e7zLS8WzWE70eK8AvPN\/2PjRvQ2KQLFih5DQ\/7VS1GZgxdE1esumsOXZvO8dCDRl\/ywTNL5\/eViaZ7Hv3xuhTsvPPVj0WmGTBPBd2Ojt+5YFTF6Vikm\/vwOo1oRafYFUsHDDXtp5HL7hG8EbbmkYJAuTL5bcgEDz3EgkXrvdezoADQAUABIEAwgEBAEFAwgFBQEIBgYBAgEABQAFAQAAAAAzdAAAABIAAAAQADAALgJoMgVoMi0xNgVoMi0xNQVoMi0xNAhzcGR5LzMuMQZzcGR5LzMIaHR0cC8xLjEACwACAQAACgAIAAYAHQAXABgAFQAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="}
00822{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":314,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_first_seen":1519924240121,"flow_last_seen":1519924240183,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":517,"flow_avg_l4_payload_len":129,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49698,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mmg-fna.whatsapp.net","ja3":"4e1a414c4f4c99097edd2a9a98e336c8","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
00430{"flow_id":2,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":315,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":243918,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"kLkxKPrKXEl5dU5qCABFAAA0Vs5AAFUGer65PNg1wKgCHQG7wiLPr2yqgo9DLYAQAHLJsAAAAQEICreGOmoo53eW"}
00632{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":316,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":244034,"pkt_caplen":212,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":212,"pkt_l4_len":178,"pkt":"kLkxKPrKXEl5dU5qCABFAADGVs9AAFUGeiu5PNg1wKgCHQG7wiLPr2yqgo9DLYAYAHK+xQAAAQEICreGOmoo53eWFgMDAFoCAABWAwMLRBt1h0+Ajb66OiYB8NNd0wKhDeQemNCYHWdmUob\/sCCx8n8z8XDJ+pVmShGZO5o0rp2h9+q5RbYekK14EkkJr8ArAAAO\/wEAAQAAEAAFAAMCaDIUAwMAAQEWAwMAKCefUt2iPQKuNPxVIK+TBqcb15iKo36mH+uDwU\/pzNiwUl4kJCwY2Lg="}
00878{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":316,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":6,"flow_first_seen":1519924240121,"flow_last_seen":1519924240244,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":517,"flow_tot_l4_payload_len":663,"flow_avg_l4_payload_len":110,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49698,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.WhatsAppFiles","breed":"Acceptable","category":"Download-FileTransfer-FileSharing"},"tls": {"version":"TLSv1.2","client_requested_server_name":"mmg-fna.whatsapp.net","ja3":"4e1a414c4f4c99097edd2a9a98e336c8","ja3s":"96681175a9547081bf3d417f1a572091","unsafe_cipher":0,"cipher":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","alpn":"h2,h2-16,h2-15,h2-14,spdy\/3.1,spdy\/3,http\/1.1"}}
00430{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":317,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":248126,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIiAbuCj0Mtz69tPIAQCAPBTQAAAQEICijnd9a3hjpq"}
00500{"flow_id":2,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":318,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":249124,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"XEl5dU5qkLkxKPrKCABFAABnAABAAEAG5lnAqAIduTzYNcIiAbuCj0Mtz69tPIAYCAN6CAAAAQEICijnd9a3hjpqFAMDAAEBFgMDACgAAAAAAAAAANdfhyIP4+1Mi6+0AJlnmtiOXBq8OASkMp6UrXYXlEpc"}
00504{"flow_id":2,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":319,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":254122,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"XEl5dU5qkLkxKPrKCABFAABpAABAAEAG5lfAqAIduTzYNcIiAbuCj0Ngz69tPIAYCAO+EgAAAQEICijnd9u3hjpqFwMDADAAAAAAAAAAAauzMkgQ0N+NwIi4B1AH6wgdJgK7X8Q7cVpebPo9K0xiVYBRpILWCsU="}
00502{"flow_id":2,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":320,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":254126,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"XEl5dU5qkLkxKPrKCABFAABmAABAAEAG5lrAqAIduTzYNcIiAbuCj0OVz69tPIAYCAPQRgAAAQEICijnd9u3hjpqFwMDAC0AAAAAAAAAAmFnpgjORwk8oq90nd2tyh8VTc2tO6n\/Z0sD6qO57Ry5JLQTilw="}
00490{"flow_id":2,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":321,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":255120,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"XEl5dU5qkLkxKPrKCABFAABeAABAAEAG5mLAqAIduTzYNcIiAbuCj0PHz69tPIAYCAO49gAAAQEICijnd9y3hjpqFwMDACUAAAAAAAAAAw4lY\/RXECpBhLX1bSNKQwoQHaB7U0UdeY8FT4Wu"}
00737{"flow_id":2,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":322,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":255124,"pkt_caplen":290,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":290,"pkt_l4_len":256,"pkt":"XEl5dU5qkLkxKPrKCABFAAEUAABAAEAG5azAqAIduTzYNcIiAbuCj0Pxz69tPIAYCAMluwAAAQEICijnd9y3hjpqFwMDANsAAAAAAAAABAnxCfWOecoK+43GJ7tLm2RmkIHeG7mEMaMvmJFJuz\/IDQiz6GYF89+O\/CAwOu+htaIl5YNKFiAGjA9S1YIScC0U6tbele0v9p+wygdy0uLaSvPi3WjJmc6fg66MyBQsdeyz9Y7A07CFaLIdfuObF25SX0h6YOBzH3cB6yBiSIq8uRa7czogf8n8\/heQxioQwfZda6QxWf8jXKUMC0ZtHFwBL2MUd8T25BFAhhvhbL8+CJJLntdrM6QoG8dkJ3Pn8xtSaxdoMqnCHda1Ha495l++vYo="}
00544{"flow_id":2,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":323,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":303930,"pkt_caplen":147,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":147,"pkt_l4_len":113,"pkt":"kLkxKPrKXEl5dU5qCABFAACFVtBAAFUGemu5PNg1wKgCHQG7wiLPr208go9DYIAYAHJd7gAAAQEICreGOqco53fWFwMDAEwnn1Ldoj0Cr5\/Im58b20pVNsEUdlvAxt5j+2mE6973guqJvkeaSOw7r5BrbRlq9NgfbBt7cCvCjOmKkI3k1Bgn5\/BcHUaq6GBshCdh"}
00431{"flow_id":2,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":324,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":306082,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"XEl5dU5qkLkxKPrKCABFAAA0AABAAEAG5ozAqAIduTzYNcIiAbuCj0TRz69tjYAQCAG+5AAAAQEICijneA+3hjqn"}
00486{"flow_id":2,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":325,"source":"whatsappfiles.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1519924240,"pkt_ts_usec":306087,"pkt_caplen":104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":104,"pkt_l4_len":70,"pkt":"XEl5dU5qkLkxKPrKCABFAABaAABAAEAG5mbAqAIduTzYNcIiAbuCj0TRz69tjYAYCAGn0QAAAQEICijneA+3hjqnFwMDACEAAAAAAAAABZSoQs4Gsxi2Tj\/BQp5xrm7kfCitYcqpn3Y="}
00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":310,"flow_first_seen":1519924083411,"flow_last_seen":1519924193429,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1398,"flow_tot_l4_payload_len":183524,"flow_avg_l4_payload_len":592,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49674,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":310,"flow_first_seen":1519924240121,"flow_last_seen":1519924247388,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1398,"flow_tot_l4_payload_len":226819,"flow_avg_l4_payload_len":731,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.2.29","dst_ip":"185.60.216.53","src_port":49698,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15}
00134{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":620,"source":"whatsappfiles.pcap","alias":"nDPId-test"}
~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
~~ packets captured/processed: 620/620
~~ skipped flows.............: 0
~~ total layer4 data length..: 431135 bytes
~~ total detected protocols..: 2
~~ total active/idle flows...: 2/2
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~ total memory allocated....: 4851760 bytes
~~ total memory freed........: 4851760 bytes
~~ total allocations/frees...: 58995/58995
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|