bump libnDPI to 2b230e28e0612e8654ad617534deb9aaaabd51b7

* fixes loading of gambling lists which increased nDPId's memory usage *a lot*
 * nDPId: handle EINTR correctly

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

nDPId.c

@@ -586,9 +586,14 @@ static void jsonize_flow_detection_event(struct nDPId_reader_thread * const read
 
 static int set_collector_nonblock(struct nDPId_reader_thread * const reader_thread)
 {
-    int current_flags = fcntl(reader_thread->collector_sockfd, F_GETFL, 0);
+    int current_flags;
 
-    if (current_flags == -1 || fcntl(reader_thread->collector_sockfd, F_SETFL, current_flags | O_NONBLOCK) == -1)
+    while ((current_flags = fcntl(reader_thread->collector_sockfd, F_GETFL, 0)) == -1 && errno == EINTR) {}
+    if (current_flags == -1) {
+    }
+
+    while ((current_flags = fcntl(reader_thread->collector_sockfd, F_SETFL, current_flags | O_NONBLOCK)) == -1 && errno == EINTR) {}
+    if (current_flags == -1)
     {
         reader_thread->collector_sock_last_errno = errno;
         logger(1,
@@ -1318,7 +1323,7 @@ static struct nDPId_workflow * init_workflow(char const * const file_or_device)
         pcap_freecode(&fp);
     }
 
-    ndpi_init_prefs init_prefs = ndpi_no_prefs;
+    ndpi_init_prefs init_prefs = ndpi_no_prefs | ndpi_dont_load_gambling_list;
     workflow->ndpi_struct = ndpi_init_detection_module(init_prefs);
     if (workflow->ndpi_struct == NULL)
     {

test/results/caches_cfg/ookla.pcap.out

@@ -61,9 +61,9 @@
 ~~ total active/idle flows...: 6/6
 ~~ total timeout flows.......: 1
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7995315 bytes
-~~ total memory freed........: 7995315 bytes
-~~ total allocations/frees...: 148474/148474
+~~ total memory allocated....: 7625096 bytes
+~~ total memory freed........: 7625096 bytes
+~~ total allocations/frees...: 142877/142877
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 1402 chars

test/results/caches_cfg/teams.pcap.out

@@ -686,9 +686,9 @@
 ~~ total active/idle flows...: 83/83
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 9092192 bytes
-~~ total memory freed........: 9092192 bytes
-~~ total allocations/frees...: 151087/151087
+~~ total memory allocated....: 8723821 bytes
+~~ total memory freed........: 8723821 bytes
+~~ total allocations/frees...: 145490/145490
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 298 chars
 ~~ json string max len.......: 2504 chars

test/results/default/1kxun.pcap.out

@@ -1290,9 +1290,9 @@
 ~~ total active/idle flows...: 197/197
 ~~ total timeout flows.......: 20
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8506082 bytes
-~~ total memory freed........: 8506082 bytes
-~~ total allocations/frees...: 152931/152931
+~~ total memory allocated....: 8140447 bytes
+~~ total memory freed........: 8140447 bytes
+~~ total allocations/frees...: 147334/147334
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 9026 chars

test/results/default/443-chrome.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966176 bytes
-~~ total memory freed........: 7966176 bytes
-~~ total allocations/frees...: 148289/148289
+~~ total memory allocated....: 7595837 bytes
+~~ total memory freed........: 7595837 bytes
+~~ total allocations/frees...: 142692/142692
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2505 chars

test/results/default/443-curl.pcap.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7974227 bytes
-~~ total memory freed........: 7974227 bytes
-~~ total allocations/frees...: 148404/148404
+~~ total memory allocated....: 7603888 bytes
+~~ total memory freed........: 7603888 bytes
+~~ total allocations/frees...: 142807/142807
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 2167 chars

test/results/default/443-firefox.pcap.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7990463 bytes
-~~ total memory freed........: 7990463 bytes
-~~ total allocations/frees...: 148963/148963
+~~ total memory allocated....: 7620124 bytes
+~~ total memory freed........: 7620124 bytes
+~~ total allocations/frees...: 143366/143366
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 517 chars
 ~~ json string max len.......: 2182 chars

test/results/default/443-git.pcap.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7976612 bytes
-~~ total memory freed........: 7976612 bytes
-~~ total allocations/frees...: 148367/148367
+~~ total memory allocated....: 7606273 bytes
+~~ total memory freed........: 7606273 bytes
+~~ total allocations/frees...: 142770/142770
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2459 chars

test/results/default/443-opvn.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7967481 bytes
-~~ total memory freed........: 7967481 bytes
-~~ total allocations/frees...: 148334/148334
+~~ total memory allocated....: 7597142 bytes
+~~ total memory freed........: 7597142 bytes
+~~ total allocations/frees...: 142737/142737
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 2200 chars

test/results/default/443-safari.pcap.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7972285 bytes
-~~ total memory freed........: 7972285 bytes
-~~ total allocations/frees...: 148336/148336
+~~ total memory allocated....: 7601946 bytes
+~~ total memory freed........: 7601946 bytes
+~~ total allocations/frees...: 142739/142739
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2164 chars

test/results/default/4in4tunnel.pcap.out

@@ -23,9 +23,9 @@
 ~~ total active/idle flows...: 0/0
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7961999 bytes
-~~ total memory freed........: 7961999 bytes
-~~ total allocations/frees...: 148276/148276
+~~ total memory allocated....: 7591636 bytes
+~~ total memory freed........: 7591636 bytes
+~~ total allocations/frees...: 142679/142679
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 303 chars
 ~~ json string max len.......: 582 chars

test/results/default/4in6tunnel.pcap.out

@@ -16,9 +16,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964215 bytes
-~~ total memory freed........: 7964215 bytes
-~~ total allocations/frees...: 148291/148291
+~~ total memory allocated....: 7593876 bytes
+~~ total memory freed........: 7593876 bytes
+~~ total allocations/frees...: 142694/142694
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2494 chars

test/results/default/6in4tunnel.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7967782 bytes
-~~ total memory freed........: 7967782 bytes
-~~ total allocations/frees...: 148414/148414
+~~ total memory allocated....: 7597443 bytes
+~~ total memory freed........: 7597443 bytes
+~~ total allocations/frees...: 142817/142817
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2020 chars

test/results/default/6in6tunnel.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966257 bytes
-~~ total memory freed........: 7966257 bytes
-~~ total allocations/frees...: 148300/148300
+~~ total memory allocated....: 7595942 bytes
+~~ total memory freed........: 7595942 bytes
+~~ total allocations/frees...: 142703/142703
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 998 chars

test/results/default/BGP_Cisco_hdlc_slarp.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964505 bytes
-~~ total memory freed........: 7964505 bytes
-~~ total allocations/frees...: 148301/148301
+~~ total memory allocated....: 7594166 bytes
+~~ total memory freed........: 7594166 bytes
+~~ total allocations/frees...: 142704/142704
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 526 chars
 ~~ json string max len.......: 980 chars

test/results/default/BGP_redist.pcap.out

@@ -15,9 +15,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964128 bytes
-~~ total memory freed........: 7964128 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593789 bytes
+~~ total memory freed........: 7593789 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 301 chars
 ~~ json string max len.......: 1090 chars

test/results/default/EAQ.pcap.out

@@ -275,9 +275,9 @@
 ~~ total active/idle flows...: 31/31
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8033021 bytes
-~~ total memory freed........: 8033021 bytes
-~~ total allocations/frees...: 148827/148827
+~~ total memory allocated....: 7663402 bytes
+~~ total memory freed........: 7663402 bytes
+~~ total allocations/frees...: 143230/143230
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 509 chars
 ~~ json string max len.......: 1206 chars

test/results/default/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out

@@ -27,9 +27,9 @@
 02335{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":44,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":1228468937630923,"flow_src_last_pkt_time":1228468963851351,"flow_dst_last_pkt_time":1228468963854227,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":45,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":334,"flow_dst_max_l4_payload_len":372,"flow_src_tot_l4_payload_len":1020,"flow_dst_tot_l4_payload_len":3039,"midstream":0,"thread_ts_usec":1228468963854227,"l3_proto":"ip4","src_ip":"10.35.40.22","dst_ip":"10.23.1.42","src_port":2944,"dst_port":2944,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":15,"avg":1691733.2,"max":4370196,"stddev":2031243.2,"var":4125948903424.0,"ent":3.7,"data": [147,2580,146,4369720,177,4369379,142,4370170,85,4370186,150,4369866,79,4370149,291,4370036,88,4369436,150,3508424,3524296,204367,192966,657514,15,652477,151,4369658,82,4370196,609]},"pktlen": {"min":73,"avg":154.8,"max":400,"stddev":98.9,"var":9786.3,"ent":4.7,"data": [73,73,278,150,73,73,278,150,73,73,278,150,73,73,278,150,73,73,278,150,362,400,80,87,74,74,279,151,74,74,279,151]},"bins": {"c_to_s": [0,15,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,1,0,7,0,0,0,7,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},"directions": [0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,1,0,1,0,0,1,1,0,0,1,1],"entropies": [5.184563637,5.058271885,5.379110336,5.406789303,5.184563637,5.179216385,5.374631405,5.446616650,5.168875217,5.151818752,5.378158569,5.424983501,5.206613541,5.151818752,5.376394272,5.444680214,5.168875217,5.134762764,5.362365723,5.408768177,5.778869152,5.247618675,5.299749374,5.105933189,5.158446312,5.175271988,5.367991447,5.455423832,5.202299118,5.175271988,5.384085178,5.429594994]},"ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"Megaco","proto_id":"181","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
 00799{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1228468965434208,"flow_src_last_pkt_time":1228468965434208,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":172,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":172,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":172,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1228468965434208,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":5}
 00765{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_src_last_pkt_time":1228468965434208,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_usec":1228468965434208,"pkt":"ABgYesP\/AAglAXLqCABFuADIHecAAD0RDLUKIzxkChcBNDzcQXQAtEC7gAgAAGfPFaAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="}
-00944{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1228468965434208,"flow_src_last_pkt_time":1228468965434208,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":172,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":172,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":172,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1228468965434208,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 00765{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":2,"flow_src_last_pkt_time":1228468965455031,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_usec":1228468965455031,"pkt":"ABgYesP\/AAglAXLqCABFuADIHegAAD0RDLQKIzxkChcBNDzcQXQAtEAagAgAAWfPFkAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="}
 00765{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":3,"flow_src_last_pkt_time":1228468965474173,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_usec":1228468965474173,"pkt":"ABgYesP\/AAglAXLqCABFuADIHekAAD0RDLMKIzxkChcBNDzcQXQAtD95gAgAAmfPFuAOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="}
+00944{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":47,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":0,"flow_first_seen":1228468965434208,"flow_src_last_pkt_time":1228468965474173,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":172,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":172,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":516,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1228468965474173,"l3_proto":"ip4","src_ip":"10.35.60.100","dst_ip":"10.23.1.52","src_port":15580,"dst_port":16756,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 01561{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":4,"flow_src_last_pkt_time":1228468958657176,"flow_dst_last_pkt_time":1228468965488757,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":811,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":811,"pkt_l4_len":777,"thread_ts_usec":1228468965488757,"pkt":"AAglAXLkABZGR+C\/CABFuAMdHeoAAD0RAsHAqGTbioSpZRPEE8QDCWBVU0lQLzIuMCAyMDAgT0sNCkFsbG93OiBJTlZJVEUsQUNLLE9QVElPTlMsQllFLENBTkNFTCxJTkZPLFJFRkVSLE5PVElGWSxVUERBVEUNCkNhbGwtSUQ6IFNENDkwOTcwMS05ZmYxMWJmNzJlYjRhMzQ3YzkyOTc0ZDhmYmJjMjY2OC1hbzhvM2kxDQpDb250YWN0OiA8c2lwOjA2MTk2MzE3N0AxOTIuMTY4LjEwMC4yMTk6NTA2MD4NCkNvbnRlbnQtTGVuZ3RoOiAyMTINCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpDU2VxOiAxIElOVklURQ0KRnJvbTogPHNpcDp1bmF2YWlsYWJsZUBob3N0cG9ydGlvbj47dGFnPVNENDkwOTcwMS0wMGU5ZDQ3OA0KTWluLVNFOiA5MA0KU2VydmVyOiBBcmNvci9BcmNvci0xLjAyLjAwNXQyDQpTdXBwb3J0ZWQ6IHJlcGxhY2VzLHRpbWVyDQpUbzogPHNpcDowNjE5NjMxNzdAaXRhbHRlbC5pdDt1c2VyPXBob25lPjt0YWc9NjE3MjYzNjE2NDc5NjE2RS0zMzE3MTU1MjAtNTMzNmY3ODUtMTg3NDEwMjA1DQpWaWE6IFNJUC8yLjAvVURQIDEzOC4xMzIuMTY5LjEwMTo1MDYwO2JyYW5jaD16OWhHNGJLZnYyZjQwMTA3ODdoM2E4cTEyODAuMQ0KDQp2PTANCm89LSA3NTQ1ODA0MjMgMSBJTiBJUDQgMTkyLjE2OC4xMDAuMjE5DQpzPS0NCmM9SU4gSVA0IDE5Mi4xNjguMTAwLjIxOQ0KdD0wIDANCm09YXVkaW8gNTAwMiBSVFAvQVZQIDggMTAyDQphPXJ0cG1hcDo4IFBDTUEvODAwMA0KYT1ydHBtYXA6MTAyIHRlbGVwaG9uZS1ldmVudC84MDAwDQphPWZtdHA6MTAyIDAtMTUsMzINCmE9cHRpbWU6MjANCmE9c2VuZHJlY3YNCg=="}
 01576{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":4,"flow_src_last_pkt_time":1228468958651179,"flow_dst_last_pkt_time":1228468965492834,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":825,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":825,"pkt_l4_len":791,"thread_ts_usec":1228468965492834,"pkt":"ABEKVkXQAAglAXLqCABFAAMrAABAAIARatAKIzxkCiM8SBPEE8QDF31BU0lQLzIuMCAyMDAgT0sNClZpYTogU0lQLzIuMC9VRFAgMTAuMzUuNjAuNzI6NTA2MDticmFuY2g9ejloRzRiSy5pSWlJaUkuMGEyMzI4MTkuZTlkNGJkDQpUbzogPHNpcDowNjE5NjMxNzdAaXRhbHRlbC5pdDt1c2VyPXBob25lPjt0YWc9U0Q0OTA5Nzk5LTYxNzI2MzYxNjQ3OTYxNkUtMzMxNzE1NTIwLTUzMzZmNzg1LTE4NzQxMDIwNQ0KRnJvbTogPHNpcDp1bmF2YWlsYWJsZUBob3N0cG9ydGlvbj47dGFnPTAwZTlkNDc4DQpDYWxsLUlEOiAwMGU5ZDRhNTAwZTlkNDgtMDAxNS0wMDAxLTAwMDAtMDAwMEAxMC4zNS40MC4yNQ0KQ1NlcTogMSBJTlZJVEUNCkFsbG93OiBJTlZJVEUsQUNLLE9QVElPTlMsQllFLENBTkNFTCxJTkZPLFJFRkVSLE5PVElGWSxVUERBVEUNCkNvbnRhY3Q6IDxzaXA6MDYxOTYzMTc3LWlraHV1ZXA1YmkxMjNAMTAuMzUuNjAuMTAwOjUwNjA7dHJhbnNwb3J0PXVkcD4NCkNvbnRlbnQtTGVuZ3RoOiAyMDcNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2RwDQpNaW4tU0U6IDkwDQpTZXJ2ZXI6IEFyY29yL0FyY29yLTEuMDIuMDA1dDINClN1cHBvcnRlZDogcmVwbGFjZXMsdGltZXINCg0Kdj0wDQpvPS0gNzU0NTgwNDIzIDEgSU4gSVA0IDEwLjM1LjYwLjEwMA0Kcz0tDQpjPUlOIElQNCAxMC4zNS42MC4xMDANCnQ9MCAwDQptPWF1ZGlvIDE1NTgwIFJUUC9BVlAgOCAxMDINCmE9cnRwbWFwOjggUENNQS84MDAwDQphPXJ0cG1hcDoxMDIgdGVsZXBob25lLWV2ZW50LzgwMDANCmE9Zm10cDoxMDIgMC0xNSwzMg0KYT1wdGltZToyMA0KYT1zZW5kcmVjdg0K"}
 00765{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"cfgs\/default\/pcap\/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":4,"flow_src_last_pkt_time":1228468965513703,"flow_dst_last_pkt_time":1228468965434208,"flow_idle_time":200000000,"pkt_datalink":1,"pkt_caplen":214,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":214,"pkt_l4_len":180,"thread_ts_usec":1228468965513703,"pkt":"ABgYesP\/AAglAXLqCABFuADIHesAAD0RDLEKIzxkChcBNDzcQXQAtD7YgAgAA2fPF4AOrw6v1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1Q=="}
@@ -58,9 +58,9 @@
 ~~ total active/idle flows...: 5/5
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8017507 bytes
-~~ total memory freed........: 8017507 bytes
-~~ total allocations/frees...: 149883/149883
+~~ total memory allocated....: 7647264 bytes
+~~ total memory freed........: 7647264 bytes
+~~ total allocations/frees...: 144286/144286
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 534 chars
 ~~ json string max len.......: 2357 chars

test/results/default/IEC104.pcap.out

@@ -23,9 +23,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966634 bytes
-~~ total memory freed........: 7966634 bytes
-~~ total allocations/frees...: 148313/148313
+~~ total memory allocated....: 7596319 bytes
+~~ total memory freed........: 7596319 bytes
+~~ total allocations/frees...: 142716/142716
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1103 chars

test/results/default/KakaoTalk_chat.pcap.out

@@ -276,9 +276,9 @@
 ~~ total active/idle flows...: 38/38
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8180105 bytes
-~~ total memory freed........: 8180105 bytes
-~~ total allocations/frees...: 149269/149269
+~~ total memory allocated....: 7810654 bytes
+~~ total memory freed........: 7810654 bytes
+~~ total allocations/frees...: 143672/143672
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 520 chars
 ~~ json string max len.......: 2369 chars

test/results/default/KakaoTalk_talk.pcap.out

@@ -58,17 +58,17 @@
 01067{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":79,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":11,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1430069170975714,"flow_src_last_pkt_time":1430069170975714,"flow_dst_last_pkt_time":1430069170975714,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":78,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":78,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":78,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069170975714,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":10269,"dst_port":23047,"l4_proto":"udp","ndpi": {"flow_risk": {"46": {"risk":"Unidirectional Traffic","severity":"Low","risk_score": {"total":500,"client":430,"server":70}}},"confidence": {"6":"DPI"},"proto":"KakaoTalk_Voice","proto_id":"194","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":10,"category":"VoIP"}}
 00786{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":82,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1430069171118750,"flow_src_last_pkt_time":1430069171118750,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":56,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":56,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":56,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171118750,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":11320,"dst_port":23044,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":5}
 00600{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":82,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_src_last_pkt_time":1430069171118750,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":100,"pkt_l4_len":64,"thread_ts_usec":1430069171118750,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFQAAEAAPxHbTgoYUrwByQGuLDhaBABATCmA7E6yizmc2guGVRn+xfaQv+g9g3ccEnajV1GbM8MpJWVK2C77CAiJwDoJYkgGCqWuS2HWMkwGeQ=="}
-00929{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":82,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1430069171118750,"flow_src_last_pkt_time":1430069171118750,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":56,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":56,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":56,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171118750,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":11320,"dst_port":23044,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":83,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":2,"flow_src_last_pkt_time":1430069171120856,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171120856,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFMAAEAAPxHbTwoYUrwByQGuLDhaBAA\/C92AbE6zizmgmguGVRkt\/rZnfXpGz0N2A\/IfJpewUyMSY166JO1xGXdEkGNQd31ADIw6ZS3SDh9Y"}
 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":3,"flow_src_last_pkt_time":1430069171120948,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171120948,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFMAAEAAPxHbTwoYUrwByQGuLDhaBAA\/5SmAbE60izmkWguGVRmezvGSQL2r8\/lU9MEKvF6SC08uWokrFHcn2V7\/8UTxLNEjkf5mPRch1tsI"}
+00930{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":84,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":0,"flow_first_seen":1430069171118750,"flow_src_last_pkt_time":1430069171120948,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":55,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":56,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":166,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171120948,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":11320,"dst_port":23044,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 00631{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":85,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":2,"flow_src_last_pkt_time":1430069170892951,"flow_dst_last_pkt_time":1430069171127448,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":122,"pkt_l4_len":86,"thread_ts_usec":1430069171127448,"pkt":"AAACEgAAAAAAAAAAAAAIAEUoAGoAAEAAGxH\/EAHJAa4KGFK8WgUsOQBWReSByQAHVJql2hcYBvUW09\/cV2PnqW9IAC+tkcS3zbxHaXzNy97m1tMPsxdrmxKMjQTBocmvV+MtI4fyJpYC3zCcgAAAAaPWslm6g8tl\/I8="}
 00597{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_src_last_pkt_time":1430069171212226,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171212226,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFMAAEAAPxHbTwoYUrwByQGuLDhaBAA\/jTmAbE61izmoGguGVRn1lqaVNU04\/0pxhmXG3LpjHLoEtStGBpgmAENokf++6bVHtFV\/dhtsB+qy"}
 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":5,"flow_src_last_pkt_time":1430069171212470,"flow_dst_last_pkt_time":1430069171118750,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171212470,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFMAAEAAPxHbTwoYUrwByQGuLDhaBAA\/7uaAbE62izmr2guGVRn8RhAolyCXjh9CBCF49gOSkQpyC1NGr5hVj6UCX85c7EbzzNysGYkXDN7V"}
 00786{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":91,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1430069171389136,"flow_src_last_pkt_time":1430069171389136,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":79,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":79,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":79,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171389136,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":10268,"dst_port":23046,"l4_proto":"udp","flow_datalink":113,"flow_max_packets":5}
 00629{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":91,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_src_last_pkt_time":1430069171389136,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":123,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":123,"pkt_l4_len":87,"thread_ts_usec":1430069171389136,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAGsAAEAAQBHaNwoYUrwByQGuKBxaBgBXWCuA7DE+fqkVA1Sapdp6cTmDebnhh8KUkQVLcfVIHO+KdE\/hh8TrsDi1pxsxiqViFSLVRYeZKeMWrEXQddUHKF8UZHmGznF9XlwFasBuVesU"}
-00929{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":91,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1430069171389136,"flow_src_last_pkt_time":1430069171389136,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":79,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":79,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":79,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171389136,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":10268,"dst_port":23046,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 00723{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":93,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":2,"flow_src_last_pkt_time":1430069171425208,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":192,"pkt_l4_len":156,"thread_ts_usec":1430069171425208,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAALAAAEAAQBHZ8goYUrwByQGuKBxaBgCccR6AbDE\/fqkYw1SapdpQtIGDUUcsKy8FZc8SkcXbnkaLnkk7o+K31\/Lp8iVo3SBPJc3DyoRUtaFntc3koP5JLgEppFZXqNkw36nmYntuZ329GNTJ06T0XeyZJfDm34fzEotPLv3zEaM1kQ76cuJR6IF9rGbKT3sQKWcYIsd5M3XbqcXgkS4bFd8efSkCV9pxMGaMM2HU"}
 00621{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":3,"flow_src_last_pkt_time":1430069171464453,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":115,"pkt_l4_len":79,"thread_ts_usec":1430069171464453,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAGMAAEAAQBHaPwoYUrwByQGuKBxaBgBPG\/OAbDFAfqkcg1SapdrEmBFpbnVmJMblF0rZoL8vvV92uiSDpJJT7NfUzojI6pP2kn9ZuUksJi0oXTyacMa3Otx9PZKNJxznlw=="}
+00931{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":94,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":0,"flow_first_seen":1430069171389136,"flow_src_last_pkt_time":1430069171464453,"flow_dst_last_pkt_time":1430069171389136,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":71,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":148,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":298,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1430069171464453,"l3_proto":"ip4","src_ip":"10.24.82.188","dst_ip":"1.201.1.174","src_port":10268,"dst_port":23046,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"RTP","proto_id":"87","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":0,"breed":"Acceptable","category_id":1,"category":"Media"}}
 00595{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":98,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":4,"flow_src_last_pkt_time":1430069171464453,"flow_dst_last_pkt_time":1430069171529486,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171529486,"pkt":"AAACEgAAAAAAAAAAAAAIAEUoAFMAAEAAGhEAKAHJAa4KGFK8WgYoHAA\/9kiAbE65izm3GguGVRmdGcA+AQC9PW6Iu7D56EiFtVEV8BRmHczMxTAvU5GNKbDmUz3uXGfPQe61"}
 00596{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":100,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":5,"flow_src_last_pkt_time":1430069171566474,"flow_dst_last_pkt_time":1430069171529486,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":99,"pkt_l4_len":63,"thread_ts_usec":1430069171566474,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAFMAAEAAQBHaTwoYUrwByQGuKBxaBgA\/KK6AbDFBfqkgQ1SapdqU2NQbnkxB3Xf0AOGlSFlAxEVDNvMv8YdF7fCM5vVAJXsQ3FrK2qCKRi6W"}
 00661{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":130,"source":"cfgs\/default\/pcap\/KakaoTalk_talk.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":3,"flow_src_last_pkt_time":1430069171998328,"flow_dst_last_pkt_time":1430069171127448,"flow_idle_time":200000000,"pkt_datalink":113,"pkt_caplen":142,"pkt_type":2048,"pkt_l3_offset":16,"pkt_l4_offset":36,"pkt_len":142,"pkt_l4_len":106,"thread_ts_usec":1430069171998328,"pkt":"AAQCEgAAAAAAAAAAAAAIAEUAAH4AAEAAPxHbJAoYUrwByQGuLDlaBQBqX6qByAAMC4ZVGUMDyNdZMqzZvFL5masXDZVA6JQCTSwYzII6r0J+H6ebHDpiG6\/AGpupgF2zzgl2ppSiLVPnYiD98U8UjOQ2fRfyw\/ugiovyQFT+lfaAAAACkQQ8eHVaWMSL\/A=="}
@@ -150,9 +150,9 @@
 ~~ total active/idle flows...: 20/20
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8122077 bytes
-~~ total memory freed........: 8122077 bytes
-~~ total allocations/frees...: 151732/151732
+~~ total memory allocated....: 7752194 bytes
+~~ total memory freed........: 7752194 bytes
+~~ total allocations/frees...: 146135/146135
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 520 chars
 ~~ json string max len.......: 2713 chars

test/results/default/NTPv2.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964128 bytes
-~~ total memory freed........: 7964128 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593789 bytes
+~~ total memory freed........: 7593789 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 1087 chars

test/results/default/NTPv3.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964128 bytes
-~~ total memory freed........: 7964128 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593789 bytes
+~~ total memory freed........: 7593789 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 1084 chars

test/results/default/NTPv4.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964128 bytes
-~~ total memory freed........: 7964128 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593789 bytes
+~~ total memory freed........: 7593789 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 1084 chars

test/results/default/Oscar.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7968206 bytes
-~~ total memory freed........: 7968206 bytes
-~~ total allocations/frees...: 148359/148359
+~~ total memory allocated....: 7597867 bytes
+~~ total memory freed........: 7597867 bytes
+~~ total allocations/frees...: 142762/142762
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 2004 chars

test/results/default/TivoDVR.pcap.out

@@ -14,9 +14,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964129 bytes
-~~ total memory freed........: 7964129 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593790 bytes
+~~ total memory freed........: 7593790 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 1093 chars

test/results/default/WebattackRCE.pcap.out

@@ -3197,9 +3197,9 @@
 ~~ total active/idle flows...: 797/797
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 9809943 bytes
-~~ total memory freed........: 9809943 bytes
-~~ total allocations/frees...: 162411/162411
+~~ total memory allocated....: 9458708 bytes
+~~ total memory freed........: 9458708 bytes
+~~ total allocations/frees...: 156814/156814
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 518 chars
 ~~ json string max len.......: 1892 chars

test/results/default/WebattackSQLinj.pcap.out

@@ -81,9 +81,9 @@
 ~~ total active/idle flows...: 9/9
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7987140 bytes
-~~ total memory freed........: 7987140 bytes
-~~ total allocations/frees...: 148552/148552
+~~ total memory allocated....: 7616993 bytes
+~~ total memory freed........: 7616993 bytes
+~~ total allocations/frees...: 142955/142955
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 521 chars
 ~~ json string max len.......: 1507 chars

test/results/default/WebattackXSS.pcap.out

@@ -5311,9 +5311,9 @@
 ~~ total active/idle flows...: 661/661
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 9630796 bytes
-~~ total memory freed........: 9630796 bytes
-~~ total allocations/frees...: 165093/165093
+~~ total memory allocated....: 9276297 bytes
+~~ total memory freed........: 9276297 bytes
+~~ total allocations/frees...: 159496/159496
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 518 chars
 ~~ json string max len.......: 2577 chars

test/results/default/activision.pcap.out

@@ -44,9 +44,9 @@
 ~~ total active/idle flows...: 4/4
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7972139 bytes
-~~ total memory freed........: 7972139 bytes
-~~ total allocations/frees...: 148380/148380
+~~ total memory allocated....: 7601872 bytes
+~~ total memory freed........: 7601872 bytes
+~~ total allocations/frees...: 142783/142783
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 1101 chars

test/results/default/adult_content.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964824 bytes
-~~ total memory freed........: 7964824 bytes
-~~ total allocations/frees...: 148312/148312
+~~ total memory allocated....: 7594485 bytes
+~~ total memory freed........: 7594485 bytes
+~~ total allocations/frees...: 142715/142715
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 519 chars
 ~~ json string max len.......: 1195 chars

test/results/default/afp.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964563 bytes
-~~ total memory freed........: 7964563 bytes
-~~ total allocations/frees...: 148303/148303
+~~ total memory allocated....: 7594224 bytes
+~~ total memory freed........: 7594224 bytes
+~~ total allocations/frees...: 142706/142706
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 509 chars
 ~~ json string max len.......: 1099 chars

test/results/default/agora-sd-rtn.pcap.out

@@ -244,9 +244,9 @@
 ~~ total active/idle flows...: 26/26
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8028286 bytes
-~~ total memory freed........: 8028286 bytes
-~~ total allocations/frees...: 148965/148965
+~~ total memory allocated....: 7658547 bytes
+~~ total memory freed........: 7658547 bytes
+~~ total allocations/frees...: 143368/143368
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 518 chars
 ~~ json string max len.......: 2185 chars

test/results/default/ah.pcapng.out

@@ -21,9 +21,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966373 bytes
-~~ total memory freed........: 7966373 bytes
-~~ total allocations/frees...: 148304/148304
+~~ total memory allocated....: 7596058 bytes
+~~ total memory freed........: 7596058 bytes
+~~ total allocations/frees...: 142707/142707
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 1076 chars

test/results/default/ajp.pcap.out

@@ -49,9 +49,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966953 bytes
-~~ total memory freed........: 7966953 bytes
-~~ total allocations/frees...: 148324/148324
+~~ total memory allocated....: 7596638 bytes
+~~ total memory freed........: 7596638 bytes
+~~ total allocations/frees...: 142727/142727
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 313 chars
 ~~ json string max len.......: 1513 chars

test/results/default/alexa-app.pcapng.out

@@ -1428,9 +1428,9 @@
 ~~ total active/idle flows...: 160/160
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 9085569 bytes
-~~ total memory freed........: 9085569 bytes
-~~ total allocations/frees...: 154002/154002
+~~ total memory allocated....: 8719046 bytes
+~~ total memory freed........: 8719046 bytes
+~~ total allocations/frees...: 148405/148405
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 300 chars
 ~~ json string max len.......: 2508 chars

test/results/default/alicloud.pcap.out

@@ -141,9 +141,9 @@
 ~~ total active/idle flows...: 15/15
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8030744 bytes
-~~ total memory freed........: 8030744 bytes
-~~ total allocations/frees...: 148681/148681
+~~ total memory allocated....: 7660741 bytes
+~~ total memory freed........: 7660741 bytes
+~~ total allocations/frees...: 143084/143084
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 985 chars

test/results/default/among_us.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964128 bytes
-~~ total memory freed........: 7964128 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593789 bytes
+~~ total memory freed........: 7593789 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 1082 chars

test/results/default/amqp.pcap.out

@@ -34,9 +34,9 @@
 ~~ total active/idle flows...: 3/3
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7979083 bytes
-~~ total memory freed........: 7979083 bytes
-~~ total allocations/frees...: 148472/148472
+~~ total memory allocated....: 7608792 bytes
+~~ total memory freed........: 7608792 bytes
+~~ total allocations/frees...: 142875/142875
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 2263 chars

test/results/default/android.pcap.out

@@ -441,9 +441,9 @@
 ~~ total active/idle flows...: 63/63
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8350377 bytes
-~~ total memory freed........: 8350377 bytes
-~~ total allocations/frees...: 149727/149727
+~~ total memory allocated....: 7981526 bytes
+~~ total memory freed........: 7981526 bytes
+~~ total allocations/frees...: 144130/144130
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2635 chars

test/results/default/anyconnect-vpn.pcap.out

@@ -465,9 +465,9 @@
 ~~ total active/idle flows...: 69/69
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8218808 bytes
-~~ total memory freed........: 8218808 bytes
-~~ total allocations/frees...: 149703/149703
+~~ total memory allocated....: 7850101 bytes
+~~ total memory freed........: 7850101 bytes
+~~ total allocations/frees...: 144106/144106
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 520 chars
 ~~ json string max len.......: 2780 chars

test/results/default/anydesk.pcapng.out

@@ -73,9 +73,9 @@
 ~~ total active/idle flows...: 7/7
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8028232 bytes
-~~ total memory freed........: 8028232 bytes
-~~ total allocations/frees...: 148563/148563
+~~ total memory allocated....: 7658037 bytes
+~~ total memory freed........: 7658037 bytes
+~~ total allocations/frees...: 142966/142966
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 515 chars
 ~~ json string max len.......: 2677 chars

test/results/default/avast.pcap.out

@@ -107,9 +107,9 @@
 ~~ total active/idle flows...: 10/10
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8007597 bytes
-~~ total memory freed........: 8007597 bytes
-~~ total allocations/frees...: 148538/148538
+~~ total memory allocated....: 7637474 bytes
+~~ total memory freed........: 7637474 bytes
+~~ total allocations/frees...: 142941/142941
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 966 chars

test/results/default/avast_securedns.pcapng.out

@@ -224,9 +224,9 @@
 ~~ total active/idle flows...: 39/39
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8046132 bytes
-~~ total memory freed........: 8046132 bytes
-~~ total allocations/frees...: 148782/148782
+~~ total memory allocated....: 7676705 bytes
+~~ total memory freed........: 7676705 bytes
+~~ total allocations/frees...: 143185/143185
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 523 chars
 ~~ json string max len.......: 1118 chars

test/results/default/bacnet.pcap.out

@@ -63,9 +63,9 @@
 ~~ total active/idle flows...: 10/10
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7983666 bytes
-~~ total memory freed........: 7983666 bytes
-~~ total allocations/frees...: 148409/148409
+~~ total memory allocated....: 7613543 bytes
+~~ total memory freed........: 7613543 bytes
+~~ total allocations/frees...: 142812/142812
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1104 chars

test/results/default/bad-dns-traffic.pcap.out

@@ -45,9 +45,9 @@
 ~~ total active/idle flows...: 3/3
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7979701 bytes
-~~ total memory freed........: 7979701 bytes
-~~ total allocations/frees...: 148697/148697
+~~ total memory allocated....: 7609410 bytes
+~~ total memory freed........: 7609410 bytes
+~~ total allocations/frees...: 143100/143100
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 521 chars
 ~~ json string max len.......: 2494 chars

test/results/default/badpackets.pcap.out

@@ -200,9 +200,9 @@
 ~~ total active/idle flows...: 0/0
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7961999 bytes
-~~ total memory freed........: 7961999 bytes
-~~ total allocations/frees...: 148276/148276
+~~ total memory allocated....: 7591636 bytes
+~~ total memory freed........: 7591636 bytes
+~~ total allocations/frees...: 142679/142679
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 320 chars
 ~~ json string max len.......: 2335 chars

test/results/default/bitcoin.pcap.out

@@ -64,9 +64,9 @@
 ~~ total active/idle flows...: 6/6
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7993072 bytes
-~~ total memory freed........: 7993072 bytes
-~~ total allocations/frees...: 148979/148979
+~~ total memory allocated....: 7622853 bytes
+~~ total memory freed........: 7622853 bytes
+~~ total allocations/frees...: 143382/143382
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2493 chars

test/results/default/bittorrent.pcap.out

@@ -170,9 +170,9 @@
 ~~ total active/idle flows...: 24/24
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8066126 bytes
-~~ total memory freed........: 8066126 bytes
-~~ total allocations/frees...: 148861/148861
+~~ total memory allocated....: 7696339 bytes
+~~ total memory freed........: 7696339 bytes
+~~ total allocations/frees...: 143264/143264
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2508 chars

test/results/default/bittorrent_tcp_miss.pcapng.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7969047 bytes
-~~ total memory freed........: 7969047 bytes
-~~ total allocations/frees...: 148388/148388
+~~ total memory allocated....: 7598708 bytes
+~~ total memory freed........: 7598708 bytes
+~~ total allocations/frees...: 142791/142791
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 527 chars
 ~~ json string max len.......: 2336 chars

test/results/default/bittorrent_utp.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966593 bytes
-~~ total memory freed........: 7966593 bytes
-~~ total allocations/frees...: 148373/148373
+~~ total memory allocated....: 7596254 bytes
+~~ total memory freed........: 7596254 bytes
+~~ total allocations/frees...: 142776/142776
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 520 chars
 ~~ json string max len.......: 2377 chars

test/results/default/bjnp.pcap.out

@@ -49,9 +49,9 @@
 ~~ total active/idle flows...: 10/10
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7983289 bytes
-~~ total memory freed........: 7983289 bytes
-~~ total allocations/frees...: 148396/148396
+~~ total memory allocated....: 7613166 bytes
+~~ total memory freed........: 7613166 bytes
+~~ total allocations/frees...: 142799/142799
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 1095 chars

test/results/default/bot.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7975986 bytes
-~~ total memory freed........: 7975986 bytes
-~~ total allocations/frees...: 148695/148695
+~~ total memory allocated....: 7605647 bytes
+~~ total memory freed........: 7605647 bytes
+~~ total allocations/frees...: 143098/143098
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 509 chars
 ~~ json string max len.......: 2255 chars

test/results/default/bt-dns.pcap.out

@@ -14,9 +14,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964157 bytes
-~~ total memory freed........: 7964157 bytes
-~~ total allocations/frees...: 148289/148289
+~~ total memory allocated....: 7593818 bytes
+~~ total memory freed........: 7593818 bytes
+~~ total allocations/frees...: 142692/142692
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1155 chars

test/results/default/bt-http.pcapng.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7965119 bytes
-~~ total memory freed........: 7965119 bytes
-~~ total allocations/frees...: 148316/148316
+~~ total memory allocated....: 7594780 bytes
+~~ total memory freed........: 7594780 bytes
+~~ total allocations/frees...: 142719/142719
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 515 chars
 ~~ json string max len.......: 1317 chars

test/results/default/bt_search.pcap.out

@@ -14,9 +14,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964129 bytes
-~~ total memory freed........: 7964129 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593790 bytes
+~~ total memory freed........: 7593790 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 515 chars
 ~~ json string max len.......: 969 chars

test/results/default/cachefly.pcapng.out

@@ -19,9 +19,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8013767 bytes
-~~ total memory freed........: 8013767 bytes
-~~ total allocations/frees...: 148358/148358
+~~ total memory allocated....: 7643428 bytes
+~~ total memory freed........: 7643428 bytes
+~~ total allocations/frees...: 142761/142761
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 516 chars
 ~~ json string max len.......: 2707 chars

test/results/default/capwap.pcap.out

@@ -76,9 +76,9 @@
 ~~ total active/idle flows...: 5/5
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7983956 bytes
-~~ total memory freed........: 7983956 bytes
-~~ total allocations/frees...: 148726/148726
+~~ total memory allocated....: 7613713 bytes
+~~ total memory freed........: 7613713 bytes
+~~ total allocations/frees...: 143129/143129
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 297 chars
 ~~ json string max len.......: 2383 chars

test/results/default/capwap_data.pcapng.out

@@ -37,9 +37,9 @@
 ~~ total active/idle flows...: 0/0
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7961999 bytes
-~~ total memory freed........: 7961999 bytes
-~~ total allocations/frees...: 148276/148276
+~~ total memory allocated....: 7591636 bytes
+~~ total memory freed........: 7591636 bytes
+~~ total allocations/frees...: 142679/142679
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 306 chars
 ~~ json string max len.......: 738 chars

test/results/default/cassandra.pcap.out

@@ -27,9 +27,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7978589 bytes
-~~ total memory freed........: 7978589 bytes
-~~ total allocations/frees...: 148586/148586
+~~ total memory allocated....: 7608274 bytes
+~~ total memory freed........: 7608274 bytes
+~~ total allocations/frees...: 142989/142989
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 515 chars
 ~~ json string max len.......: 2202 chars

test/results/default/check_mk_new.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966941 bytes
-~~ total memory freed........: 7966941 bytes
-~~ total allocations/frees...: 148385/148385
+~~ total memory allocated....: 7596602 bytes
+~~ total memory freed........: 7596602 bytes
+~~ total allocations/frees...: 142788/142788
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 518 chars
 ~~ json string max len.......: 2133 chars

test/results/default/chrome.pcap.out

@@ -63,9 +63,9 @@
 ~~ total active/idle flows...: 6/6
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8165056 bytes
-~~ total memory freed........: 8165056 bytes
-~~ total allocations/frees...: 148519/148519
+~~ total memory allocated....: 7794837 bytes
+~~ total memory freed........: 7794837 bytes
+~~ total allocations/frees...: 142922/142922
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1409 chars

test/results/default/citrix.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966999 bytes
-~~ total memory freed........: 7966999 bytes
-~~ total allocations/frees...: 148387/148387
+~~ total memory allocated....: 7596660 bytes
+~~ total memory freed........: 7596660 bytes
+~~ total allocations/frees...: 142790/142790
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 500 chars
 ~~ json string max len.......: 2056 chars

test/results/default/cloudflare-warp.pcap.out

@@ -69,9 +69,9 @@
 ~~ total active/idle flows...: 8/8
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8003125 bytes
-~~ total memory freed........: 8003125 bytes
-~~ total allocations/frees...: 148452/148452
+~~ total memory allocated....: 7632954 bytes
+~~ total memory freed........: 7632954 bytes
+~~ total allocations/frees...: 142855/142855
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 521 chars
 ~~ json string max len.......: 1547 chars

test/results/default/coap_mqtt.pcap.out

@@ -127,9 +127,9 @@
 ~~ total active/idle flows...: 16/16
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8035111 bytes
-~~ total memory freed........: 8035111 bytes
-~~ total allocations/frees...: 149536/149536
+~~ total memory allocated....: 7665132 bytes
+~~ total memory freed........: 7665132 bytes
+~~ total allocations/frees...: 143939/143939
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 515 chars
 ~~ json string max len.......: 2431 chars

test/results/default/collectd.pcap.out

@@ -80,9 +80,9 @@
 ~~ total active/idle flows...: 9/9
 ~~ total timeout flows.......: 3
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7983164 bytes
-~~ total memory freed........: 7983164 bytes
-~~ total allocations/frees...: 148453/148453
+~~ total memory allocated....: 7613017 bytes
+~~ total memory freed........: 7613017 bytes
+~~ total allocations/frees...: 142856/142856
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 2401 chars

test/results/default/corba.pcap.out

@@ -33,9 +33,9 @@
 ~~ total active/idle flows...: 3/3
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7975081 bytes
-~~ total memory freed........: 7975081 bytes
-~~ total allocations/frees...: 148334/148334
+~~ total memory allocated....: 7604790 bytes
+~~ total memory freed........: 7604790 bytes
+~~ total allocations/frees...: 142737/142737
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 1190 chars

test/results/default/cpha.pcap.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964100 bytes
-~~ total memory freed........: 7964100 bytes
-~~ total allocations/frees...: 148287/148287
+~~ total memory allocated....: 7593761 bytes
+~~ total memory freed........: 7593761 bytes
+~~ total allocations/frees...: 142690/142690
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 950 chars

test/results/default/crawler_false_positive.pcapng.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964552 bytes
-~~ total memory freed........: 7964552 bytes
-~~ total allocations/frees...: 148304/148304
+~~ total memory allocated....: 7594213 bytes
+~~ total memory freed........: 7594213 bytes
+~~ total allocations/frees...: 142707/142707
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 530 chars
 ~~ json string max len.......: 1093 chars

test/results/default/crynet.pcap.out

@@ -44,9 +44,9 @@
 ~~ total active/idle flows...: 4/4
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7972139 bytes
-~~ total memory freed........: 7972139 bytes
-~~ total allocations/frees...: 148380/148380
+~~ total memory allocated....: 7601872 bytes
+~~ total memory freed........: 7601872 bytes
+~~ total allocations/frees...: 142783/142783
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1100 chars

test/results/default/custom_rules_same-ip_multiple_ports.pcapng.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7966428 bytes
-~~ total memory freed........: 7966428 bytes
-~~ total allocations/frees...: 148306/148306
+~~ total memory allocated....: 7596113 bytes
+~~ total memory freed........: 7596113 bytes
+~~ total allocations/frees...: 142709/142709
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 543 chars
 ~~ json string max len.......: 1074 chars

test/results/default/dazn.pcapng.out

@@ -33,9 +33,9 @@
 ~~ total active/idle flows...: 3/3
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7981019 bytes
-~~ total memory freed........: 7981019 bytes
-~~ total allocations/frees...: 148333/148333
+~~ total memory allocated....: 7610728 bytes
+~~ total memory freed........: 7610728 bytes
+~~ total allocations/frees...: 142736/142736
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 2497 chars

test/results/default/dcerpc.pcap.out

@@ -35,9 +35,9 @@
 ~~ total active/idle flows...: 4/4
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7970863 bytes
-~~ total memory freed........: 7970863 bytes
-~~ total allocations/frees...: 148336/148336
+~~ total memory allocated....: 7600596 bytes
+~~ total memory freed........: 7600596 bytes
+~~ total allocations/frees...: 142739/142739
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 512 chars
 ~~ json string max len.......: 1808 chars

test/results/default/dhcp-fuzz.pcapng.out

@@ -13,9 +13,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964100 bytes
-~~ total memory freed........: 7964100 bytes
-~~ total allocations/frees...: 148287/148287
+~~ total memory allocated....: 7593761 bytes
+~~ total memory freed........: 7593761 bytes
+~~ total allocations/frees...: 142690/142690
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 517 chars
 ~~ json string max len.......: 1004 chars

test/results/default/diameter.pcap.out

@@ -17,9 +17,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964273 bytes
-~~ total memory freed........: 7964273 bytes
-~~ total allocations/frees...: 148293/148293
+~~ total memory allocated....: 7593934 bytes
+~~ total memory freed........: 7593934 bytes
+~~ total allocations/frees...: 142696/142696
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 1107 chars

test/results/default/discord.pcap.out

@@ -322,9 +322,9 @@
 ~~ total active/idle flows...: 34/34
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8052321 bytes
-~~ total memory freed........: 8052321 bytes
-~~ total allocations/frees...: 149072/149072
+~~ total memory allocated....: 7682774 bytes
+~~ total memory freed........: 7682774 bytes
+~~ total allocations/frees...: 143475/143475
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2458 chars

test/results/default/discord_mid_flow.pcap.out

@@ -41,9 +41,9 @@
 ~~ total active/idle flows...: 0/0
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7961999 bytes
-~~ total memory freed........: 7961999 bytes
-~~ total allocations/frees...: 148276/148276
+~~ total memory allocated....: 7591636 bytes
+~~ total memory freed........: 7591636 bytes
+~~ total allocations/frees...: 142679/142679
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 309 chars
 ~~ json string max len.......: 590 chars

test/results/default/dlt_ppp.pcap.out

@@ -10,9 +10,9 @@
 ~~ total active/idle flows...: 0/0
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7961999 bytes
-~~ total memory freed........: 7961999 bytes
-~~ total allocations/frees...: 148276/148276
+~~ total memory allocated....: 7591636 bytes
+~~ total memory freed........: 7591636 bytes
+~~ total allocations/frees...: 142679/142679
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 277 chars
 ~~ json string max len.......: 1955 chars

test/results/default/dnp3.pcap.out

@@ -87,9 +87,9 @@
 ~~ total active/idle flows...: 8/8
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7994994 bytes
-~~ total memory freed........: 7994994 bytes
-~~ total allocations/frees...: 148923/148923
+~~ total memory allocated....: 7624823 bytes
+~~ total memory freed........: 7624823 bytes
+~~ total allocations/frees...: 143326/143326
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 2098 chars

test/results/default/dns-invalid-chars.pcap.out

@@ -15,9 +15,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964157 bytes
-~~ total memory freed........: 7964157 bytes
-~~ total allocations/frees...: 148289/148289
+~~ total memory allocated....: 7593818 bytes
+~~ total memory freed........: 7593818 bytes
+~~ total allocations/frees...: 142692/142692
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 523 chars
 ~~ json string max len.......: 1317 chars

test/results/default/dns-tunnel-iodine.pcap.out

@@ -19,9 +19,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7976735 bytes
-~~ total memory freed........: 7976735 bytes
-~~ total allocations/frees...: 148723/148723
+~~ total memory allocated....: 7606396 bytes
+~~ total memory freed........: 7606396 bytes
+~~ total allocations/frees...: 143126/143126
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 523 chars
 ~~ json string max len.......: 2394 chars

test/results/default/dns_ambiguous_names.pcap.out

@@ -69,9 +69,9 @@
 ~~ total active/idle flows...: 10/10
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7983603 bytes
-~~ total memory freed........: 7983603 bytes
-~~ total allocations/frees...: 148407/148407
+~~ total memory allocated....: 7613480 bytes
+~~ total memory freed........: 7613480 bytes
+~~ total allocations/frees...: 142810/142810
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 525 chars
 ~~ json string max len.......: 1216 chars

test/results/default/dns_doh.pcap.out

@@ -19,9 +19,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7977740 bytes
-~~ total memory freed........: 7977740 bytes
-~~ total allocations/frees...: 148435/148435
+~~ total memory allocated....: 7607401 bytes
+~~ total memory freed........: 7607401 bytes
+~~ total allocations/frees...: 142838/142838
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2171 chars

test/results/default/dns_dot.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7973129 bytes
-~~ total memory freed........: 7973129 bytes
-~~ total allocations/frees...: 148329/148329
+~~ total memory allocated....: 7602790 bytes
+~~ total memory freed........: 7602790 bytes
+~~ total allocations/frees...: 142732/142732
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 1916 chars

test/results/default/dns_exfiltration.pcap.out

@@ -20,9 +20,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7972913 bytes
-~~ total memory freed........: 7972913 bytes
-~~ total allocations/frees...: 148589/148589
+~~ total memory allocated....: 7602574 bytes
+~~ total memory freed........: 7602574 bytes
+~~ total allocations/frees...: 142992/142992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 522 chars
 ~~ json string max len.......: 2502 chars

test/results/default/dns_fragmented.pcap.out

@@ -158,9 +158,9 @@
 ~~ total active/idle flows...: 21/21
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8008030 bytes
-~~ total memory freed........: 8008030 bytes
-~~ total allocations/frees...: 148576/148576
+~~ total memory allocated....: 7638171 bytes
+~~ total memory freed........: 7638171 bytes
+~~ total allocations/frees...: 142979/142979
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 325 chars
 ~~ json string max len.......: 2522 chars

test/results/default/dns_invert_query.pcapng.out

@@ -14,9 +14,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964129 bytes
-~~ total memory freed........: 7964129 bytes
-~~ total allocations/frees...: 148288/148288
+~~ total memory allocated....: 7593790 bytes
+~~ total memory freed........: 7593790 bytes
+~~ total allocations/frees...: 142691/142691
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 524 chars
 ~~ json string max len.......: 1070 chars

test/results/default/dns_long_domainname.pcap.out

@@ -15,9 +15,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964181 bytes
-~~ total memory freed........: 7964181 bytes
-~~ total allocations/frees...: 148290/148290
+~~ total memory allocated....: 7593842 bytes
+~~ total memory freed........: 7593842 bytes
+~~ total allocations/frees...: 142693/142693
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 525 chars
 ~~ json string max len.......: 1221 chars

test/results/default/dnscrypt-v1-and-resolver-pings.pcap.out

@@ -1545,9 +1545,9 @@
 ~~ total active/idle flows...: 245/245
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8490651 bytes
-~~ total memory freed........: 8490651 bytes
-~~ total allocations/frees...: 151459/151459
+~~ total memory allocated....: 8126168 bytes
+~~ total memory freed........: 8126168 bytes
+~~ total allocations/frees...: 145862/145862
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 338 chars
 ~~ json string max len.......: 2508 chars

test/results/default/dnscrypt-v2-doh.pcap.out

@@ -315,9 +315,9 @@
 ~~ total active/idle flows...: 34/34
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8332487 bytes
-~~ total memory freed........: 8332487 bytes
-~~ total allocations/frees...: 149423/149423
+~~ total memory allocated....: 7962940 bytes
+~~ total memory freed........: 7962940 bytes
+~~ total allocations/frees...: 143826/143826
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 521 chars
 ~~ json string max len.......: 4788 chars

test/results/default/dnscrypt-v2.pcap.out

@@ -24,9 +24,9 @@
 ~~ total active/idle flows...: 3/3
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7968473 bytes
-~~ total memory freed........: 7968473 bytes
-~~ total allocations/frees...: 148315/148315
+~~ total memory allocated....: 7598182 bytes
+~~ total memory freed........: 7598182 bytes
+~~ total allocations/frees...: 142718/142718
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 517 chars
 ~~ json string max len.......: 1999 chars

test/results/default/dnscrypt_skype_false_positive.pcapng.out

@@ -19,9 +19,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964273 bytes
-~~ total memory freed........: 7964273 bytes
-~~ total allocations/frees...: 148293/148293
+~~ total memory allocated....: 7593934 bytes
+~~ total memory freed........: 7593934 bytes
+~~ total allocations/frees...: 142696/142696
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 537 chars
 ~~ json string max len.......: 1235 chars

test/results/default/doh.pcapng.out

@@ -0,0 +1,28 @@
+00506{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":64,"reader-thread-count":1,"flow-scan-interval":10000000,"generic-max-idle-time":600000000,"icmp-max-idle-time":120000000,"udp-max-idle-time":180000000,"tcp-max-idle-time":7560000000,"max-packets-per-flow-to-send":5,"max-packets-per-flow-to-process":32,"max-packets-per-flow-to-analyse":32,"global_ts_usec":0}
+00569{"daemon_event_id":4,"daemon_event_name":"status","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","packets-captured":1,"packets-processed":0,"total-skipped-flows":0,"total-l4-payload-len":0,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":0,"total-detection-updates":0,"total-updates":0,"current-active-flows":0,"total-active-flows":0,"total-idle-flows":0,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":2,"global_ts_usec":1623220847881632}
+00766{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":1623220847881632,"flow_src_last_pkt_time":1623220847881632,"flow_dst_last_pkt_time":1623220847881632,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":0,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":0,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1623220847881632,"l3_proto":"ip4","src_ip":"192.168.1.253","dst_ip":"1.1.1.1","src_port":35996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5}
+00550{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_src_last_pkt_time":1623220847881632,"flow_dst_last_pkt_time":1623220847881632,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"thread_ts_usec":1623220847881632,"pkt":"pJGxgjQ53KYyW3JVCABFAAA8GoVAAEAGW5DAqAH9AQEBAYycAbvJgv8BAAAAAKAC+vDR+gAAAgQFtAQCCAq18KmgAAAAAAEDAwc="}
+00542{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_src_last_pkt_time":1623220847881632,"flow_dst_last_pkt_time":1623220847893990,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"thread_ts_usec":1623220847893990,"pkt":"3KYyW3JVpJGxgjQ5CABFAAA0AABAADgGfh0BAQEBwKgB\/QG7jJzQgMYoyYL\/AoAS\/\/+80AAAAgQFtAEBBAIBAwMK"}
+00530{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_src_last_pkt_time":1623220847894289,"flow_dst_last_pkt_time":1623220847893990,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1623220847894289,"pkt":"pJGxgjQ53KYyW3JVCABFAAAoGoZAAEAGW6PAqAH9AQEBAYycAbvJgv8C0IDGKVAQAfb7rwAAAAAAAAAA"}
+00875{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":4,"flow_src_last_pkt_time":1623220847903684,"flow_dst_last_pkt_time":1623220847893990,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":315,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":315,"pkt_l4_len":281,"thread_ts_usec":1623220847903684,"pkt":"pJGxgjQ53KYyW3JVCABFAAEtGodAAEAGWp3AqAH9AQEBAYycAbvJgv8C0IDGKVAYAfbHEwAAFgMBAQABAAD8AwPoLOpgwE25psercF8dtgS9urXcGuIXWON7hv8MEOxxwCBmK04kA9gzmAQCdEKOzz6ZUSvZIzIKAJ4xNU24mlRHDQAmzKjMqcAvwDDAK8AswBPACcAUwAoAnACdAC8ANcASAAoTAxMBEwIBAACNAAUABQEAAAAAAAoACgAIAB0AFwAYABkACwACAQAADQAaABgIBAQDCAcIBQgGBAEFAQYBBQMGAwIBAgP\/AQABAAAQAA4ADAJoMghodHRwLzEuMQASAAAAKwAJCAMEAwMDAgMBADMAJgAkAB0AIBKfRS3py5Rs1YQ6EAtEgG+yypeHCfHggy9eoe\/nh6Bu"}
+01271{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":1,"flow_first_seen":1623220847881632,"flow_src_last_pkt_time":1623220847903684,"flow_dst_last_pkt_time":1623220847893990,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":261,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":261,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":1623220847903684,"l3_proto":"ip4","src_ip":"192.168.1.253","dst_ip":"1.1.1.1","src_port":35996,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":300,"client":210,"server":90}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web","hostname":"","tls": {"version":"TLSv1.2","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}}
+00531{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_src_last_pkt_time":1623220847903684,"flow_dst_last_pkt_time":1623220847916856,"flow_idle_time":7580000000,"pkt_datalink":1,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"thread_ts_usec":1623220847916856,"pkt":"3KYyW3JVpJGxgjQ5CABFAAAoTTlAADgGMPABAQEBwKgB\/QG7jJzQgMYpyYMAB1AQAEL8XgAAAAAAAAAA"}
+01322{"flow_event_id":8,"flow_event_name":"detection-update","thread_id":0,"packet_id":6,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"info","flow_src_packets_processed":3,"flow_dst_packets_processed":3,"flow_first_seen":1623220847881632,"flow_src_last_pkt_time":1623220847903684,"flow_dst_last_pkt_time":1623220847919967,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":261,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":261,"flow_dst_tot_l4_payload_len":1460,"midstream":0,"thread_ts_usec":1623220847919967,"l3_proto":"ip4","src_ip":"192.168.1.253","dst_ip":"1.1.1.1","src_port":35996,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":300,"client":210,"server":90}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web","hostname":"","tls": {"version":"TLSv1.3","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","ja3s":"d75f9129bb5d05492a65ff78e081bcb2","unsafe_cipher":0,"cipher":"TLS_CHACHA20_POLY1305_SHA256","advertised_alpns":"h2,http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1"}}}
+02275{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":32,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":17,"flow_dst_packets_processed":15,"flow_first_seen":1623220847881632,"flow_src_last_pkt_time":1623220894239868,"flow_dst_last_pkt_time":1623220878891197,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":261,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":606,"flow_dst_tot_l4_payload_len":3569,"midstream":0,"thread_ts_usec":1623220894239868,"l3_proto":"ip4","src_ip":"192.168.1.253","dst_ip":"1.1.1.1","src_port":35996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"data_analysis": {"iat": {"min":0,"avg":2495735.5,"max":15359810,"stddev":5583085.5,"var":31170844688384.0,"ent":2.4,"data": [12358,12657,9395,22866,3111,16283,0,0,492,492,548541,0,471,0,559446,0,429,10863,0,436,0,2867,0,3303,0,50308,15056860,15017798,15339561,15339454,15359810]},"pktlen": {"min":46,"avg":174.8,"max":1500,"stddev":350.9,"var":123099.2,"ent":3.6,"data": [60,52,46,301,46,1500,46,1500,46,256,46,104,126,136,108,46,46,111,46,71,46,46,371,71,46,46,46,46,46,46,46,46]},"bins": {"c_to_s": [12,0,3,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [10,0,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0]},"directions": [0,1,0,0,1,1,0,1,0,1,0,0,0,0,0,1,1,1,0,0,1,1,1,1,0,0,1,0,1,0,1,0],"entropies": [4.425882339,4.437160492,4.225621700,5.947368622,4.140616417,7.830754280,4.117669106,7.879162312,4.117669106,7.097528458,4.117669106,5.884155750,6.247783184,6.373653889,6.047423363,4.140616417,4.140616417,6.197440624,4.131088734,5.480591297,4.053659439,4.117669106,7.372667789,5.483504295,4.087610722,4.087610245,4.161148071,4.087610245,4.117669582,4.087610245,4.161148071,4.087610245]},"ndpi": {"flow_risk": {"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":300,"client":210,"server":90}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}}
+01083{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":120,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","flow_id":1,"flow_state":"finished","flow_src_packets_processed":61,"flow_dst_packets_processed":59,"flow_first_seen":1623220847881632,"flow_src_last_pkt_time":1623220970655801,"flow_dst_last_pkt_time":1623220970669537,"flow_idle_time":7580000000,"flow_src_min_l4_payload_len":0,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":261,"flow_dst_max_l4_payload_len":1460,"flow_src_tot_l4_payload_len":1881,"flow_dst_tot_l4_payload_len":5821,"midstream":0,"thread_ts_usec":1623220970669537,"l3_proto":"ip4","src_ip":"192.168.1.253","dst_ip":"1.1.1.1","src_port":35996,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":5,"ndpi": {"flow_risk": {"24": {"risk":"Missing SNI TLS Extn","severity":"Medium","risk_score": {"total":300,"client":210,"server":90}}},"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web"}}
+00581{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":120,"source":"cfgs\/default\/pcap\/doh.pcapng","alias":"nDPId-test","packets-captured":120,"packets-processed":120,"total-skipped-flows":0,"total-l4-payload-len":7702,"total-not-detected-flows":0,"total-guessed-flows":0,"total-detected-flows":1,"total-detection-updates":1,"total-updates":0,"current-active-flows":0,"total-active-flows":1,"total-idle-flows":1,"total-compressions":0,"total-compression-diff":0,"current-compression-diff":0,"total-events-serialized":13,"global_ts_usec":1623220970669537}
+~~~~~~~~~~~~~~~~~~~~ SUMMARY ~~~~~~~~~~~~~~~~~~~~
+~~ packets captured/processed: 120/120
+~~ skipped flows.............: 0
+~~ total layer4 data length..: 7702 bytes
+~~ total detected protocols..: 1
+~~ total active/idle flows...: 1/1
+~~ total timeout flows.......: 0
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~ total memory allocated....: 7607170 bytes
+~~ total memory freed........: 7607170 bytes
+~~ total allocations/frees...: 142816/142816
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~ json string min len.......: 511 chars
+~~ json string max len.......: 2280 chars
+~~ json string avg len.......: 1330 chars

test/results/default/doq.pcapng.out

@@ -25,9 +25,9 @@
 ~~ total active/idle flows...: 2/2
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7976913 bytes
-~~ total memory freed........: 7976913 bytes
-~~ total allocations/frees...: 148339/148339
+~~ total memory allocated....: 7606598 bytes
+~~ total memory freed........: 7606598 bytes
+~~ total allocations/frees...: 142742/142742
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 511 chars
 ~~ json string max len.......: 2220 chars

test/results/default/doq_adguard.pcapng.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7982753 bytes
-~~ total memory freed........: 7982753 bytes
-~~ total allocations/frees...: 148604/148604
+~~ total memory allocated....: 7612414 bytes
+~~ total memory freed........: 7612414 bytes
+~~ total allocations/frees...: 143007/143007
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 519 chars
 ~~ json string max len.......: 2331 chars

test/results/default/dos_win98_smb_netbeui.pcap.out

@@ -116,9 +116,9 @@
 ~~ total active/idle flows...: 4/4
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7972113 bytes
-~~ total memory freed........: 7972113 bytes
-~~ total allocations/frees...: 148379/148379
+~~ total memory allocated....: 7601846 bytes
+~~ total memory freed........: 7601846 bytes
+~~ total allocations/frees...: 142782/142782
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 311 chars
 ~~ json string max len.......: 2200 chars

test/results/default/drda_db2.pcap.out

@@ -18,9 +18,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7967249 bytes
-~~ total memory freed........: 7967249 bytes
-~~ total allocations/frees...: 148326/148326
+~~ total memory allocated....: 7596910 bytes
+~~ total memory freed........: 7596910 bytes
+~~ total allocations/frees...: 142729/142729
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 514 chars
 ~~ json string max len.......: 2213 chars

test/results/default/dropbox.pcap.out

@@ -133,9 +133,9 @@
 ~~ total active/idle flows...: 15/15
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 8017923 bytes
-~~ total memory freed........: 8017923 bytes
-~~ total allocations/frees...: 149283/149283
+~~ total memory allocated....: 7647920 bytes
+~~ total memory freed........: 7647920 bytes
+~~ total allocations/frees...: 143686/143686
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 513 chars
 ~~ json string max len.......: 2356 chars

test/results/default/dtls.pcap.out

@@ -14,9 +14,9 @@
 ~~ total active/idle flows...: 1/1
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 7964165 bytes
-~~ total memory freed........: 7964165 bytes
-~~ total allocations/frees...: 148290/148290
+~~ total memory allocated....: 7593826 bytes
+~~ total memory freed........: 7593826 bytes
+~~ total allocations/frees...: 142693/142693
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 510 chars
 ~~ json string max len.......: 1413 chars