nDPI
nDPI copied to clipboard
ndpiReader: issue with printout of timestamps (-k -K flags)
ndpiReader with -k -K flags gives rounded timestamps
./ndpiReader -i telegram.pcap -k out.json -K json
{"src_ip":"192.168.1.77","dest_ip":"91.108.16.4","src_port":23174,"dst_port":538,"ip":4,"proto":"UDP","ndpi": {"confidence": {"6":"DPI"},"proto":"Telegram","proto_id":"185","encrypted":1,"breed":"Acceptable","category_id":9,"category":"Chat"},"flow_id":23,"first_seen_ms":1588779679744.000,"last_seen_ms":1588779679744.000,"duration_ms":2.971,"
vs.
./ndpiReader -i telegram.pcap -C out.csv
#flow_id | protocol | first_seen | last_seen | duration | src_ip | src_port | dst_ip 23 | 17 | 1588779616.036 | 1588779619.007 | 2.971 | 192.168.1.77 | 23174 | 91.108.16.4