/
facebookchat3.json
69 lines (69 loc) · 123 KB
/
facebookchat3.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
{"pr": 6, "time_start": 1429117977.534903, "bytes_out": 74, "sp": 13389, "packets": [{"b": 74, "ipt": 0, "dir": ">"}], "time_end": 1429117977.587115, "byte_dist_std": 81.404759, "da": "64.12.104.73", "total_entropy": 427.990165, "ip": {"in": {"id": [63976], "ttl": 99}, "out": {"id": [26337], "ttl": 128}}, "idp_out": "4500007266e140008006772d83caf057", "num_pkts_in": 1, "num_pkts_out": 1, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 5.783651, "sa": "131.202.240.87", "byte_dist": [2, 3, 0, 2, 1, 0, 0, 0, 0, 0, 2, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 2, 0, 0, 0, 0, 1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0], "dp": 443, "byte_dist_mean": 107.391892}
{"pr": 6, "time_start": 1429117977.535015, "bytes_out": 53, "sp": 13385, "packets": [{"b": 53, "ipt": 0, "dir": ">"}], "time_end": 1429117977.589824, "byte_dist_std": 81.055335, "da": "64.12.24.167", "total_entropy": 289.579679, "ip": {"in": {"id": [59886], "ttl": 100}, "out": {"id": [20295], "ttl": 128}}, "idp_out": "4500005d4f4740008006de7e83caf057", "num_pkts_in": 1, "num_pkts_out": 1, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 5.463768, "sa": "131.202.240.87", "byte_dist": [1, 0, 1, 2, 1, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 2, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0], "dp": 443, "byte_dist_mean": 104.735849}
{"ip": {"in": {"id": [9231, 9232, 9233, 9234, 9235, 9236, 9237, 9238, 9239, 9240, 9241, 9242, 9243, 9244, 9247, 9248, 9251, 9262, 9264, 9266, 9269, 9281, 9284, 9285, 9286, 9289, 9290, 9292, 9293, 9294, 9295, 9296, 9297, 9298, 9299, 9300, 9301, 9302, 9304, 9306, 9308, 9310, 9311, 9312, 9313, 9314, 9316, 9318, 9319, 9320], "ttl": 128}, "out": {"id": [16904, 16905, 16906, 16907, 16908, 16909, 16910, 16911, 16912, 16913, 16914, 16915, 16916, 16917, 16918, 16919, 16920, 16921, 16922, 16923, 16924, 16925, 16926, 16927, 16928, 16929, 16930, 16931, 16932, 16933, 16934, 16935, 16936, 16937, 16938, 16939, 16940, 16941, 16942, 16943, 16944, 16945, 16946, 16947, 16948, 16949, 16950, 16951, 16952, 16953], "ttl": 76}}, "idp_in": "45000502240f4000800641ad83caf057", "time_end": 1429118003.758048, "expire_type": "a", "entropy": 2.482568, "num_pkts_out": 71, "pr": 6, "time_start": 1429117978.558744, "bytes_in": 32937, "num_pkts_in": 66, "bytes_out": 26088, "byte_dist_std": 53.228329, "da": "131.202.240.87", "byte_dist_mean": 126.725133, "idp_len_out": 16, "total_entropy": 146533.549565, "byte_dist": [142, 53, 53, 106, 72, 59, 58, 55, 50, 62, 53, 47, 51, 56, 57, 57, 64, 60, 53, 54, 62, 54, 60, 82, 61, 60, 55, 52, 52, 57, 56, 58, 54, 56, 61, 58, 45, 55, 52, 60, 61, 56, 55, 57, 55, 59, 51, 53, 53, 63, 55, 56, 64, 59, 51, 51, 57, 60, 53, 57, 56, 57, 54, 51, 57, 57, 59, 51, 58, 57, 59, 59, 55, 53, 55, 54, 52, 58, 62, 58, 51, 64, 51, 55, 56, 56, 54, 56, 57, 58, 56, 69, 56, 57, 53, 58, 52, 54, 57, 61, 66, 55, 56, 58, 55, 54, 58, 52, 57, 59, 59, 54, 56, 52, 56, 59, 55, 60, 53, 57, 61, 56, 55, 57, 50, 50, 48, 57, 56, 52, 62, 56, 64, 52, 52, 54, 55, 61, 66, 59, 54, 52, 62, 60, 54, 56, 55, 52, 53, 58, 49, 55, 60, 55, 61, 57, 60, 61, 53, 57, 73, 56, 54, 59, 56, 54, 57, 57, 56, 60, 56, 58, 50, 61, 61, 61, 53, 52, 56, 59, 56, 72, 50, 53, 48, 57, 54, 58, 55, 57, 56, 53, 53, 55, 57, 56, 58, 55, 52, 59, 58, 58, 47, 47, 62, 56, 63, 54, 56, 52, 75, 55, 54, 62, 57, 59, 56, 57, 54, 58, 52, 62, 54, 59, 57, 46, 65, 58, 61, 59, 58, 54, 54, 54, 52, 53, 72, 56, 54, 58, 54, 61, 62, 77, 56, 58, 58, 59, 51, 64, 56, 59, 60, 56, 57, 57], "dp": 1959, "idp_len_in": 16, "tls": {"error": "no role"}, "sp": 443, "packets": [{"b": 481, "ipt": 0, "dir": ">"}, {"b": 1242, "ipt": 17, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 280, "dir": "<"}, {"b": 1000, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 76, "dir": ">"}, {"b": 289, "ipt": 0, "dir": ">"}, {"b": 72, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 1234, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 249, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1301, "ipt": 147, "dir": ">"}, {"b": 1244, "ipt": 48, "dir": "<"}, {"b": 1350, "ipt": 10, "dir": ">"}, {"b": 279, "ipt": 0, "dir": ">"}, {"b": 145, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 45, "ipt": 127, "dir": ">"}, {"b": 1083, "ipt": 11, "dir": ">"}, {"b": 1245, "ipt": 9, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 657, "ipt": 1564, "dir": ">"}, {"b": 1245, "ipt": 18, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 643, "ipt": 11, "dir": ">"}, {"b": 1245, "ipt": 13, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1100, "ipt": 1552, "dir": ">"}, {"b": 1155, "ipt": 91, "dir": "<"}, {"b": 1350, "ipt": 7, "dir": "<"}, {"b": 356, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 130, "dir": ">"}, {"b": 45, "ipt": 7, "dir": ">"}, {"b": 1245, "ipt": 43, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1028, "ipt": 12, "dir": ">"}, {"b": 1245, "ipt": 9, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 51, "dir": ">"}, {"b": 109, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 94, "dir": ">"}, {"b": 254, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 559, "dir": "<"}, {"b": 496, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 71, "dir": ">"}, {"b": 289, "ipt": 0, "dir": ">"}, {"b": 72, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 745, "ipt": 394, "dir": ">"}, {"b": 1245, "ipt": 16, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 766, "ipt": 11, "dir": ">"}, {"b": 1245, "ipt": 10, "dir": "<"}, {"b": 45, "ipt": 138, "dir": ">"}, {"b": 1350, "ipt": 955, "dir": "<"}, {"b": 96, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 73, "dir": ">"}, {"b": 92, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 10900, "dir": "<"}, {"b": 1263, "ipt": 0, "dir": "<"}, {"b": 1350, "ipt": 32, "dir": "<"}, {"b": 96, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 105, "dir": ">"}, {"b": 45, "ipt": 32, "dir": ">"}, {"b": 1140, "ipt": 54, "dir": ">"}, {"b": 1350, "ipt": 17, "dir": ">"}, {"b": 92, "ipt": 0, "dir": ">"}, {"b": 1245, "ipt": 21, "dir": "<"}, {"b": 1245, "ipt": 161, "dir": "<"}, {"b": 1245, "ipt": 2645, "dir": "<"}, {"b": 1245, "ipt": 161, "dir": "<"}, {"b": 1245, "ipt": 1558, "dir": "<"}], "idp_out": "45000209420840004c065aadadfc6e1b", "sa": "173.252.110.27"}
{"ip": {"in": {"id": [53588, 53589], "ttl": 63}, "out": {"id": [8176, 8177], "ttl": 63}}, "idp_in": "450000b1d15400003f11bdf783caf403", "time_end": 1429117978.5748, "expire_type": "a", "entropy": 4.869386, "num_pkts_out": 2, "pr": 17, "time_start": 1429117978.572497, "bytes_in": 310, "num_pkts_in": 2, "dns": [{"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2324}, {"a": "173.252.100.27", "ttl": 18}], "rc": 0}, {"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2324}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 3}], "rc": 0}], "bytes_out": 84, "byte_dist_std": 57.554986, "da": "131.202.244.3", "byte_dist_mean": 60.139594, "idp_len_out": 16, "total_entropy": 1918.537973, "byte_dist": [93, 34, 20, 6, 11, 2, 0, 3, 4, 2, 0, 8, 5, 0, 0, 0, 2, 0, 1, 0, 2, 0, 0, 0, 2, 0, 0, 1, 3, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 8, 0, 0, 2, 2, 4, 0, 0, 0, 2, 0, 0, 0, 0, 6, 0, 0, 0, 2, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 12, 6, 14, 5, 12, 4, 4, 4, 0, 1, 4, 1, 4, 2, 12, 2, 1, 4, 4, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56944, "packets": [{"b": 42, "ipt": 0, "dir": ">"}, {"b": 149, "ipt": 0, "dir": "<"}, {"b": 42, "ipt": 1, "dir": ">"}, {"b": 161, "ipt": 0, "dir": "<"}], "idp_out": "450000461ff040003f112fc783caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53590, 53591], "ttl": 63}, "out": {"id": [8178, 8179], "ttl": 63}}, "idp_in": "450000a9d15600003f11bdfd83caf403", "time_end": 1429117978.99734, "expire_type": "a", "entropy": 4.6554, "num_pkts_out": 2, "pr": 17, "time_start": 1429117978.994687, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2265}, {"a": "173.252.100.27", "ttl": 18}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2265}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 3}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 61.603081, "da": "131.202.244.3", "byte_dist_mean": 60.030387, "idp_len_out": 16, "total_entropy": 1685.2549, "byte_dist": [93, 34, 20, 10, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 2, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 1, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56945, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ff240003f112fcd83caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429117979.002301, "bytes_out": 12, "sp": 13407, "packets": [{"b": 6, "ipt": 0, "dir": ">"}, {"b": 6, "ipt": 29998, "dir": ">"}], "time_end": 1429118009.172839, "byte_dist_std": 44.056008, "da": "178.237.19.228", "total_entropy": 29.019553, "ip": {"in": {"id": [44394, 51791], "ttl": 101}, "out": {"id": [21636, 21640], "ttl": 128}}, "idp_out": "4500002e5484400080066b5283caf057", "num_pkts_in": 2, "num_pkts_out": 2, "idp_len_out": 16, "bytes_in": 0, "expire_type": "a", "entropy": 2.418296, "sa": "131.202.240.87", "byte_dist": [4, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 443, "byte_dist_mean": 27.25}
{"pr": 6, "time_start": 1429117979.00343, "bytes_out": 12, "sp": 13404, "packets": [{"b": 6, "ipt": 0, "dir": ">"}, {"b": 6, "ipt": 29997, "dir": ">"}], "time_end": 1429118009.173482, "byte_dist_std": 55.136401, "da": "178.237.19.103", "total_entropy": 29.019553, "ip": {"in": {"id": [39527, 50063], "ttl": 101}, "out": {"id": [21382, 21386], "ttl": 128}}, "idp_out": "4500002e5386400080066ccd83caf057", "num_pkts_in": 2, "num_pkts_out": 2, "idp_len_out": 16, "bytes_in": 0, "expire_type": "a", "entropy": 2.418296, "sa": "131.202.240.87", "byte_dist": [4, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 443, "byte_dist_mean": 32.25}
{"ip": {"in": {"id": [15010], "ttl": 52}, "out": {"id": [3028, 3029], "ttl": 128}}, "idp_in": "4500004d3aa240003406f937d194cd1a", "time_end": 1429117979.544217, "expire_type": "a", "entropy": 5.663991, "num_pkts_out": 2, "pr": 6, "time_start": 1429117979.470117, "bytes_in": 37, "num_pkts_in": 1, "bytes_out": 37, "byte_dist_std": 51.29959, "da": "209.148.205.26", "byte_dist_mean": 83.459459, "idp_len_out": 16, "total_entropy": 419.135367, "byte_dist": [2, 0, 1, 5, 1, 1, 0, 0, 1, 0, 1, 1, 0, 2, 0, 0, 0, 1, 0, 0, 0, 0, 0, 4, 0, 1, 0, 1, 0, 0, 1, 0, 2, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1], "dp": 443, "idp_len_in": 16, "tls": {"error": "no role"}, "sp": 3229, "packets": [{"b": 37, "ipt": 0, "dir": ">"}, {"b": 37, "ipt": 22, "dir": "<"}], "idp_out": "4500004d0bd440008006dc0583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53592, 53593], "ttl": 63}, "out": {"id": [8180, 8181], "ttl": 63}}, "idp_in": "450000a9d15800003f11bdfb83caf403", "time_end": 1429117980.44444, "expire_type": "a", "entropy": 4.640288, "num_pkts_out": 2, "pr": 17, "time_start": 1429117980.442963, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2263}, {"a": "173.252.100.27", "ttl": 16}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2263}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 1}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 62.692385, "da": "131.202.244.3", "byte_dist_mean": 61.444751, "idp_len_out": 16, "total_entropy": 1679.784211, "byte_dist": [93, 35, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56950, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ff440003f112fcb83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [9245, 9246, 9249, 9250, 9252, 9253, 9254, 9255, 9256, 9257, 9258, 9259, 9260, 9261, 9263, 9265, 9267, 9268, 9270, 9271, 9272, 9273, 9274, 9275, 9276, 9277, 9278, 9279, 9280, 9282, 9283, 9287, 9288, 9291, 9303, 9305, 9307, 9309, 9315, 9317, 9326, 9330, 9332, 9333, 9335, 9336, 9337, 9338, 9339, 9340], "ttl": 128}, "out": {"id": [17503, 17504, 17505, 17506, 17507, 17508, 17509, 17510, 17511, 17512, 17513, 17514, 17515, 17516, 17517, 17518, 17519, 17520, 17521, 17522, 17523, 17524, 17525, 17526, 17527, 17528, 17529, 17530, 17531, 17532, 17533, 17534, 17535, 17536, 17537, 17538, 17539, 17540, 17541, 17542, 17543, 17544, 17545, 17546, 17547, 17548, 17549, 17550, 17551, 17552], "ttl": 76}}, "idp_in": "45000175241e40008006452b83caf057", "time_end": 1429118003.673866, "expire_type": "a", "entropy": 4.482923, "num_pkts_out": 74, "pr": 6, "time_start": 1429117980.743449, "bytes_in": 16655, "num_pkts_in": 64, "bytes_out": 29010, "byte_dist_std": 54.390376, "da": "131.202.240.87", "byte_dist_mean": 125.984145, "idp_len_out": 16, "total_entropy": 204712.680204, "byte_dist": [209, 101, 90, 174, 100, 97, 91, 84, 88, 85, 114, 78, 82, 85, 89, 85, 90, 86, 88, 81, 84, 75, 90, 121, 87, 88, 86, 88, 79, 84, 80, 78, 88, 86, 80, 84, 83, 109, 88, 74, 94, 98, 88, 78, 87, 106, 92, 88, 94, 88, 84, 80, 86, 87, 110, 88, 80, 79, 88, 79, 90, 81, 92, 95, 88, 86, 77, 83, 92, 79, 89, 87, 87, 87, 87, 79, 88, 93, 88, 89, 86, 85, 98, 97, 93, 96, 85, 98, 92, 82, 92, 76, 91, 92, 84, 90, 93, 94, 84, 93, 89, 88, 79, 102, 94, 75, 89, 90, 81, 92, 93, 99, 87, 91, 83, 87, 89, 99, 87, 85, 100, 94, 81, 94, 85, 82, 93, 94, 86, 103, 88, 96, 90, 81, 79, 81, 95, 86, 91, 81, 88, 86, 89, 84, 88, 83, 98, 85, 83, 92, 90, 80, 89, 85, 91, 93, 85, 91, 92, 90, 88, 76, 86, 84, 93, 84, 109, 84, 94, 94, 91, 82, 98, 84, 82, 91, 88, 115, 92, 73, 75, 78, 81, 77, 86, 83, 115, 81, 93, 74, 94, 85, 94, 80, 86, 81, 81, 94, 81, 88, 86, 94, 93, 101, 91, 93, 75, 89, 75, 82, 87, 95, 89, 82, 91, 102, 75, 75, 86, 90, 88, 83, 94, 90, 88, 73, 90, 90, 96, 89, 113, 97, 82, 85, 83, 88, 97, 84, 97, 87, 86, 96, 88, 77, 75, 84, 78, 84, 88, 86, 87, 86, 85, 91, 79, 91], "dp": 1967, "idp_len_in": 16, "tls": {"error": "no role"}, "sp": 443, "packets": [{"b": 1291, "ipt": 0, "dir": ">"}, {"b": 333, "ipt": 92, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1290, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 45, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 83, "dir": ">"}, {"b": 252, "ipt": 0, "dir": ">"}, {"b": 472, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 140, "dir": ">"}, {"b": 268, "ipt": 0, "dir": ">"}, {"b": 135, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 1215, "ipt": 85, "dir": ">"}, {"b": 419, "ipt": 5, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 808, "ipt": 341, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 511, "dir": ">"}, {"b": 268, "ipt": 0, "dir": ">"}, {"b": 253, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 743, "ipt": 84, "dir": ">"}, {"b": 621, "ipt": 28, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 768, "ipt": 12, "dir": ">"}, {"b": 580, "ipt": 5, "dir": "<"}, {"b": 45, "ipt": 138, "dir": ">"}, {"b": 517, "ipt": 494, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 4, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 78, "dir": ">"}, {"b": 256, "ipt": 0, "dir": ">"}, {"b": 120, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 279, "ipt": 553, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 47, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1111, "ipt": 143, "dir": ">"}, {"b": 428, "ipt": 29, "dir": "<"}, {"b": 1350, "ipt": 25, "dir": ">"}, {"b": 279, "ipt": 0, "dir": ">"}, {"b": 198, "ipt": 0, "dir": ">"}, {"b": 47, "ipt": 0, "dir": ">"}, {"b": 45, "ipt": 113, "dir": ">"}, {"b": 894, "ipt": 12, "dir": ">"}, {"b": 604, "ipt": 3, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 657, "ipt": 1567, "dir": ">"}, {"b": 581, "ipt": 10, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 643, "ipt": 13, "dir": ">"}, {"b": 581, "ipt": 8, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 644, "ipt": 1183, "dir": ">"}, {"b": 584, "ipt": 7, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 644, "ipt": 10995, "dir": ">"}, {"b": 587, "ipt": 14, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 12, "dir": ">"}, {"b": 91, "ipt": 0, "dir": ">"}, {"b": 521, "ipt": 40, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 729, "ipt": 0, "dir": "<"}, {"b": 45, "ipt": 137, "dir": ">"}, {"b": 1350, "ipt": 144, "dir": ">"}, {"b": 539, "ipt": 1133, "dir": "<"}, {"b": 1350, "ipt": 69, "dir": "<"}, {"b": 652, "ipt": 0, "dir": "<"}, {"b": 431, "ipt": 986, "dir": "<"}, {"b": 606, "ipt": 154, "dir": "<"}, {"b": 508, "ipt": 1189, "dir": "<"}, {"b": 311, "ipt": 137, "dir": "<"}, {"b": 45, "ipt": 210, "dir": "<"}], "idp_out": "45000533445f40004c06552cadfc6e1b", "sa": "173.252.110.27"}
{"ip": {"in": {"id": [39383, 39384, 39394, 39395, 39396, 39397, 39398, 39419, 39438, 39445, 39446, 46747, 46748, 46756, 46757, 46758, 46759, 46760, 46763, 46832, 46833], "ttl": 55}, "out": {"id": [30377, 30378, 30379, 30380, 30381, 30382, 30383, 30384, 30385, 30386, 30387, 30388, 30389, 30390, 30391, 30392, 30393, 30394, 30395, 30396, 30397], "ttl": 128}}, "idp_in": "4500003f99d70000371148914a7de2a6", "time_end": 1429117996.406121, "expire_type": "a", "entropy": 7.990552, "num_pkts_out": 21, "pr": 17, "time_start": 1429117980.985336, "bytes_in": 9817, "num_pkts_in": 21, "bytes_out": 12590, "byte_dist_std": 53.011083, "da": "74.125.226.166", "byte_dist_mean": 126.600348, "idp_len_out": 16, "total_entropy": 179044.308196, "byte_dist": [106, 86, 100, 94, 89, 88, 87, 87, 86, 83, 101, 95, 116, 84, 87, 101, 95, 91, 92, 93, 89, 96, 92, 99, 96, 93, 64, 88, 92, 91, 81, 98, 79, 82, 93, 90, 99, 97, 78, 79, 93, 78, 92, 87, 104, 92, 95, 75, 94, 82, 71, 89, 90, 80, 86, 96, 91, 84, 90, 107, 84, 87, 90, 80, 86, 92, 79, 78, 107, 99, 74, 81, 104, 94, 91, 106, 86, 83, 98, 110, 88, 81, 91, 76, 80, 88, 95, 82, 89, 80, 81, 105, 92, 87, 85, 96, 78, 94, 87, 92, 63, 80, 73, 84, 80, 96, 84, 71, 87, 83, 93, 81, 68, 66, 100, 82, 86, 93, 81, 77, 72, 91, 83, 103, 91, 62, 89, 92, 81, 87, 82, 68, 84, 85, 69, 82, 82, 72, 75, 89, 103, 80, 84, 92, 78, 86, 77, 77, 96, 89, 88, 98, 79, 90, 105, 120, 99, 94, 72, 87, 82, 69, 99, 89, 84, 78, 71, 83, 93, 89, 93, 91, 83, 92, 95, 91, 76, 85, 100, 99, 101, 73, 100, 92, 77, 108, 107, 86, 90, 98, 91, 71, 71, 79, 89, 87, 94, 79, 80, 88, 91, 85, 97, 98, 75, 94, 93, 103, 92, 81, 99, 78, 72, 88, 96, 77, 101, 91, 80, 95, 73, 81, 75, 94, 77, 87, 88, 76, 86, 99, 88, 85, 95, 82, 102, 93, 75, 87, 59, 109, 78, 67, 77, 81, 102, 86, 85, 102, 85, 90, 90, 81, 94, 89, 85, 85], "dp": 443, "idp_len_in": 16, "sp": 56937, "packets": [{"b": 285, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 377, "ipt": 0, "dir": ">"}, {"b": 35, "ipt": 25, "dir": "<"}, {"b": 32, "ipt": 0, "dir": "<"}, {"b": 77, "ipt": 20, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 46, "ipt": 0, "dir": ">"}, {"b": 221, "ipt": 0, "dir": "<"}, {"b": 40, "ipt": 0, "dir": ">"}, {"b": 299, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 226, "ipt": 0, "dir": ">"}, {"b": 38, "ipt": 25, "dir": "<"}, {"b": 29, "ipt": 24, "dir": "<"}, {"b": 51, "ipt": 46, "dir": "<"}, {"b": 386, "ipt": 0, "dir": "<"}, {"b": 46, "ipt": 0, "dir": ">"}, {"b": 285, "ipt": 15116, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 1350, "ipt": 0, "dir": ">"}, {"b": 377, "ipt": 0, "dir": ">"}, {"b": 35, "ipt": 29, "dir": "<"}, {"b": 32, "ipt": 0, "dir": "<"}, {"b": 1350, "ipt": 21, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 1350, "ipt": 0, "dir": "<"}, {"b": 182, "ipt": 0, "dir": "<"}, {"b": 118, "ipt": 0, "dir": "<"}, {"b": 46, "ipt": 0, "dir": ">"}, {"b": 40, "ipt": 0, "dir": ">"}, {"b": 299, "ipt": 1, "dir": ">"}, {"b": 731, "ipt": 0, "dir": ">"}, {"b": 38, "ipt": 25, "dir": "<"}, {"b": 57, "ipt": 79, "dir": "<"}, {"b": 386, "ipt": 0, "dir": "<"}, {"b": 43, "ipt": 0, "dir": ">"}], "idp_out": "4500013976a90000801121c583caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429117984.539708, "bytes_out": 12, "sp": 13397, "packets": [{"b": 6, "ipt": 0, "dir": ">"}, {"b": 6, "ipt": 29995, "dir": ">"}], "time_end": 1429118014.708356, "byte_dist_std": 52.156161, "da": "178.237.19.227", "total_entropy": 29.019553, "ip": {"in": {"id": [47728, 56259], "ttl": 97}, "out": {"id": [14964, 14968], "ttl": 128}}, "idp_out": "4500002e3a7440008006856383caf057", "num_pkts_in": 2, "num_pkts_out": 2, "idp_len_out": 16, "bytes_in": 0, "expire_type": "a", "entropy": 2.418296, "sa": "131.202.240.87", "byte_dist": [4, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 443, "byte_dist_mean": 30.916667}
{"pr": 6, "time_start": 1429117984.539844, "bytes_out": 12, "sp": 13393, "packets": [{"b": 6, "ipt": 0, "dir": ">"}, {"b": 6, "ipt": 29995, "dir": ">"}], "time_end": 1429118014.707624, "byte_dist_std": 78.967341, "da": "178.237.24.202", "total_entropy": 29.019553, "ip": {"in": {"id": [50533, 31828], "ttl": 97}, "out": {"id": [26017, 26021], "ttl": 128}}, "idp_out": "4500002e65a140008006554f83caf057", "num_pkts_in": 2, "num_pkts_out": 2, "idp_len_out": 16, "bytes_in": 0, "expire_type": "a", "entropy": 2.418296, "sa": "131.202.240.87", "byte_dist": [4, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 443, "byte_dist_mean": 42.75}
{"ip": {"in": {"id": [53594, 53595], "ttl": 63}, "out": {"id": [8182, 8183], "ttl": 63}}, "idp_in": "450000a9d15a00003f11bdf983caf403", "time_end": 1429117984.603511, "expire_type": "a", "entropy": 4.642361, "num_pkts_out": 2, "pr": 17, "time_start": 1429117984.601698, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2259}, {"a": "173.252.100.27", "ttl": 12}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2259}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 59}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 61.561279, "da": "131.202.244.3", "byte_dist_mean": 60.063536, "idp_len_out": 16, "total_entropy": 1680.534741, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 6, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 2, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 1, 1, 0, 0, 0, 2, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56951, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ff640003f112fc983caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53596, 53597], "ttl": 63}, "out": {"id": [8184, 8185], "ttl": 63}}, "idp_in": "450000a9d15c00003f11bdf783caf403", "time_end": 1429117984.612295, "expire_type": "a", "entropy": 4.638582, "num_pkts_out": 2, "pr": 17, "time_start": 1429117984.610051, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2259}, {"a": "173.252.100.27", "ttl": 12}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2259}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 59}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 61.105324, "da": "131.202.244.3", "byte_dist_mean": 59.687845, "idp_len_out": 16, "total_entropy": 1679.166767, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 6, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 9, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 2, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56952, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ff840003f112fc783caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53598, 53599], "ttl": 63}, "out": {"id": [8186, 8187], "ttl": 63}}, "idp_in": "450000a9d15e00003f11bdf583caf403", "time_end": 1429117985.79381, "expire_type": "i", "entropy": 4.638441, "num_pkts_out": 2, "pr": 17, "time_start": 1429117985.792115, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2258}, {"a": "173.252.100.27", "ttl": 11}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2258}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 58}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 61.072066, "da": "131.202.244.3", "byte_dist_mean": 59.881215, "idp_len_out": 16, "total_entropy": 1679.115673, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 5, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 2, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56953, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ffa40003f112fc583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53600, 53601], "ttl": 63}, "out": {"id": [8188, 8189], "ttl": 63}}, "idp_in": "450000a9d16000003f11bdf383caf403", "time_end": 1429117987.677215, "expire_type": "i", "entropy": 4.58285, "num_pkts_out": 2, "pr": 17, "time_start": 1429117987.672884, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2256}, {"a": "173.252.100.27", "ttl": 9}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2256}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 56}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 60.899421, "da": "131.202.244.3", "byte_dist_mean": 58.820442, "idp_len_out": 16, "total_entropy": 1658.991693, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 1, 0, 4, 5, 2, 0, 0, 4, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 12, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 26, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56954, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 3, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ffc40003f112fc383caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429117993.34873, "bytes_out": 1, "sp": 2417, "packets": [{"b": 1, "ipt": 0, "dir": ">"}], "time_end": 1429117993.38737, "byte_dist_std": 0.0, "da": "173.194.208.188", "total_entropy": 0.0, "ip": {"in": {"id": [51249], "ttl": 44}, "out": {"id": [9286], "ttl": 128}}, "idp_out": "45000029244640008006e3e783caf057", "num_pkts_in": 1, "num_pkts_out": 1, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 0.0, "sa": "131.202.240.87", "byte_dist": [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5228, "byte_dist_mean": 0.0}
{"ip": {"in": {"id": [53602, 53603], "ttl": 63}, "out": {"id": [8190, 8191], "ttl": 63}}, "idp_in": "450000a9d16200003f11bdf183caf403", "time_end": 1429117998.855788, "expire_type": "i", "entropy": 4.657306, "num_pkts_out": 2, "pr": 17, "time_start": 1429117998.779677, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2245}, {"a": "173.252.100.27", "ttl": 60}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2245}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 45}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 61.585785, "da": "131.202.244.3", "byte_dist_mean": 61.151934, "idp_len_out": 16, "total_entropy": 1685.944842, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56955, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 75, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e1ffe40003f112fc183caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429118003.000591, "bytes_out": 74, "sp": 1258, "packets": [{"b": 74, "ipt": 0, "dir": ">"}], "time_end": 1429118003.053152, "byte_dist_std": 76.258888, "da": "64.12.104.73", "total_entropy": 433.990188, "ip": {"in": {"id": [10597], "ttl": 100}, "out": {"id": [26339], "ttl": 128}}, "idp_out": "4500007266e340008006772b83caf057", "num_pkts_in": 1, "num_pkts_out": 1, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 5.864732, "sa": "131.202.240.87", "byte_dist": [3, 2, 1, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 3, 0, 0, 0, 0, 1, 1, 0, 2, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 2, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 2, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0], "dp": 443, "byte_dist_mean": 104.081081}
{"pr": 6, "time_start": 1429118003.00107, "bytes_out": 53, "sp": 1254, "packets": [{"b": 53, "ipt": 0, "dir": ">"}], "time_end": 1429118003.053931, "byte_dist_std": 81.774305, "da": "64.12.104.85", "total_entropy": 291.579659, "ip": {"in": {"id": [17673], "ttl": 100}, "out": {"id": [19816], "ttl": 128}}, "idp_out": "4500005d4d684000800690af83caf057", "num_pkts_in": 1, "num_pkts_out": 1, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 5.501503, "sa": "131.202.240.87", "byte_dist": [1, 1, 0, 2, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 2, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0], "dp": 443, "byte_dist_mean": 135.037736}
{"ip": {"in": {"id": [53604, 53605], "ttl": 63}, "out": {"id": [8192, 8193], "ttl": 63}}, "idp_in": "450000a9d16400003f11bdef83caf403", "time_end": 1429118015.525423, "expire_type": "a", "entropy": 4.659391, "num_pkts_out": 2, "pr": 17, "time_start": 1429118015.524327, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2228}, {"a": "173.252.100.27", "ttl": 43}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2228}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 28}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 60.134558, "da": "131.202.244.3", "byte_dist_mean": 59.383978, "idp_len_out": 16, "total_entropy": 1686.699688, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 2, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56964, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200040003f112fbf83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53606, 53607], "ttl": 63}, "out": {"id": [8194, 8195], "ttl": 63}}, "idp_in": "450000a9d16600003f11bded83caf403", "time_end": 1429118015.531559, "expire_type": "a", "entropy": 4.648342, "num_pkts_out": 2, "pr": 17, "time_start": 1429118015.529812, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2228}, {"a": "173.252.100.27", "ttl": 43}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2228}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 28}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.127822, "da": "131.202.244.3", "byte_dist_mean": 57.533149, "idp_len_out": 16, "total_entropy": 1682.699679, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 2, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 4, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56965, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200240003f112fbd83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53608, 53609], "ttl": 63}, "out": {"id": [8196, 8197], "ttl": 63}}, "idp_in": "450000a9d16800003f11bdeb83caf403", "time_end": 1429118017.179117, "expire_type": "a", "entropy": 4.649695, "num_pkts_out": 2, "pr": 17, "time_start": 1429118017.177924, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2227}, {"a": "173.252.100.27", "ttl": 42}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2227}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 27}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.385154, "da": "131.202.244.3", "byte_dist_mean": 58.48895, "idp_len_out": 16, "total_entropy": 1683.189734, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 2, 2, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56966, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200440003f112fbb83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53610, 53611], "ttl": 63}, "out": {"id": [8198, 8199], "ttl": 63}}, "idp_in": "450000a9d16a00003f11bde983caf403", "time_end": 1429118018.836649, "expire_type": "a", "entropy": 4.635091, "num_pkts_out": 2, "pr": 17, "time_start": 1429118018.83551, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2225}, {"a": "173.252.100.27", "ttl": 40}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2225}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 25}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.952812, "da": "131.202.244.3", "byte_dist_mean": 58.660221, "idp_len_out": 16, "total_entropy": 1677.90288, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 7, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 1, 2, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56967, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200640003f112fb983caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53612, 53613], "ttl": 63}, "out": {"id": [8200, 8201], "ttl": 63}}, "idp_in": "450000a9d16c00003f11bde783caf403", "time_end": 1429118022.061268, "expire_type": "i", "entropy": 4.657306, "num_pkts_out": 2, "pr": 17, "time_start": 1429118022.059362, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2222}, {"a": "173.252.100.27", "ttl": 37}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2222}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 22}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 60.911251, "da": "131.202.244.3", "byte_dist_mean": 60.466851, "idp_len_out": 16, "total_entropy": 1685.944842, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 2, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 2, 0, 1, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 2, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56968, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200840003f112fb783caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53614, 53615], "ttl": 63}, "out": {"id": [8202, 8203], "ttl": 63}}, "idp_in": "450000a9d16e00003f11bde583caf403", "time_end": 1429118022.102392, "expire_type": "i", "entropy": 4.668355, "num_pkts_out": 2, "pr": 17, "time_start": 1429118022.100972, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2222}, {"a": "173.252.100.27", "ttl": 37}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2222}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 22}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.044191, "da": "131.202.244.3", "byte_dist_mean": 57.240331, "idp_len_out": 16, "total_entropy": 1689.944678, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 2, 0, 4, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 3, 2, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 2, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 2, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56969, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200a40003f112fb583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53616, 53617], "ttl": 63}, "out": {"id": [8204, 8205], "ttl": 63}}, "idp_in": "450000a9d17000003f11bde383caf403", "time_end": 1429118031.06156, "expire_type": "i", "entropy": 4.659391, "num_pkts_out": 2, "pr": 17, "time_start": 1429118031.059251, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2213}, {"a": "173.252.100.27", "ttl": 28}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2213}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 13}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.637446, "da": "131.202.244.3", "byte_dist_mean": 57.140884, "idp_len_out": 16, "total_entropy": 1686.699515, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 1, 0, 0, 4, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 2, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56970, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200c40003f112fb383caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53618, 53619], "ttl": 63}, "out": {"id": [8206, 8207], "ttl": 63}}, "idp_in": "450000a9d17200003f11bde183caf403", "time_end": 1429118031.067342, "expire_type": "i", "entropy": 4.630414, "num_pkts_out": 2, "pr": 17, "time_start": 1429118031.066076, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2213}, {"a": "173.252.100.27", "ttl": 28}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2213}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 13}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.494402, "da": "131.202.244.3", "byte_dist_mean": 57.814917, "idp_len_out": 16, "total_entropy": 1676.209699, "byte_dist": [93, 34, 20, 9, 11, 4, 0, 3, 8, 0, 0, 4, 5, 1, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 2, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56971, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e200e40003f112fb183caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [54346, 54356, 54363, 54383, 54448, 54461, 54470, 54471], "ttl": 99}, "out": {"id": [5612, 5614, 5615, 5616, 5617, 5618, 5621, 5622, 5623, 5624], "ttl": 128}}, "idp_in": "45000042d4544000630673f2400c1b41", "time_end": 1429118037.94616, "tcp": {"out": {"opt_len": 12, "flags": "S", "opts": [{"mss": 1460}, {"noop": null}, {"ws": 2}, {"noop": null}, {"noop": null}, {"sackp": null}], "first_window_size": 8192}, "in": {"opt_len": 4, "flags": "SA", "opts": [{"mss": 1350}], "first_window_size": 16384}, "first_seq": 927533259}, "expire_type": "i", "entropy": 1.148235, "num_pkts_out": 10, "pr": 6, "time_start": 1429118037.165179, "bytes_in": 992, "num_pkts_in": 8, "bytes_out": 461, "probable_os": {"in": "Windows 2000", "out": "Windows 7, Vista, and Server 8"}, "byte_dist_std": 46.536762, "da": "64.12.27.65", "byte_dist_mean": 46.0, "idp_len_out": 16, "total_entropy": 1668.384882, "byte_dist": [135, 20, 6, 3, 3, 3, 2, 2, 0, 1, 1, 2, 1, 2, 1, 1, 28, 1, 1, 1, 2, 1, 1, 2, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 3, 0, 1, 1, 2, 0, 2, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 2, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1], "dp": 443, "idp_len_in": 16, "sp": 3245, "packets": [{"b": 317, "ipt": 77, "dir": ">"}, {"b": 26, "ipt": 28, "dir": "<"}, {"b": 20, "ipt": 24, "dir": "<"}, {"b": 24, "ipt": 13, "dir": ">"}, {"b": 24, "ipt": 52, "dir": "<"}, {"b": 16, "ipt": 385, "dir": ">"}, {"b": 785, "ipt": 53, "dir": "<"}, {"b": 26, "ipt": 18, "dir": ">"}, {"b": 78, "ipt": 53, "dir": ">"}, {"b": 137, "ipt": 53, "dir": "<"}], "idp_out": "4500016515ef40008006143583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53620, 53621], "ttl": 63}, "out": {"id": [8208, 8209], "ttl": 63}}, "idp_in": "450000a9d17400003f11bddf83caf403", "time_end": 1429118037.356234, "expire_type": "i", "entropy": 4.668356, "num_pkts_out": 2, "pr": 17, "time_start": 1429118037.353969, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2206}, {"a": "173.252.100.27", "ttl": 21}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2206}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 6}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.392867, "da": "131.202.244.3", "byte_dist_mean": 58.765193, "idp_len_out": 16, "total_entropy": 1689.944851, "byte_dist": [93, 34, 20, 9, 11, 2, 1, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 2, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56986, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e201040003f112faf83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [20806, 20841, 20963, 20964, 20965], "ttl": 124}, "out": {"id": [9665, 9666, 9667, 9668, 9669], "ttl": 128}}, "idp_in": "450000eb51e340007c06ae2383ca061a", "time_end": 1429118037.746882, "tcp": {"out": {"opt_len": 12, "flags": "S", "opts": [{"mss": 1460}, {"noop": null}, {"ws": 8}, {"noop": null}, {"noop": null}, {"sackp": null}], "first_window_size": 8192}, "in": {"opt_len": 12, "flags": "SA", "opts": [{"mss": 1350}, {"noop": null}, {"ws": 8}, {"noop": null}, {"noop": null}, {"sackp": null}], "first_window_size": 8192}, "first_seq": 685191032}, "expire_type": "i", "entropy": 6.639049, "num_pkts_out": 5, "pr": 6, "time_start": 1429118037.441899, "bytes_in": 195, "num_pkts_in": 5, "bytes_out": 124, "probable_os": {"in": "Windows 7, Vista, and Server 8", "out": "Windows 7, Vista, and Server 8"}, "byte_dist_std": 57.883733, "da": "131.202.6.26", "byte_dist_mean": 89.636364, "idp_len_out": 16, "total_entropy": 2117.856648, "byte_dist": [39, 11, 6, 5, 2, 2, 5, 2, 1, 2, 5, 2, 2, 1, 1, 1, 4, 3, 0, 1, 0, 1, 0, 3, 2, 1, 0, 0, 1, 3, 2, 1, 9, 0, 1, 1, 2, 1, 0, 0, 0, 0, 1, 3, 1, 1, 3, 0, 1, 2, 4, 2, 3, 1, 2, 2, 1, 0, 1, 0, 2, 1, 2, 0, 3, 3, 0, 2, 1, 0, 1, 2, 0, 1, 1, 4, 2, 0, 2, 0, 0, 0, 0, 2, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 2, 2, 1, 0, 1, 1, 1, 0, 1, 4, 1, 0, 0, 0, 1, 1, 0, 0, 2, 0, 0, 0, 3, 1, 1, 3, 0, 1, 2, 4, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 4, 1, 0, 0, 0, 0, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 1, 0, 0, 1, 2, 1, 1, 0, 0, 1, 2, 2, 0, 2, 1, 2, 3, 0, 1, 3, 1, 2, 2, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 2, 1, 3, 1, 1, 0, 0, 2, 0, 1, 0, 0, 1, 3, 1, 0, 1, 1, 0, 2, 3, 0, 1, 3, 0, 2, 0, 0, 1, 0, 0, 0, 2, 1, 0, 1, 2, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 3], "dp": 13111, "idp_len_in": 16, "sp": 3246, "packets": [{"b": 124, "ipt": 2, "dir": ">"}, {"b": 195, "ipt": 301, "dir": "<"}], "idp_out": "450000a425c340008006d68a83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53622, 53623], "ttl": 63}, "out": {"id": [8215, 8216], "ttl": 63}}, "idp_in": "450000a9d17600003f11bddd83caf403", "time_end": 1429118039.170632, "expire_type": "i", "entropy": 4.622142, "num_pkts_out": 2, "pr": 17, "time_start": 1429118039.168935, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2205}, {"a": "173.252.100.27", "ttl": 20}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2205}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 5}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.016701, "da": "131.202.244.3", "byte_dist_mean": 57.676796, "idp_len_out": 16, "total_entropy": 1673.215345, "byte_dist": [93, 34, 20, 9, 11, 3, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 4, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 2, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56995, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e201740003f112fa883caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53624, 53625], "ttl": 63}, "out": {"id": [8217, 8218], "ttl": 63}}, "idp_in": "450000a9d17800003f11bddb83caf403", "time_end": 1429118039.879451, "expire_type": "i", "entropy": 4.654638, "num_pkts_out": 2, "pr": 17, "time_start": 1429118039.878129, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2204}, {"a": "173.252.100.27", "ttl": 19}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2204}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 4}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.450977, "da": "131.202.244.3", "byte_dist_mean": 58.207182, "idp_len_out": 16, "total_entropy": 1684.978889, "byte_dist": [93, 34, 20, 9, 12, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 2, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56996, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e201940003f112fa683caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53626, 53627], "ttl": 63}, "out": {"id": [8219, 8220], "ttl": 63}}, "idp_in": "450000a9d17a00003f11bdd983caf403", "time_end": 1429118039.93423, "expire_type": "i", "entropy": 4.654639, "num_pkts_out": 2, "pr": 17, "time_start": 1429118039.932799, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2204}, {"a": "173.252.100.27", "ttl": 19}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2204}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 4}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.538153, "da": "131.202.244.3", "byte_dist_mean": 59.107735, "idp_len_out": 16, "total_entropy": 1684.979234, "byte_dist": [93, 34, 20, 9, 12, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56997, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e201b40003f112fa483caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53628, 53629], "ttl": 63}, "out": {"id": [8221, 8222], "ttl": 63}}, "idp_in": "450000b1d17c00003f11bdcf83caf403", "time_end": 1429118040.119793, "expire_type": "i", "entropy": 4.852696, "num_pkts_out": 2, "pr": 17, "time_start": 1429118040.118355, "bytes_in": 310, "num_pkts_in": 2, "dns": [{"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2263}, {"a": "173.252.100.27", "ttl": 19}], "rc": 0}, {"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2263}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 4}], "rc": 0}], "bytes_out": 84, "byte_dist_std": 57.03614, "da": "131.202.244.3", "byte_dist_mean": 60.667513, "idp_len_out": 16, "total_entropy": 1911.962389, "byte_dist": [93, 34, 20, 5, 12, 2, 0, 3, 6, 0, 0, 8, 5, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 1, 3, 0, 0, 0, 2, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 8, 0, 0, 2, 2, 4, 0, 0, 0, 2, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 12, 6, 14, 5, 12, 4, 4, 4, 0, 1, 4, 1, 4, 2, 12, 0, 1, 4, 4, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 2, 2], "dp": 53, "idp_len_in": 16, "sp": 56998, "packets": [{"b": 42, "ipt": 0, "dir": ">"}, {"b": 149, "ipt": 0, "dir": "<"}, {"b": 42, "ipt": 0, "dir": ">"}, {"b": 161, "ipt": 0, "dir": "<"}], "idp_out": "45000046201d40003f112f9a83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53630, 53631], "ttl": 63}, "out": {"id": [8223, 8224], "ttl": 63}}, "idp_in": "450000a9d17e00003f11bdd583caf403", "time_end": 1429118041.973815, "expire_type": "i", "entropy": 4.644723, "num_pkts_out": 2, "pr": 17, "time_start": 1429118041.961628, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2202}, {"a": "173.252.100.27", "ttl": 17}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2202}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 2}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.194356, "da": "131.202.244.3", "byte_dist_mean": 57.864641, "idp_len_out": 16, "total_entropy": 1681.389876, "byte_dist": [93, 34, 21, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 1, 0, 0, 0, 0, 0, 0, 0, 2, 0, 3, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 2, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 56999, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 11, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e201f40003f112fa083caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [18995, 18996], "ttl": 234}, "out": {"id": [7637, 7638], "ttl": 128}}, "idp_in": "4500002e4a334000ea11db994d48a987", "time_end": 1429118044.100037, "expire_type": "i", "entropy": 5.959649, "num_pkts_out": 2, "pr": 17, "time_start": 1429118043.965802, "bytes_in": 85, "num_pkts_in": 2, "bytes_out": 126, "byte_dist_std": 55.368776, "da": "77.72.169.135", "byte_dist_mean": 96.085308, "idp_len_out": 16, "total_entropy": 1257.485857, "byte_dist": [36, 2, 1, 1, 0, 0, 0, 2, 0, 2, 0, 0, 0, 2, 2, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 3, 2, 0, 1, 1, 0, 3, 0, 0, 4, 0, 0, 2, 1, 2, 0, 0, 2, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 2, 1, 2, 2, 1, 0, 2, 0, 3, 2, 2, 2, 1, 1, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 0, 2, 1, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 3, 0, 2, 0, 2, 0, 4, 2, 2, 2, 0, 4, 0, 0, 0, 2, 0, 0, 0, 2, 2, 0, 2, 0, 0, 2, 1, 0, 1, 0, 2, 0, 0, 0, 1, 0, 0, 2, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 3, 0, 1, 2, 0, 0, 1, 3, 4, 0, 0, 2, 0, 0, 0, 1, 0, 0, 2, 0, 1, 0, 0, 2, 3, 0, 0, 2, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 2, 2, 0, 1, 0, 1, 1, 0, 1, 2, 0, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2], "dp": 11113, "idp_len_in": 16, "sp": 43302, "packets": [{"b": 108, "ipt": 0, "dir": ">"}, {"b": 18, "ipt": 134, "dir": "<"}, {"b": 67, "ipt": 0, "dir": "<"}, {"b": 18, "ipt": 0, "dir": ">"}], "idp_out": "450000881dd540008011719e83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53632, 53633], "ttl": 63}, "out": {"id": [8225, 8226], "ttl": 63}}, "idp_in": "450000a9d18000003f11bdd383caf403", "time_end": 1429118049.857447, "expire_type": "i", "entropy": 4.657306, "num_pkts_out": 2, "pr": 17, "time_start": 1429118049.781233, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2194}, {"a": "173.252.100.27", "ttl": 9}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2194}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 60}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.253022, "da": "131.202.244.3", "byte_dist_mean": 59.063536, "idp_len_out": 16, "total_entropy": 1685.944842, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 1, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 4, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 57000, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 75, "dir": "<"}], "idp_out": "4500003e202140003f112f9e83caf057", "sa": "131.202.240.87"}
{"pr": 17, "time_start": 1429118049.881119, "bytes_out": 44, "sp": 53327, "packets": [{"b": 22, "ipt": 0, "dir": "<"}, {"b": 22, "ipt": 411, "dir": "<"}], "time_end": 1429118050.292257, "byte_dist_std": 41.492377, "da": "224.0.0.252", "idp_out": "45000032500500000111149883caf057", "entropy": 2.413089, "num_pkts_out": 2, "idp_len_out": 16, "ip": {"out": {"id": [20485, 20487], "ttl": 1}}, "expire_type": "i", "total_entropy": 106.175907, "sa": "131.202.240.87", "byte_dist": [24, 4, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5355, "byte_dist_mean": 24.681818}
{"pr": 17, "time_start": 1429118049.881191, "bytes_out": 150, "sp": 137, "packets": [{"b": 50, "ipt": 0, "dir": "<"}, {"b": 50, "ipt": 750, "dir": "<"}, {"b": 50, "ipt": 752, "dir": "<"}], "time_end": 1429118051.384342, "byte_dist_std": 38.081862, "da": "131.202.243.255", "idp_out": "4500004e542000008011fa9283caf057", "entropy": 2.882141, "num_pkts_out": 3, "idp_len_out": 16, "ip": {"out": {"id": [21536, 21537, 21538], "ttl": 128}}, "expire_type": "i", "total_entropy": 432.321167, "sa": "131.202.240.87", "byte_dist": [30, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 42, 3, 33, 0, 9, 6, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 137, "byte_dist_mean": 50.4}
{"pr": 17, "time_start": 1429118049.881404, "bytes_out": 44, "sp": 49487, "packets": [{"b": 22, "ipt": 0, "dir": "<"}, {"b": 22, "ipt": 410, "dir": "<"}], "time_end": 1429118050.292249, "byte_dist_std": 68.711672, "da": "224.0.0.252", "idp_out": "45000032500600000111149783caf057", "entropy": 2.287867, "num_pkts_out": 2, "idp_len_out": 16, "ip": {"out": {"id": [20486, 20488], "ttl": 1}}, "expire_type": "i", "total_entropy": 100.66613, "sa": "131.202.240.87", "byte_dist": [24, 6, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5355, "byte_dist_mean": 38.909091}
{"ip": {"in": {"id": [53634, 53635], "ttl": 63}, "out": {"id": [8230, 8231], "ttl": 63}}, "idp_in": "450000a9d18200003f11bdd183caf403", "time_end": 1429118055.396295, "expire_type": "i", "entropy": 4.6554, "num_pkts_out": 2, "pr": 17, "time_start": 1429118055.3952, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2188}, {"a": "173.252.100.27", "ttl": 3}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2188}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 54}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 57.958566, "da": "131.202.244.3", "byte_dist_mean": 56.754144, "idp_len_out": 16, "total_entropy": 1685.2549, "byte_dist": [93, 34, 20, 10, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 1, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 8, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 63659, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e202640003f112f9983caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53636, 53637], "ttl": 63}, "out": {"id": [8232, 8233], "ttl": 63}}, "idp_in": "450000a9d18400003f11bdcf83caf403", "time_end": 1429118057.3152, "expire_type": "i", "entropy": 4.619818, "num_pkts_out": 2, "pr": 17, "time_start": 1429118057.313162, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2186}, {"a": "173.252.100.27", "ttl": 1}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2186}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 52}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.293528, "da": "131.202.244.3", "byte_dist_mean": 57.837017, "idp_len_out": 16, "total_entropy": 1672.37402, "byte_dist": [93, 35, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 6, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 8, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 63660, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e202840003f112f9783caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429118077.502398, "bytes_out": 0, "sp": 19931, "packets": [], "time_end": 1429118080.495405, "tcp": {"out": {"opt_len": 20, "flags": "S", "opts": [{"mss": 1350}, {"sackp": null}, {"ts": {"ecr": 0, "val": 177914541}}, {"noop": null}, {"ws": 1}], "first_window_size": 5808}, "first_seq": 831169528}, "da": "131.202.240.87", "expire_type": "i", "num_pkts_out": 2, "ip": {"out": {"id": [25209, 25210], "ttl": 39}}, "sa": "114.34.249.170", "byte_dist": [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 23}
{"ip": {"in": {"id": [53638, 53639], "ttl": 63}, "out": {"id": [8234, 8235], "ttl": 63}}, "idp_in": "450000a9d18600003f11bdcd83caf403", "time_end": 1429118092.59205, "expire_type": "i", "entropy": 4.668355, "num_pkts_out": 2, "pr": 17, "time_start": 1429118092.587861, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2151}, {"a": "173.252.100.27", "ttl": 36}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2151}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 17}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.074532, "da": "131.202.244.3", "byte_dist_mean": 56.765193, "idp_len_out": 16, "total_entropy": 1689.944506, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 2, 0, 4, 5, 0, 0, 0, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 8, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 2, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 63665, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 3, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e202a40003f112f9583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53640, 53641], "ttl": 63}, "out": {"id": [8236, 8237], "ttl": 63}}, "idp_in": "450000a9d18800003f11bdcb83caf403", "time_end": 1429118092.646749, "expire_type": "i", "entropy": 4.668355, "num_pkts_out": 2, "pr": 17, "time_start": 1429118092.644507, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2151}, {"a": "173.252.100.27", "ttl": 36}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2151}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 17}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 57.308249, "da": "131.202.244.3", "byte_dist_mean": 55.892265, "idp_len_out": 16, "total_entropy": 1689.944506, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 8, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 2, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 63666, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e202c40003f112f9383caf057", "sa": "131.202.240.87"}
{"pr": 17, "time_start": 1429118111.466755, "bytes_out": 44, "sp": 60898, "packets": [{"b": 22, "ipt": 0, "dir": "<"}, {"b": 22, "ipt": 412, "dir": "<"}], "time_end": 1429118111.879262, "byte_dist_std": 62.498118, "da": "224.0.0.252", "idp_out": "45000032500900000111149483caf057", "entropy": 2.287867, "num_pkts_out": 2, "idp_len_out": 16, "ip": {"out": {"id": [20489, 20491], "ttl": 1}}, "expire_type": "i", "total_entropy": 100.66613, "sa": "131.202.240.87", "byte_dist": [24, 6, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5355, "byte_dist_mean": 36.409091}
{"pr": 17, "time_start": 1429118111.46723, "bytes_out": 44, "sp": 60555, "packets": [{"b": 22, "ipt": 0, "dir": "<"}, {"b": 22, "ipt": 412, "dir": "<"}], "time_end": 1429118111.879424, "byte_dist_std": 69.837943, "da": "224.0.0.252", "idp_out": "45000032500a00000111149383caf057", "entropy": 2.413089, "num_pkts_out": 2, "idp_len_out": 16, "ip": {"out": {"id": [20490, 20492], "ttl": 1}}, "expire_type": "i", "total_entropy": 106.175907, "sa": "131.202.240.87", "byte_dist": [24, 4, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5355, "byte_dist_mean": 40.681818}
{"ip": {"in": {"id": [53642, 53647], "ttl": 63}, "out": {"id": [8241, 8242], "ttl": 63}}, "idp_in": "450000a9d18a00003f11bdc983caf403", "time_end": 1429118127.163758, "expire_type": "i", "entropy": 4.629503, "num_pkts_out": 2, "pr": 17, "time_start": 1429118127.085517, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2117}, {"a": "173.252.100.27", "ttl": 2}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2117}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 60}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 59.301289, "da": "131.202.244.3", "byte_dist_mean": 57.668508, "idp_len_out": 16, "total_entropy": 1675.880177, "byte_dist": [93, 34, 21, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 8, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62056, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 76, "dir": "<"}], "idp_out": "4500003e203140003f112f8e83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53643, 53648], "ttl": 63}, "out": {"id": [8243, 8247], "ttl": 63}}, "idp_in": "450000b1d18b00003f11bdc083caf403", "time_end": 1429118127.163895, "expire_type": "i", "entropy": 4.838257, "num_pkts_out": 2, "pr": 17, "time_start": 1429118127.110926, "bytes_in": 310, "num_pkts_in": 2, "dns": [{"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2176}, {"a": "173.252.100.27", "ttl": 2}], "rc": 0}, {"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2176}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 60}], "rc": 0}], "bytes_out": 84, "byte_dist_std": 55.189344, "da": "131.202.244.3", "byte_dist_mean": 58.781726, "idp_len_out": 16, "total_entropy": 1906.273381, "byte_dist": [93, 34, 21, 5, 11, 2, 0, 3, 6, 0, 0, 8, 5, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 8, 0, 0, 2, 2, 4, 0, 0, 8, 2, 0, 0, 0, 0, 6, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 12, 6, 14, 5, 12, 4, 4, 4, 0, 1, 4, 1, 4, 2, 12, 0, 1, 4, 4, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 5, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62057, "packets": [{"b": 42, "ipt": 0, "dir": ">"}, {"b": 149, "ipt": 0, "dir": "<"}, {"b": 42, "ipt": 9, "dir": ">"}, {"b": 161, "ipt": 43, "dir": "<"}], "idp_out": "45000046203340003f112f8483caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53644], "ttl": 63}, "out": {"id": [8244], "ttl": 63}}, "idp_in": "450001ddd18c00003f11bc9383caf403", "time_end": 1429118127.114248, "expire_type": "i", "entropy": 4.886807, "num_pkts_out": 1, "pr": 17, "time_start": 1429118127.113593, "bytes_in": 449, "num_pkts_in": 1, "dns": [{"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 176}, {"cname": "a1168.dsw4.akamai.net", "ttl": 63}, {"a": "209.148.205.35", "ttl": 2}, {"a": "209.148.205.26", "ttl": 2}], "rc": 0}], "bytes_out": 41, "byte_dist_std": 67.587318, "da": "131.202.244.3", "byte_dist_mean": 65.24898, "idp_len_out": 16, "total_entropy": 2394.535646, "byte_dist": [122, 37, 10, 4, 12, 3, 11, 0, 5, 20, 4, 0, 2, 1, 1, 1, 0, 3, 0, 0, 2, 0, 0, 1, 0, 2, 1, 0, 0, 0, 0, 0, 2, 0, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 1, 3, 1, 1, 10, 2, 2, 1, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 19, 3, 3, 13, 8, 3, 1, 3, 8, 0, 12, 0, 4, 11, 0, 8, 0, 0, 13, 10, 1, 0, 9, 0, 0, 0, 0, 0, 0, 0, 2, 3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 2, 1, 0, 0, 0, 0, 0, 27, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 0, 1, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 11, 0, 0, 0, 1, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0], "dp": 53, "idp_len_in": 16, "sp": 62058, "packets": [{"b": 41, "ipt": 0, "dir": ">"}, {"b": 449, "ipt": 0, "dir": "<"}], "idp_out": "45000045203440003f112f8483caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53646], "ttl": 63}, "out": {"id": [8246], "ttl": 63}}, "idp_in": "450001ddd18e00003f11bc9183caf403", "time_end": 1429118127.117411, "expire_type": "i", "entropy": 4.878644, "num_pkts_out": 1, "pr": 17, "time_start": 1429118127.116782, "bytes_in": 449, "num_pkts_in": 1, "dns": [{"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 176}, {"cname": "a1168.dsw4.akamai.net", "ttl": 63}, {"a": "209.148.205.35", "ttl": 2}, {"a": "209.148.205.26", "ttl": 2}], "rc": 0}], "bytes_out": 41, "byte_dist_std": 67.636173, "da": "131.202.244.3", "byte_dist_mean": 65.053061, "idp_len_out": 16, "total_entropy": 2390.535555, "byte_dist": [122, 37, 10, 4, 12, 3, 11, 0, 5, 20, 4, 0, 2, 1, 1, 1, 0, 3, 0, 0, 2, 0, 0, 1, 0, 2, 1, 0, 0, 0, 0, 0, 2, 0, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 1, 3, 1, 1, 10, 4, 2, 1, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 19, 3, 3, 13, 8, 3, 1, 3, 8, 0, 12, 0, 4, 11, 0, 8, 0, 0, 13, 10, 1, 0, 9, 0, 0, 0, 0, 0, 0, 0, 0, 3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 27, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 0, 1, 0, 2, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 11, 0, 0, 0, 1, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0], "dp": 53, "idp_len_in": 16, "sp": 62059, "packets": [{"b": 41, "ipt": 0, "dir": ">"}, {"b": 449, "ipt": 0, "dir": "<"}], "idp_out": "45000045203640003f112f8283caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53645, 53653, 53654], "ttl": 63}, "out": {"id": [8245, 8252, 8253], "ttl": 63}}, "idp_in": "450001ddd18d00003f11bc9283caf403", "time_end": 1429118132.248694, "expire_type": "i", "entropy": 2.84922, "num_pkts_out": 3, "pr": 17, "time_start": 1429118127.116782, "bytes_in": 1371, "num_pkts_in": 3, "dns": [{"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 176}, {"cname": "a1168.dsw4.akamai.net", "ttl": 63}, {"a": "209.148.205.26", "ttl": 2}, {"a": "209.148.205.35", "ttl": 2}], "rc": 0}, {"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 171}, {"cname": "a1168.dsw4.akamai.net", "ttl": 58}, {"a": "209.148.205.26", "ttl": 20}, {"a": "209.148.205.35", "ttl": 20}], "rc": 0}, {"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 171}, {"cname": "a1168.dsw4.akamai.net", "ttl": 58}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 20}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 20}], "rc": 0}], "bytes_out": 123, "byte_dist_std": 67.65535, "da": "131.202.244.3", "byte_dist_mean": 65.080991, "idp_len_out": 16, "total_entropy": 4256.734736, "byte_dist": [189, 53, 13, 6, 17, 4, 16, 1, 7, 30, 6, 0, 3, 1, 1, 1, 1, 5, 0, 0, 6, 0, 0, 1, 0, 3, 1, 0, 2, 0, 0, 0, 3, 0, 0, 2, 1, 0, 1, 0, 0, 0, 0, 0, 0, 4, 0, 0, 1, 4, 2, 1, 15, 3, 3, 1, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 28, 4, 4, 19, 12, 4, 1, 4, 12, 0, 18, 0, 6, 16, 0, 12, 0, 0, 19, 15, 1, 0, 13, 0, 0, 0, 2, 0, 0, 0, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 41, 5, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 1, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 1, 0, 0, 5, 0, 0, 0, 1, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0], "dp": 53, "idp_len_in": 16, "sp": 62060, "packets": [{"b": 41, "ipt": 0, "dir": ">"}, {"b": 449, "ipt": 0, "dir": "<"}, {"b": 41, "ipt": 5004, "dir": ">"}, {"b": 449, "ipt": 63, "dir": "<"}, {"b": 41, "ipt": 0, "dir": ">"}, {"b": 473, "ipt": 61, "dir": "<"}], "idp_out": "45000045203540003f112f8383caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [0, 34375, 34376, 34377, 34378, 34379], "ttl": 52}, "out": {"id": [30227, 30228, 30229, 30230, 30231, 30232, 30233], "ttl": 128}}, "idp_in": "450000ce864840003406ad07d194cd23", "time_end": 1429118127.378465, "tcp": {"out": {"opt_len": 12, "flags": "S", "opts": [{"mss": 1460}, {"noop": null}, {"ws": 2}, {"noop": null}, {"noop": null}, {"sackp": null}], "first_window_size": 8192}, "in": {"opt_len": 12, "flags": "SA", "opts": [{"mss": 1350}, {"noop": null}, {"noop": null}, {"sackp": null}, {"noop": null}, {"ws": 5}], "first_window_size": 14600}, "first_seq": 4075090025}, "expire_type": "i", "entropy": 6.667589, "num_pkts_out": 7, "pr": 6, "time_start": 1429118127.120245, "bytes_in": 219, "num_pkts_in": 6, "linked_dns": {"server_addr": "131.202.244.3", "dns": [{"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 176}, {"cname": "a1168.dsw4.akamai.net", "ttl": 63}, {"a": "209.148.205.26", "ttl": 2}, {"a": "209.148.205.35", "ttl": 2}], "rc": 0}, {"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 171}, {"cname": "a1168.dsw4.akamai.net", "ttl": 58}, {"a": "209.148.205.26", "ttl": 20}, {"a": "209.148.205.35", "ttl": 20}], "rc": 0}, {"rn": "fbstatic-a.akamaihd.net", "rr": [{"cname": "fbstatic-a.akamaihd.net.edgesuite.net", "ttl": 171}, {"cname": "a1168.dsw4.akamai.net", "ttl": 58}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 20}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 20}], "rc": 0}], "time": 1429118127.116782}, "bytes_out": 661, "probable_os": {"out": "Windows 7, Vista, and Server 8"}, "byte_dist_std": 64.525104, "da": "209.148.205.35", "byte_dist_mean": 86.281818, "idp_len_out": 16, "total_entropy": 5867.478065, "byte_dist": [181, 16, 11, 23, 6, 8, 4, 3, 6, 4, 6, 4, 3, 1, 0, 6, 4, 3, 3, 2, 5, 5, 7, 6, 2, 3, 3, 4, 2, 2, 0, 3, 3, 3, 2, 2, 4, 2, 3, 0, 3, 1, 4, 2, 3, 2, 8, 6, 6, 10, 2, 7, 2, 2, 2, 1, 3, 3, 2, 0, 1, 2, 3, 2, 1, 3, 1, 0, 5, 4, 1, 3, 3, 1, 1, 2, 1, 1, 4, 4, 2, 1, 1, 0, 3, 4, 3, 0, 3, 3, 4, 3, 1, 3, 1, 1, 6, 7, 2, 2, 5, 4, 2, 0, 5, 3, 0, 3, 2, 2, 3, 5, 7, 2, 2, 8, 11, 3, 3, 1, 3, 3, 2, 0, 2, 3, 4, 1, 2, 0, 2, 2, 2, 5, 2, 3, 5, 2, 0, 1, 1, 1, 2, 1, 0, 2, 3, 1, 1, 4, 2, 3, 1, 0, 2, 2, 4, 2, 1, 1, 2, 5, 0, 1, 2, 0, 2, 0, 1, 0, 5, 4, 1, 4, 4, 2, 2, 4, 1, 3, 0, 3, 4, 1, 1, 3, 2, 0, 1, 0, 2, 2, 13, 1, 1, 1, 4, 2, 4, 5, 2, 3, 3, 1, 1, 3, 2, 1, 2, 6, 1, 8, 2, 6, 2, 0, 7, 3, 2, 4, 1, 2, 2, 1, 2, 1, 2, 6, 2, 2, 3, 3, 3, 1, 0, 1, 2, 2, 1, 1, 2, 0, 3, 3, 0, 3, 1, 0, 3, 1, 2, 0, 1, 0, 0, 5], "dp": 443, "idp_len_in": 16, "tls": {"c_version": 5, "c_random": "0251ff4b558bece7bab90ad49ad0c0e7d134b1e2d5339e052acb40935eca7419", "srlt": [{"hs_types": [1], "b": 512, "hs_lens": [508], "tp": 22, "ipt": 0, "dir": ">"}, {"hs_types": [2], "b": 114, "hs_lens": [110], "tp": 22, "ipt": 23, "dir": "<"}, {"b": 1, "tp": 20, "ipt": 0, "dir": "<"}, {"b": 36, "tp": 22, "ipt": 0, "dir": "<"}, {"b": 1, "tp": 20, "ipt": 56, "dir": ">"}, {"b": 72, "tp": 22, "ipt": 0, "dir": ">"}, {"b": 56, "tp": 23, "ipt": 60, "dir": ">"}, {"b": 48, "tp": 23, "ipt": 21, "dir": "<"}], "c_extensions": [{"server_name": "001a00001766627374617469632d612e616b616d616968642e6e6574"}, {"renegotiation_info": "00"}, {"supported_groups": "0006001700180019"}, {"ec_point_formats": "0100"}, {"session_ticket": "8d76e7c9ae66452a3f7646f02473bee35d9c791d2e54482d356bd3d159b132a037adbf2a4b04d2c55dc77f58dad8aa95652868658031163de8e6200fc4c41b5abf5460708307c626c747cfe84173d347c098cc39d0627c15951a042311223e97c83e2531b3ab15e3d1c7a8547e78cd5828527e006197970a950828d445319ce486decd55e441aaa6c994dbbe16718844da0b6068506fd515b87c64d97e025fca29b75ad82c5aac88a170566fab82aebc"}, {"kind": 13172, "data": ""}, {"status_request": "0100000000"}, {"signature_algorithms": "001004010501020104030503020304020202"}, {"padding": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}], "c_sid": "e3a1c6921fb6d8c7d36f0f7309faffd344214f0cd55675f3ad5b4eed8830aa60", "s_version": 5, "s_random": "552e9cae122170df39e659b55bc69bd9b1a687f2914ddb7d7d9dc8dd919fb9ab", "cs": ["c02b", "c02f", "c00a", "c009", "c013", "c014", "c012", "c007", "c011", "0033", "0032", "0045", "0039", "0038", "0088", "0016", "002f", "0041", "0035", "0084", "000a", "0005", "0004"], "sni": ["fbstatic-a.akamaihd.net"], "s_extensions": [{"kind": 13172, "data": "08737064792f332e3106737064792f3308687474702f312e3108687474702f312e30"}], "scs": "0005", "s_sid": "e3a1c6921fb6d8c7d36f0f7309faffd344214f0cd55675f3ad5b4eed8830aa60"}, "sp": 3248, "packets": [{"b": 517, "ipt": 45, "dir": ">"}, {"b": 166, "ipt": 23, "dir": "<"}, {"b": 83, "ipt": 56, "dir": ">"}, {"b": 61, "ipt": 60, "dir": ">"}, {"b": 53, "ipt": 21, "dir": "<"}], "idp_out": "4500022d7615400080066fdb83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53649, 53650], "ttl": 63}, "out": {"id": [8248, 8249], "ttl": 63}}, "idp_in": "450000b5d19100003f11bdb683caf403", "time_end": 1429118128.526331, "expire_type": "i", "entropy": 4.630252, "num_pkts_out": 2, "pr": 17, "time_start": 1429118128.451097, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2115}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 58}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2115}, {"a": "173.252.100.27", "ttl": 60}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 57.674005, "da": "131.202.244.3", "byte_dist_mean": 55.674033, "idp_len_out": 16, "total_entropy": 1676.151355, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 2, 0, 0, 2, 0, 2, 2, 0, 14, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62061, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}, {"b": 141, "ipt": 74, "dir": "<"}], "idp_out": "4500003e203840003f112f8783caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53651, 53652], "ttl": 63}, "out": {"id": [8250, 8251], "ttl": 63}}, "idp_in": "450000a9d19300003f11bdc083caf403", "time_end": 1429118130.180214, "expire_type": "i", "entropy": 4.645525, "num_pkts_out": 2, "pr": 17, "time_start": 1429118130.179108, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2114}, {"a": "173.252.100.27", "ttl": 59}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2114}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 57}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 57.327674, "da": "131.202.244.3", "byte_dist_mean": 55.872928, "idp_len_out": 16, "total_entropy": 1681.680042, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 8, 6, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 4, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 6, 4, 0, 0, 3, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62066, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e203a40003f112f8583caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429118139.331527, "bytes_out": 27, "sp": 443, "packets": [{"b": 27, "ipt": 0, "dir": ">"}], "time_end": 1429118140.999594, "byte_dist_std": 81.648995, "da": "131.202.240.87", "total_entropy": 120.381944, "ip": {"in": {"id": [20167, 20168], "ttl": 128}, "out": {"id": [58651, 58652, 12405], "ttl": 43}}, "idp_out": "45000043e51b40002b060647cc5d23d3", "num_pkts_in": 2, "num_pkts_out": 3, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 4.458591, "sa": "204.93.35.211", "byte_dist": [1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0], "dp": 3189, "byte_dist_mean": 114.592593}
{"ip": {"in": {"id": [53655, 53656], "ttl": 63}, "out": {"id": [8254, 8255], "ttl": 63}}, "idp_in": "450000a9d19700003f11bdbc83caf403", "time_end": 1429118142.218212, "expire_type": "i", "entropy": 4.599348, "num_pkts_out": 2, "pr": 17, "time_start": 1429118142.216752, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2102}, {"a": "173.252.100.27", "ttl": 47}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2102}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 45}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 56.993788, "da": "131.202.244.3", "byte_dist_mean": 54.690608, "idp_len_out": 16, "total_entropy": 1664.964001, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 8, 0, 1, 0, 1, 0, 0, 1, 4, 1, 2, 4, 0, 6, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62067, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e203e40003f112f8183caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429118157.465319, "bytes_out": 0, "sp": 34680, "packets": [], "time_end": 1429118157.465319, "tcp": {"out": {"flags": "S", "first_window_size": 65284}, "first_seq": 946466310}, "da": "131.202.240.87", "expire_type": "i", "num_pkts_out": 1, "ip": {"out": {"id": [11865], "ttl": 108}}, "sa": "82.221.105.6", "byte_dist": [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 5357}
{"pr": 6, "time_start": 1429118165.335578, "bytes_out": 27, "sp": 443, "packets": [{"b": 27, "ipt": 0, "dir": ">"}], "time_end": 1429118171.001065, "byte_dist_std": 70.151566, "da": "131.202.240.87", "total_entropy": 120.381931, "ip": {"in": {"id": [20169, 20170], "ttl": 128}, "out": {"id": [54874, 54875, 40000], "ttl": 43}}, "idp_out": "45000043d65a40002b061508cc5d23d3", "num_pkts_in": 2, "num_pkts_out": 3, "idp_len_out": 16, "bytes_in": 0, "expire_type": "i", "entropy": 4.45859, "sa": "204.93.35.211", "byte_dist": [1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], "dp": 3187, "byte_dist_mean": 92.62963}
{"ip": {"in": {"id": [53657, 53658], "ttl": 63}, "out": {"id": [8256, 8257], "ttl": 63}}, "idp_in": "450000a9d19900003f11bdba83caf403", "time_end": 1429118168.41119, "expire_type": "i", "entropy": 4.630305, "num_pkts_out": 2, "pr": 17, "time_start": 1429118168.409473, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2075}, {"a": "173.252.100.27", "ttl": 20}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2075}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 18}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.93678, "da": "131.202.244.3", "byte_dist_mean": 56.104972, "idp_len_out": 16, "total_entropy": 1676.170342, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 12, 5, 0, 0, 0, 4, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 3, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 2, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62078, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e204040003f112f7f83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53659, 53660], "ttl": 63}, "out": {"id": [8258, 8259], "ttl": 63}}, "idp_in": "450000a9d19b00003f11bdb883caf403", "time_end": 1429118168.454663, "expire_type": "i", "entropy": 4.630304, "num_pkts_out": 2, "pr": 17, "time_start": 1429118168.452966, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2075}, {"a": "173.252.100.27", "ttl": 20}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2075}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 18}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.35593, "da": "131.202.244.3", "byte_dist_mean": 54.856354, "idp_len_out": 16, "total_entropy": 1676.17017, "byte_dist": [93, 34, 20, 9, 11, 2, 0, 3, 6, 0, 0, 12, 5, 0, 0, 0, 4, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 3, 3, 0, 0, 0, 0, 1, 0, 0, 2, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62079, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e204240003f112f7d83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53661, 53662], "ttl": 63}, "out": {"id": [8260, 8261], "ttl": 63}}, "idp_in": "450000a9d19d00003f11bdb683caf403", "time_end": 1429118175.468521, "expire_type": "i", "entropy": 4.595796, "num_pkts_out": 2, "pr": 17, "time_start": 1429118175.466253, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2068}, {"a": "173.252.100.27", "ttl": 13}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2068}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 11}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.783131, "da": "131.202.244.3", "byte_dist_mean": 55.243094, "idp_len_out": 16, "total_entropy": 1663.678191, "byte_dist": [93, 34, 20, 9, 19, 2, 0, 3, 6, 0, 0, 5, 5, 1, 0, 0, 4, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 4], "dp": 53, "idp_len_in": 16, "sp": 62080, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 1, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e204440003f112f7b83caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53663, 53664], "ttl": 63}, "out": {"id": [8262, 8263], "ttl": 63}}, "idp_in": "450000a9d19f00003f11bdb483caf403", "time_end": 1429118176.87694, "expire_type": "i", "entropy": 4.57814, "num_pkts_out": 2, "pr": 17, "time_start": 1429118176.875591, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2067}, {"a": "173.252.100.27", "ttl": 12}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2067}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 10}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.025854, "da": "131.202.244.3", "byte_dist_mean": 54.20442, "idp_len_out": 16, "total_entropy": 1657.286774, "byte_dist": [93, 34, 20, 17, 11, 2, 0, 3, 6, 0, 1, 4, 6, 0, 0, 0, 4, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 4, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 2, 0, 0, 0, 0, 0, 0, 0, 8, 7, 12, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62081, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e204640003f112f7983caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53665, 53666], "ttl": 63}, "out": {"id": [8264, 8265], "ttl": 63}}, "idp_in": "450000a9d1a100003f11bdb283caf403", "time_end": 1429118178.45007, "expire_type": "i", "entropy": 4.575413, "num_pkts_out": 2, "pr": 17, "time_start": 1429118178.449416, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2065}, {"a": "173.252.100.27", "ttl": 10}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2065}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 8}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 58.469655, "da": "131.202.244.3", "byte_dist_mean": 54.80663, "idp_len_out": 16, "total_entropy": 1656.299416, "byte_dist": [93, 42, 20, 9, 11, 2, 0, 3, 7, 0, 1, 4, 5, 0, 0, 0, 4, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 2, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62082, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 0, "dir": "<"}, {"b": 153, "ipt": 0, "dir": "<"}], "idp_out": "4500003e204840003f112f7783caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53667, 53668], "ttl": 63}, "out": {"id": [8266, 8267], "ttl": 63}}, "idp_in": "450000a9d1a300003f11bdb083caf403", "time_end": 1429118191.836666, "entropy": 4.632977, "num_pkts_out": 2, "pr": 17, "time_start": 1429118191.683723, "bytes_in": 294, "num_pkts_in": 2, "dns": [{"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2052}, {"a": "173.252.100.27", "ttl": 60}], "rc": 0}, {"rn": "www.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2052}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 60}], "rc": 0}], "bytes_out": 68, "byte_dist_std": 62.53308, "da": "131.202.244.3", "byte_dist_mean": 59.712707, "idp_len_out": 16, "total_entropy": 1677.137677, "byte_dist": [93, 34, 20, 9, 13, 2, 0, 3, 6, 0, 0, 4, 5, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 2, 0, 2, 2, 0, 6, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 8, 7, 10, 2, 4, 4, 0, 0, 1, 0, 4, 0, 4, 2, 12, 0, 0, 4, 4, 2, 1, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 3, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62093, "packets": [{"b": 34, "ipt": 0, "dir": ">"}, {"b": 141, "ipt": 75, "dir": "<"}, {"b": 34, "ipt": 2, "dir": ">"}, {"b": 153, "ipt": 75, "dir": "<"}], "idp_out": "4500003e204a40003f112f7583caf057", "sa": "131.202.240.87"}
{"ip": {"in": {"id": [53669, 53670], "ttl": 63}, "out": {"id": [8268, 8269], "ttl": 63}}, "idp_in": "450000b1d1a500003f11bda683caf403", "time_end": 1429118191.941126, "entropy": 4.853232, "num_pkts_out": 2, "pr": 17, "time_start": 1429118191.939069, "bytes_in": 310, "num_pkts_in": 2, "dns": [{"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2111}, {"a": "173.252.100.27", "ttl": 60}], "rc": 0}, {"rn": "2-edge-chat.facebook.com", "rr": [{"cname": "star.c10r.facebook.com", "ttl": 2111}, {"type": "1c", "class": "1", "rdlength": 4096, "ttl": 60}], "rc": 0}], "bytes_out": 84, "byte_dist_std": 58.977228, "da": "131.202.244.3", "byte_dist_mean": 60.598985, "idp_len_out": 16, "total_entropy": 1912.173371, "byte_dist": [93, 34, 20, 5, 11, 2, 0, 3, 6, 0, 0, 8, 5, 0, 0, 0, 2, 0, 0, 0, 0, 2, 0, 0, 2, 0, 0, 1, 3, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 3, 0, 1, 0, 0, 8, 0, 0, 2, 2, 4, 0, 0, 0, 2, 0, 0, 0, 0, 6, 2, 0, 0, 2, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 12, 6, 14, 5, 12, 4, 4, 4, 0, 1, 4, 1, 4, 2, 12, 0, 1, 4, 4, 6, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 3, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 2], "dp": 53, "idp_len_in": 16, "sp": 62094, "packets": [{"b": 42, "ipt": 0, "dir": ">"}, {"b": 149, "ipt": 0, "dir": "<"}, {"b": 42, "ipt": 1, "dir": ">"}, {"b": 161, "ipt": 0, "dir": "<"}], "idp_out": "45000046204c40003f112f6b83caf057", "sa": "131.202.240.87"}
{"pr": 6, "time_start": 1429118197.289273, "bytes_out": 55, "sp": 443, "packets": [{"b": 55, "ipt": 0, "dir": ">"}], "time_end": 1429118197.315516, "byte_dist_std": 73.375915, "da": "131.202.240.87", "total_entropy": 309.974999, "ip": {"in": {"id": [30398, 30399], "ttl": 128}, "out": {"id": [7123, 7124, 7132], "ttl": 55}}, "idp_out": "4500005f1bd300003706c6804a7de2a6", "num_pkts_in": 2, "num_pkts_out": 3, "idp_len_out": 16, "bytes_in": 0, "entropy": 5.635909, "sa": "74.125.226.166", "byte_dist": [1, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0], "dp": 3243, "byte_dist_mean": 125.709091}