StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:06.905653 3.014735 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 01:00:07.157904 3.033285 arp 10.0.2.110 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:07.176683 1.992673 arp 0.0.0.0 who 10.0.2.110 INT 3 126 flow=Background-ARP 1970/01/01 01:00:07.176798 0.000000 ipv6-icmp :: 135 -> ff02::1:ffdf:b0f1 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:07.176836 3.995392 ipv6-icmp fe80::31aa:edaf:e8df:b0f1 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:07.176897 0.499775 ipv6-icmp fe80::31aa:edaf:e8df:b0f1 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:11.436932 0.000000 udp 10.0.2.110 60212 -> 8.8.8.8 53 INT 0 1 76 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:00:11.454357 0.000129 arp 10.0.2.2 who 10.0.2.110 CON 2 84 flow=Background-ARP 1970/01/01 01:00:12.433450 0.016390 udp 10.0.2.110 60212 <-> 8.8.4.4 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 01:00:12.450323 0.030759 udp 10.0.2.110 56943 <-> 8.8.4.4 53 CON 0 0 4 360 flow=From-Botnet-V1-DNS 1970/01/01 01:00:12.481082 0.000000 icmp 10.0.2.110 0x0303 -> 8.8.4.4 0x6fde URP 0 1 132 flow=Background 1970/01/01 01:00:13.925739 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:00:15.167421 0.000000 ipv6-icmp fe80::31aa:edaf:e8df:b0f1 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:21.927369 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:00:38.350971 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:01:10.386914 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:16.085373 3.002171 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:07:23.092886 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:31.094544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:47.097440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:07:48.856025 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:07:48.856175 0.019850 udp 10.0.2.110 56645 <-> 8.8.8.8 53 CON 0 0 2 380 flow=From-Botnet-V1-DNS 1970/01/01 01:07:48.964091 0.070480 tcp 10.0.2.110 49158 -> 195.113.214.215 80 FSPA* 0 0 10 1026 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:49.041092 0.067526 udp 10.0.2.110 62269 <-> 8.8.8.8 53 CON 0 0 2 204 flow=From-Botnet-V1-DNS 1970/01/01 01:07:49.109139 0.108774 tcp 10.0.2.110 49159 -> 37.19.5.49 80 FSPA* 0 0 10 1599 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:50.111502 0.100744 udp fe80::31aa:edaf:e8df:b0f1 61912 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:07:50.111682 0.100780 udp 10.0.2.110 57771 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:50.111722 0.100740 icmp 10.0.2.2 0x000b -> 10.0.2.110 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:07:50.412390 1.502258 udp 10.0.2.110 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:07:50.412524 1.502124 icmp 10.0.2.2 0x0003 -> 10.0.2.110 0x0a00 URN 192 3 360 flow=Background 1970/01/01 01:07:52.810084 0.168611 udp 10.0.2.110 50685 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V1-DNS 1970/01/01 01:07:52.979228 0.426830 tcp 10.0.2.110 49160 -> 216.8.179.23 80 SRPA* 0 0 9 3377 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:07.026888 0.068727 udp 10.0.2.110 60520 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:07.096089 0.106274 tcp 10.0.2.110 49161 -> 37.19.5.66 80 FSPA* 0 0 10 970 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:07.281938 0.018332 udp 10.0.2.110 52646 <-> 8.8.8.8 53 CON 0 0 2 204 flow=From-Botnet-V1-DNS 1970/01/01 01:08:07.300747 0.115613 tcp 10.0.2.110 49162 -> 37.19.5.49 80 FSPA* 0 0 11 2294 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:07.456801 0.017065 udp 10.0.2.110 64565 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:07.464188 0.375661 tcp 10.0.2.110 49163 -> 216.8.179.23 80 SRPA* 0 0 9 3414 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:07.474330 0.563631 tcp 10.0.2.110 49164 -> 37.19.5.66 80 SRPA* 0 0 88 78679 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:07.869675 0.016841 udp 10.0.2.110 55447 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V1-DNS 1970/01/01 01:08:07.886919 1.433674 tcp 10.0.2.110 49165 -> 216.8.179.23 80 SPA_* 0 0 20 13408 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:08.146503 0.019289 udp 10.0.2.110 54540 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:08.166152 2.061124 tcp 10.0.2.110 49166 -> 37.19.5.66 80 FSPA* 0 0 1035 1104951 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:10.232762 0.018449 udp 10.0.2.110 50870 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:10.251640 1.948584 tcp 10.0.2.110 49167 -> 37.19.5.66 80 FSPA* 0 0 1033 1104855 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:12.205822 0.019617 udp 10.0.2.110 57564 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:12.225843 1.751029 tcp 10.0.2.110 49168 -> 37.19.5.66 80 FSPA* 0 0 995 1102803 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:13.987241 0.022481 udp 10.0.2.110 63948 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:14.010170 1.822309 tcp 10.0.2.110 49169 -> 37.19.5.66 80 FSPA* 0 0 1007 1103451 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:15.897876 0.017411 udp 10.0.2.110 61954 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:15.915674 1.834953 tcp 10.0.2.110 49170 -> 37.19.5.66 80 FSPA* 0 0 1010 1103613 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:17.758320 0.019032 udp 10.0.2.110 58618 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:17.777759 1.489762 tcp 10.0.2.110 49171 -> 37.19.5.66 80 FSPA* 0 0 984 1102209 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:19.103356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:08:19.275366 0.017696 udp 10.0.2.110 62211 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:19.293582 1.755384 tcp 10.0.2.110 49172 -> 37.19.5.66 80 FSPA* 0 0 983 1102155 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:21.058077 0.019118 udp 10.0.2.110 60622 <-> 8.8.8.8 53 CON 0 0 2 232 flow=From-Botnet-V1-DNS 1970/01/01 01:08:21.077610 1.028648 tcp 10.0.2.110 49173 -> 37.19.5.66 80 FSPA* 0 0 532 588072 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:32.556512 0.017765 udp 10.0.2.110 50393 <-> 8.8.8.8 53 CON 0 0 2 172 flow=From-Botnet-V1-DNS 1970/01/01 01:08:32.574892 1.395631 tcp 10.0.2.110 49174 -> 216.8.179.23 80 SPA_* 0 0 11 4588 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.708509 0.000000 tcp 10.0.2.110 49174 -> 216.8.179.23 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.714183 3.140725 tcp 10.0.2.110 49175 -> 216.8.179.23 80 FSPA* 0 0 10 2415 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.714687 3.140466 tcp 10.0.2.110 49176 -> 216.8.179.23 80 FSPA* 0 0 12 2756 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.768624 3.086861 tcp 10.0.2.110 49177 -> 216.8.179.23 80 FSPA* 0 0 41 32634 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.768967 3.086393 tcp 10.0.2.110 49178 -> 216.8.179.23 80 FSPA* 0 0 12 3464 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.837279 0.020164 udp 10.0.2.110 64897 <-> 8.8.8.8 53 CON 0 0 2 388 flow=From-Botnet-V1-DNS 1970/01/01 01:08:37.837752 0.017865 udp 10.0.2.110 56626 <-> 8.8.8.8 53 CON 0 0 2 263 flow=From-Botnet-V1-DNS 1970/01/01 01:08:37.856267 2.498829 tcp 10.0.2.110 49179 -> 66.171.231.95 80 SPA_* 0 0 19 10949 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:37.857778 1.996789 tcp 10.0.2.110 49180 -> 195.113.214.211 80 SPA_* 0 0 8 2271 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:40.855723 3.510153 tcp 10.0.2.110 49181 -> 216.8.179.23 80 SRPA* 0 0 46 37040 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:41.674649 2.690967 tcp 10.0.2.110 49182 -> 216.8.179.23 80 SRPA* 0 0 31 23253 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:44.321005 0.086293 tcp 10.0.2.110 49180 -> 195.113.214.211 80 PA_PA 0 0 49 46519 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:45.865241 0.017802 udp 10.0.2.110 50942 <-> 8.8.8.8 53 CON 0 0 2 166 flow=From-Botnet-V1-DNS 1970/01/01 01:08:45.883442 2.073380 tcp 10.0.2.110 49183 -> 173.194.35.79 80 SPA_* 0 0 8 1602 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.215802 0.019968 udp 10.0.2.110 60924 <-> 8.8.8.8 53 CON 0 0 2 231 flow=From-Botnet-V1-DNS 1970/01/01 01:08:46.236246 1.720481 tcp 10.0.2.110 49184 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.236508 1.720191 tcp 10.0.2.110 49185 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.236742 1.719920 tcp 10.0.2.110 49186 -> 173.194.44.250 80 SPA_* 0 0 8 3193 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.236965 0.365272 tcp 10.0.2.110 49187 -> 173.194.44.250 80 SPA_* 0 0 11 5948 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.731097 0.016633 udp 10.0.2.110 51342 <-> 8.8.8.8 53 CON 0 0 2 198 flow=From-Botnet-V1-DNS 1970/01/01 01:08:46.771299 2.874346 tcp 10.0.2.110 49188 -> 144.76.1.130 80 SRPA* 0 0 11 2325 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:46.911464 0.029339 udp 10.0.2.110 54510 <-> 8.8.8.8 53 CON 0 0 2 266 flow=From-Botnet-V1-DNS 1970/01/01 01:08:46.952763 1.504842 tcp 10.0.2.110 49189 -> 173.194.44.250 80 SPA_* 0 0 8 2727 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:50.364549 1.537328 tcp 10.0.2.110 49180 -> 195.113.214.211 80 PA_PA 0 0 5 1611 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:50.827150 2.573916 tcp 10.0.2.110 49190 -> 144.76.1.130 80 SPA_* 0 0 13 2429 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:53.925952 0.016704 udp 10.0.2.110 63529 <-> 8.8.8.8 53 CON 0 0 2 182 flow=From-Botnet-V1-DNS 1970/01/01 01:08:53.974426 0.139482 tcp 10.0.2.110 49191 -> 37.19.5.19 80 FSPA* 0 0 10 824 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:54.191692 0.000000 tcp 10.0.2.110 49165 -> 216.8.179.23 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:56.482825 0.000000 tcp 10.0.2.110 49190 -> 144.76.1.130 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:57.123352 0.020265 udp 10.0.2.110 58847 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 01:08:57.144462 0.131493 tcp 10.0.2.110 49192 -> 37.19.5.19 80 FSPA* 0 0 10 918 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:57.299386 0.016981 udp 10.0.2.110 59434 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 01:08:57.316909 0.117736 tcp 10.0.2.110 49193 -> 37.19.5.78 80 FSPA* 0 0 10 1134 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:57.986697 0.017774 udp 10.0.2.110 63615 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/01 01:08:58.005112 0.114907 tcp 10.0.2.110 49194 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.381574 0.017683 udp 10.0.2.110 59567 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V1-DNS 1970/01/01 01:08:58.399633 0.118165 tcp 10.0.2.110 49195 -> 37.19.5.78 80 FSPA* 0 0 14 7474 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.521352 0.115581 tcp 10.0.2.110 49196 -> 37.19.5.78 80 FSPA* 0 0 12 4511 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.644636 0.177656 tcp 10.0.2.110 49197 -> 37.19.5.78 80 FSPA* 0 0 31 20930 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.822965 0.177314 tcp 10.0.2.110 49198 -> 37.19.5.78 80 FSPA* 0 0 33 25733 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.886114 0.017606 udp 10.0.2.110 62623 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/01 01:08:58.892212 0.017166 udp 10.0.2.110 49347 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/01 01:08:58.895528 0.118888 tcp 10.0.2.110 49199 -> 37.19.5.78 80 FSPA* 0 0 10 1135 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.904245 0.115393 tcp 10.0.2.110 49200 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:58.909641 0.636463 tcp 10.0.2.110 49201 -> 37.19.5.22 80 SPA_* 0 0 107 88852 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.001485 0.172938 tcp 10.0.2.110 49202 -> 37.19.5.78 80 FSPA* 0 0 26 16779 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.175045 0.148489 tcp 10.0.2.110 49203 -> 37.19.5.78 80 FSPA* 0 0 18 12272 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.265672 0.118875 tcp 10.0.2.110 49204 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.297606 0.115560 tcp 10.0.2.110 49205 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.324346 0.111175 tcp 10.0.2.110 49206 -> 37.19.5.78 80 FSPA* 0 0 17 10253 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.436168 0.116022 tcp 10.0.2.110 49207 -> 37.19.5.78 80 FSPA* 0 0 18 11857 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.552645 0.116263 tcp 10.0.2.110 49208 -> 37.19.5.78 80 FSPA* 0 0 12 4175 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.669443 0.160217 tcp 10.0.2.110 49209 -> 37.19.5.78 80 FSPA* 0 0 29 19920 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.830218 0.175683 tcp 10.0.2.110 49210 -> 37.19.5.78 80 FSPA* 0 0 26 17101 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.913355 0.017445 udp 10.0.2.110 54251 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V1-DNS 1970/01/01 01:08:59.914600 0.017763 udp 10.0.2.110 60205 <-> 8.8.8.8 53 CON 0 0 2 164 flow=From-Botnet-V1-DNS 1970/01/01 01:08:59.931994 0.137546 tcp 10.0.2.110 49211 -> 37.19.5.78 80 FSPA* 0 0 10 1149 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:08:59.932701 0.120744 tcp 10.0.2.110 49212 -> 37.19.5.78 80 FSPA* 0 0 10 1302 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.006486 0.118977 tcp 10.0.2.110 49213 -> 37.19.5.78 80 FSPA* 0 0 20 12977 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.071263 0.017124 udp 10.0.2.110 51304 <-> 8.8.8.8 53 CON 0 0 2 194 flow=From-Botnet-V1-DNS 1970/01/01 01:09:00.088900 0.418900 tcp 10.0.2.110 49214 -> 38.102.136.141 80 FSPA* 0 0 10 1094 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.125951 0.172877 tcp 10.0.2.110 49215 -> 37.19.5.78 80 FSPA* 0 0 26 17348 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.299403 0.116446 tcp 10.0.2.110 49216 -> 37.19.5.78 80 FSPA* 0 0 17 9875 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.429341 0.115638 tcp 10.0.2.110 49217 -> 37.19.5.78 80 FSPA* 0 0 11 3098 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.521925 0.016647 udp 10.0.2.110 50231 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 01:09:00.522837 0.017971 udp 10.0.2.110 55620 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 01:09:00.539138 0.107138 tcp 10.0.2.110 49218 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.541172 0.204464 tcp 10.0.2.110 49219 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:00.545893 0.115477 tcp 10.0.2.110 49220 -> 37.19.5.78 80 FSPA* 0 0 11 3367 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:29.546493 0.000202 tcp 10.0.2.110 49201 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:34.407442 0.000107 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:09:41.557725 0.000000 tcp 10.0.2.110 49179 -> 66.171.231.95 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:45.922213 0.643623 tcp 10.0.2.110 49183 -> 173.194.35.79 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:46.243308 0.322269 tcp 10.0.2.110 49185 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:46.244597 0.320837 tcp 10.0.2.110 49184 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:46.253463 0.312223 tcp 10.0.2.110 49186 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:46.610173 4.962383 tcp 10.0.2.110 49187 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:46.956621 4.615733 tcp 10.0.2.110 49189 -> 173.194.44.250 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:09:50.418343 1.154348 tcp 10.0.2.110 49180 -> 195.113.214.211 80 RA_FA 0 0 3 162 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:13:57.998896 0.000099 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:13:57.999110 0.126389 tcp 10.0.2.110 49221 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:14:23.250353 2.996593 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 01:14:30.253199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:14:38.254312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:14:54.257401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:15:26.263687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:21:30.270023 3.000918 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:21:37.277403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:21:45.278248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:22:01.281801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:22:33.287642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:28:37.404392 3.030659 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:28:44.440897 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:28:52.442723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:29:08.445291 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:29:40.486774 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:35:44.552605 2.997311 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:35:51.555328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:35:59.558973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:36:15.559990 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:36:47.565651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:38:59.324036 0.000066 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:38:59.324173 0.118218 tcp 10.0.2.110 49222 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:38:59.442576 0.000082 tcp 10.0.2.110 49201 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 01:38:59.560839 0.114971 tcp 10.0.2.110 49223 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:42:51.571726 3.001680 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:42:58.579348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:06.580696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:22.583494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:43:54.589835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:49:58.595320 3.002218 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:50:05.602832 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:50:13.604454 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:50:29.607851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:51:01.613851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:05.619694 3.001413 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 01:57:12.626917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:20.628892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:57:36.631721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 01:58:08.637673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:04:12.644592 3.000475 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:04:19.650721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:04:27.652872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:04:43.655772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:05:15.661690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:08:59.085154 0.000044 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:08:59.085247 0.114549 tcp 10.0.2.110 49224 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:08:59.222899 0.106209 tcp 10.0.2.110 49225 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:11:19.667799 3.001602 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:11:26.675191 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:11:34.676313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:11:50.679659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:12:22.685752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:26.691327 3.002261 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:18:33.698702 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:41.700655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:18:57.703634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:19:29.709307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:25:33.715648 3.002159 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:25:40.722812 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:25:48.724446 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:26:04.727406 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:26:36.733204 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:32:40.740255 3.021230 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:32:47.767252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:32:55.768677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:33:11.771417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:33:43.777243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:38:59.092630 0.000075 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:38:59.092807 0.114883 tcp 10.0.2.110 49226 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:38:59.230106 0.114455 tcp 10.0.2.110 49227 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 02:39:47.784785 3.000111 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:39:54.791116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:02.792186 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:18.795246 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:40:50.801337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:46:54.958026 3.001384 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:47:01.965389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:09.966784 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:25.979725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:47:57.986137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:01.991730 3.001547 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 02:54:08.999015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:17.001099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:54:33.003940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 02:55:05.009632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:09.015762 3.001361 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:01:16.023200 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:24.024802 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:01:40.028110 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:02:12.033783 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:16.039440 3.001651 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:08:23.047042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:31.048187 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:47.051261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:08:59.264087 0.000061 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:08:59.264222 0.105905 tcp 10.0.2.110 49228 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:08:59.397177 0.105770 tcp 10.0.2.110 49229 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:09:01.061132 0.016667 udp 10.0.2.110 64120 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 03:09:01.098820 0.144248 tcp 10.0.2.110 49230 -> 37.19.5.65 80 FSPA* 0 0 13 5579 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:09:19.057263 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:23.063444 3.002065 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:15:30.070978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:38.072711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:15:54.075568 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:16:26.081627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:22:30.087624 3.001730 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:22:37.094615 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:22:45.096834 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:23:01.100560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:23:33.105910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:29:37.110831 3.002317 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:29:44.119139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:29:52.120085 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:30:08.123811 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:30:40.129582 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:36:44.135629 3.001648 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:36:51.142951 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:36:59.144295 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:37:15.147243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:37:47.153419 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:38:59.259484 0.000093 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:38:59.259665 0.117261 tcp 10.0.2.110 49231 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:38:59.403951 0.106049 tcp 10.0.2.110 49232 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 03:43:51.158758 3.002032 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:43:58.166656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:06.168671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:22.171677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:44:54.177517 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:50:58.183694 3.001789 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:51:05.190468 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:51:13.192273 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:51:29.195393 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:52:01.201443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:05.207528 3.001170 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 03:58:12.214986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:20.216176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:58:36.219127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 03:59:08.225048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:05:12.231177 3.001548 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:05:19.238397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:05:27.240392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:05:43.243589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:06:15.249583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:08:59.267005 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:08:59.267160 0.117405 tcp 10.0.2.110 49233 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:08:59.422154 0.114859 tcp 10.0.2.110 49234 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:12:19.256744 3.000645 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:12:26.262581 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:12:34.264422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:12:50.266975 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:13:22.273009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:26.279711 3.001112 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:19:33.286532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:41.288150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:19:57.291392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:20:29.296919 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:26:33.303123 3.001865 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:26:40.311015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:26:48.312071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:27:04.315304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:27:36.321225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:33:40.328222 3.000863 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:33:47.334441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:33:55.336154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:34:11.338841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:34:43.344996 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:38:59.275335 0.000047 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:38:59.275578 0.115517 tcp 10.0.2.110 49235 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:38:59.414431 0.105855 tcp 10.0.2.110 49236 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 04:40:47.351954 3.000628 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:40:54.358648 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:02.359799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:18.363313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:41:50.368784 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:47:54.377923 2.999151 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:48:01.382202 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:09.383970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:25.386740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:48:57.392985 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:55:01.399617 3.000935 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 04:55:08.406214 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:55:16.407681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:55:32.410916 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 04:56:04.416783 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:02:08.423547 3.001362 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:02:15.430362 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:02:23.432266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:02:39.435042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:03:11.441124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:08:59.282822 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:08:59.283001 0.118094 tcp 10.0.2.110 49237 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:08:59.425235 0.115505 tcp 10.0.2.110 49238 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:09:15.447071 3.001419 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:09:22.454816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:09:30.455708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:09:46.458953 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:10:18.465481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:22.471624 3.001170 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:16:29.478594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:37.479756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:16:53.482964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:17:25.488931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:23:29.494682 3.001682 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:23:36.502558 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:23:44.513719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:24:00.516671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:24:32.523115 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:30:36.528815 3.001451 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:30:43.536561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:30:51.538050 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:31:07.540588 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:31:39.546839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:37:43.552243 3.002431 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:37:50.560240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:37:58.561835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:38:14.565209 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:38:46.570662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:38:59.291301 0.000050 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:38:59.291390 0.114758 tcp 10.0.2.110 49239 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:38:59.429589 0.117545 tcp 10.0.2.110 49240 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 05:44:50.577929 3.001006 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:44:57.584749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:05.586183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:21.588476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:45:53.594563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:51:57.600674 3.001450 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:52:04.608525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:52:12.609453 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:52:28.612732 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:53:00.618710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:04.624826 3.001686 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 05:59:11.631966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:19.633720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 05:59:35.637248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:00:07.642557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:06:11.648136 3.002315 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:06:18.656502 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:06:26.657688 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:06:42.661005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:07:14.666922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:08:59.299059 0.000068 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:08:59.299206 0.115018 tcp 10.0.2.110 49241 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:08:59.440958 0.108049 tcp 10.0.2.110 49242 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:13:18.684049 3.000468 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:13:25.690138 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:13:33.691698 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:13:49.694566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:14:21.700966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:25.706814 3.001824 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:20:32.714179 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:40.715858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:20:56.718700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:21:28.724765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:27:32.730675 3.001595 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:27:39.737937 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:27:47.739984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:28:03.742972 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:28:35.748387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:34:39.765176 3.001047 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:34:46.772364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:34:54.773283 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:35:10.776728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:35:42.782646 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:38:59.306821 0.000076 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:38:59.306972 0.117466 tcp 10.0.2.110 49243 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:38:59.447518 0.116932 tcp 10.0.2.110 49244 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 06:41:46.788582 3.001647 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:41:53.795694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:01.797232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:17.800767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:42:49.806920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:48:53.812234 3.002243 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:49:00.819782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:08.821648 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:24.824618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:49:56.830347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:56:00.837015 3.001326 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 06:56:07.844033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:56:15.845121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:56:31.848571 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 06:57:03.854502 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:03:07.860699 3.001161 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:03:14.867705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:03:22.869518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:03:38.872442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:04:10.878640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:08:59.315198 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:08:59.315442 0.108220 tcp 10.0.2.110 49245 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:08:59.447454 0.106378 tcp 10.0.2.110 49246 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:09:01.431408 0.064887 udp 10.0.2.110 64279 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 07:09:01.510761 0.129222 tcp 10.0.2.110 49247 -> 37.19.5.65 80 FSPA* 0 0 13 5591 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:10:14.883707 3.002784 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:10:21.891847 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:10:29.893541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:10:45.896627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:11:17.902370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:21.908738 3.001375 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:17:28.915653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:36.917499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:17:52.920221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:18:24.926042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:28.932355 3.001961 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:24:35.939623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:43.941252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:24:59.944312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:25:31.950784 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:31:35.956024 3.001715 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:31:42.964224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:31:50.965401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:32:06.968447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:32:38.974347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:38:42.980023 3.001737 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:38:49.987428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:38:57.989118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:38:59.324035 0.000141 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:38:59.324268 0.117101 tcp 10.0.2.110 49248 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:38:59.464695 0.116939 tcp 10.0.2.110 49249 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 07:39:13.991897 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:39:45.998636 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:45:50.004721 3.000878 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:45:57.011381 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:05.013376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:21.016550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:46:53.022476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:52:57.028267 3.001304 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 07:53:04.035617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:53:12.036853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:53:28.040532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 07:54:00.046242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:04.052304 3.001450 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:00:11.059489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:19.061454 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:00:35.063862 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:01:07.070465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:07:11.076966 3.000609 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:07:18.083922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:07:26.084854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:07:42.087775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:08:14.093999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:08:59.331015 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:08:59.331155 0.106104 tcp 10.0.2.110 49250 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:08:59.467520 0.115327 tcp 10.0.2.110 49251 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:14:18.100160 3.002319 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:14:25.107781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:14:33.109252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:14:49.112626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:15:21.118098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:25.125221 3.000343 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:21:32.131583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:40.133266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:21:56.135766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:22:28.142438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:28:32.148163 3.001805 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:28:39.155803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:28:47.157413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:29:03.159964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:29:35.165865 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:35:39.172044 3.001313 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:35:46.179669 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:35:54.180794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:36:10.184434 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:36:42.189732 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:38:59.339801 0.000049 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:38:59.339897 0.117549 tcp 10.0.2.110 49252 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:38:59.480036 0.117063 tcp 10.0.2.110 49253 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 08:42:46.195593 3.001922 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:42:53.203170 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:43:01.205053 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:43:17.207912 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:43:49.213770 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:49:53.220428 3.001397 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:50:00.227267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:08.229441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:24.231950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:50:56.237649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:57:00.243531 3.002246 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 08:57:07.251373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:57:15.252696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:57:31.256200 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 08:58:03.262156 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:04:07.268140 3.001515 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:04:14.274972 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:04:22.277084 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:04:38.280106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:05:10.286219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:08:59.352781 0.000061 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:08:59.353113 0.117379 tcp 10.0.2.110 49254 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:08:59.494065 0.117370 tcp 10.0.2.110 49255 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:11:14.292735 3.001148 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:11:21.299661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:11:29.301142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:11:45.303717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:12:17.309718 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:21.315576 3.002003 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:18:28.323374 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:36.324680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:18:52.327723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:19:24.334080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:28.340723 3.000925 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:25:35.347580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:43.349143 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:25:59.351776 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:26:31.357438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:32:35.363322 3.002253 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:32:42.371448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:32:50.373221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:33:06.375831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:33:38.381861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:38:59.355063 0.000050 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:38:59.355309 0.117247 tcp 10.0.2.110 49256 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:38:59.497343 0.108206 tcp 10.0.2.110 49257 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 09:39:42.387027 3.002328 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:39:49.394960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:39:57.396508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:40:13.399705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:40:45.405742 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:46:49.411003 3.002126 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:46:56.418786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:04.420794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:20.423716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:47:52.429459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:53:56.435219 3.002360 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 09:54:03.443352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:11.445047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:27.447448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 09:54:59.453542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:03.459565 3.001799 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:01:10.466747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:18.468578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:01:34.471326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:02:06.477890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:10.483652 3.001721 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:08:17.491202 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:25.492645 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:41.495876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:08:59.363109 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:08:59.363256 0.117648 tcp 10.0.2.110 49258 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:08:59.505260 0.105745 tcp 10.0.2.110 49259 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:09:13.501407 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:17.507582 3.002072 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:15:24.514652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:32.516323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:15:48.519812 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:16:20.525569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:24.531464 3.001744 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:22:31.538882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:39.540114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:22:55.544032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:23:27.549823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:29:31.555312 3.001683 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:29:38.562662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:29:46.564682 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:30:02.567740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:30:34.573487 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:36:38.579596 3.001524 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:36:45.587185 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:36:53.588433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:37:09.591674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:37:41.597199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:38:59.371204 0.000045 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:38:59.371446 0.117578 tcp 10.0.2.110 49260 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:38:59.514816 0.114934 tcp 10.0.2.110 49261 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 10:43:45.602881 3.002540 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:43:52.610679 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:44:00.612356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:44:16.615217 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:44:48.621221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:50:52.628383 3.000910 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:50:59.634918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:07.636337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:23.639340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:51:55.645153 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:57:59.651644 3.001317 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 10:58:06.659085 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:58:14.660194 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:58:30.663655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 10:59:02.669582 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:05:06.675261 3.001423 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:05:13.682809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:05:21.684419 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:05:37.687080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:06:09.693595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:08:59.456162 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:08:59.456288 0.114667 tcp 10.0.2.110 49262 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:08:59.650398 0.116682 tcp 10.0.2.110 49263 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:08:59.659650 0.010048 udp 10.0.2.110 53675 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/01 11:08:59.670964 0.174280 tcp 10.0.2.110 49264 -> 37.19.5.22 80 SPA_* 0 0 23 17304 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:09:00.110119 0.010256 udp 10.0.2.110 54142 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/01 11:09:00.136557 0.116201 tcp 10.0.2.110 49265 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:09:01.214352 0.010035 udp 10.0.2.110 51858 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 11:09:01.224905 0.120331 tcp 10.0.2.110 49266 -> 37.19.5.65 80 FSPA* 0 0 13 5521 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:09:29.844836 0.000180 tcp 10.0.2.110 49264 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:09:34.738135 0.000048 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:12:13.700177 3.001476 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 11:12:20.706750 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:12:28.708566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:12:44.711010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:13:16.717305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:20.722736 3.002519 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:19:27.730810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:35.732401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:19:51.735276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:20:23.741341 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:27.748049 3.000699 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:26:34.754566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:42.755819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:26:58.759116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:27:30.765342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:33:34.770887 3.001870 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:33:41.778932 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:33:49.780389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:34:05.783282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:34:37.789537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:38:59.387439 0.000123 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:38:59.387658 0.108407 tcp 10.0.2.110 49267 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:38:59.496253 0.000028 tcp 10.0.2.110 49264 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 11:38:59.523752 0.117208 tcp 10.0.2.110 49268 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 11:40:41.794698 3.002331 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:40:48.802705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:40:56.804065 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:41:12.807222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:41:44.813108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:47:48.819436 3.001073 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:47:55.826270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:03.828383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:19.830711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:48:51.837324 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:54:55.842477 3.002312 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 11:55:02.850518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:10.851659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:26.855406 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 11:55:58.861152 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:02:02.867479 3.001522 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:02:09.874365 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:02:17.876270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:02:33.879176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:03:05.885247 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:08:59.395394 0.000046 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:08:59.395643 0.105810 tcp 10.0.2.110 49269 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:08:59.528077 0.116956 tcp 10.0.2.110 49270 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:09:09.890936 3.001549 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:09:16.898488 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:09:24.900071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:09:40.903103 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:10:12.909444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:16.915502 3.001083 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:16:23.922620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:31.923658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:16:47.926559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:17:19.932809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:23.939582 3.000724 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:23:30.946140 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:38.948207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:23:54.950688 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:24:26.956970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:30:30.962903 3.001781 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:30:37.969984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:30:45.971772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:31:01.975153 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:31:33.980627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:37:37.987775 3.000620 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:37:44.993949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:37:52.996015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:38:08.999183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:38:41.004944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:38:59.404113 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:38:59.404441 0.116949 tcp 10.0.2.110 49271 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:38:59.550157 0.105720 tcp 10.0.2.110 49272 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 12:44:45.011041 3.001332 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:44:52.018118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:45:00.019700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:45:16.022448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:45:48.028480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:51:52.034305 3.002155 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:51:59.041914 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:07.043820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:23.046864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:52:55.053174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:58:59.059421 3.001003 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 12:59:06.065834 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:59:14.067360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 12:59:30.070446 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:00:02.076747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:06:06.082568 3.001993 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:06:14.735838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:06:22.734164 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:06:38.737391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:07:10.742926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:09:00.212733 0.000115 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:09:00.212935 0.116947 tcp 10.0.2.110 49273 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:09:00.615066 0.114810 tcp 10.0.2.110 49274 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:13:14.749139 3.001692 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:13:21.756541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:13:29.758249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:13:45.760803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:14:17.766765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:20:33.780667 3.001174 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:20:40.787794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:20:48.789265 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:21:04.792130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:21:36.797926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:27:56.807293 3.061696 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:28:03.874954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:28:11.876108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:28:27.879452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:28:59.884965 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:35:03.891230 3.002109 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:35:10.898399 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:35:18.899969 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:35:34.903402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:36:06.909527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:39:00.241226 0.000124 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:39:00.241449 0.117101 tcp 10.0.2.110 49275 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:39:00.400928 0.108155 tcp 10.0.2.110 49276 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 13:42:10.915583 3.011392 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:42:17.932386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:42:25.934486 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:42:41.937239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:43:13.946470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:17.948683 3.001954 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:49:24.956931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:32.958174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:49:48.961390 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:50:20.967205 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:24.972824 3.002130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 13:56:31.980950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:39.982394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:56:55.985207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 13:57:27.991011 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:03:31.997776 3.001449 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:03:39.004292 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:03:47.006189 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:04:03.009500 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:04:35.015499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:09:00.248492 0.000045 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:09:00.248577 0.108584 tcp 10.0.2.110 49277 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:09:00.388135 0.117453 tcp 10.0.2.110 49278 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:10:39.021804 3.001322 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:10:46.028662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:10:54.030334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:11:10.032958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:11:42.038792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:17:46.045539 3.001184 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:17:53.052397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:18:01.054397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:18:17.056778 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:18:49.063190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:24:53.068650 3.002138 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:25:00.076911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:25:08.078342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:25:24.081483 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:25:56.086795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:32:00.093861 3.000717 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:32:07.100445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:32:15.101700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:32:31.105305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:33:03.111041 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:39:00.256617 0.000062 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:39:00.256752 0.117251 tcp 10.0.2.110 49279 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:39:00.401869 0.114907 tcp 10.0.2.110 49280 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 14:39:07.116718 3.002003 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:39:14.124305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:39:22.125973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:39:38.128977 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:40:10.134934 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:46:14.141055 3.001228 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:46:21.148066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:46:29.150249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:46:45.153208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:47:17.159111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:21.164752 3.001844 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 14:53:28.172456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:36.173539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:53:52.176938 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 14:54:24.182950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:28.188783 3.001505 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:00:35.196414 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:43.198017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:00:59.200821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:01:31.206714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:07:35.212354 3.002162 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:07:42.220207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:07:50.221615 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:08:06.224924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:08:38.231185 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:09:00.264891 0.000041 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:09:00.264973 0.105792 tcp 10.0.2.110 49281 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:09:00.405470 0.115316 tcp 10.0.2.110 49282 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:09:02.040416 0.010403 udp 10.0.2.110 50595 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 15:09:02.051411 0.119089 tcp 10.0.2.110 49283 -> 37.19.5.65 80 FSPA* 0 0 13 5484 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:14:42.237190 3.001685 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:14:49.244403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:14:57.245911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:15:13.248924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:15:45.255240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:21:49.260901 3.001792 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:21:56.268035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:22:04.269535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:22:20.272974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:22:52.278976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:28:56.284980 3.001681 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:29:03.292179 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:29:11.293956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:29:27.296468 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:29:59.302711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:36:03.309087 3.001158 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:36:10.316775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:36:18.317633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:36:34.321179 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:37:06.327129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:39:00.272861 0.000083 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:39:00.273031 0.116990 tcp 10.0.2.110 49284 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:39:00.434390 0.108195 tcp 10.0.2.110 49285 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 15:43:10.332288 3.002119 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:43:17.339974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:43:25.341874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:43:41.344446 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:44:13.350650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:17.356616 3.001360 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:50:24.364165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:32.365681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:50:48.368791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:51:20.374617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:24.381644 3.000929 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 15:57:31.388475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:39.389315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:57:55.392755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 15:58:27.398266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:04:31.404163 3.002335 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:04:38.411735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:04:46.413545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:05:02.416303 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:05:34.422733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:09:00.281537 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:09:00.281872 0.116726 tcp 10.0.2.110 49286 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:09:00.422039 0.117122 tcp 10.0.2.110 49287 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:11:38.428307 3.001916 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:11:45.435629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:11:53.437501 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:12:09.440933 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:12:41.446413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:18:45.452850 3.001256 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:18:52.460288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:19:00.461708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:19:16.464142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:19:48.470733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:25:52.476179 3.001782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:25:59.484142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:26:07.485146 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:26:23.488416 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:26:55.494351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:32:59.501520 3.000252 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:33:06.507682 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:33:14.509144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:33:30.512461 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:34:02.518594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:39:00.288285 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:39:00.288381 0.114561 tcp 10.0.2.110 49288 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:39:00.443719 0.114732 tcp 10.0.2.110 49289 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 16:40:06.524756 3.001159 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:40:13.532164 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:40:21.533492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:40:37.536557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:41:09.542363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:47:13.548240 3.001646 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:47:20.555904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:47:28.557775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:47:44.560644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:48:16.566005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:20.572215 3.001696 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 16:54:27.579951 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:35.581586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:54:51.584510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 16:55:23.590371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:27.597423 3.000468 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:01:34.604202 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:42.605422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:01:58.608070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:02:30.614230 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:08:34.621367 3.000284 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:08:41.627711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:08:49.629177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:09:00.303707 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:09:00.303947 0.114669 tcp 10.0.2.110 49290 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:09:00.441836 0.117412 tcp 10.0.2.110 49291 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:09:05.631873 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:09:37.638544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:15:41.644152 3.001945 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:15:48.651505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:15:56.652962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:16:12.656014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:16:44.662098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:22:48.668562 3.001285 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:22:55.675383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:23:03.676815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:23:19.680513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:23:51.685949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:29:55.692784 3.000992 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:30:02.699942 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:30:10.701213 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:30:26.703841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:30:58.710137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:37:02.718327 2.999651 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:37:09.723433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:37:17.725228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:37:33.727780 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:38:05.733995 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:39:00.304747 0.000091 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:39:00.304912 0.117124 tcp 10.0.2.110 49292 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:39:00.450368 0.105841 tcp 10.0.2.110 49293 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 17:44:09.739576 3.002121 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:44:16.747388 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:44:24.751720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:44:40.751981 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:45:12.757980 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:16.764873 3.001116 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:51:23.771816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:31.772778 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:51:47.775674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:52:19.782210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:23.788133 3.001300 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 17:58:30.795212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:38.797148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:58:54.799672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 17:59:26.806296 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:05:30.812106 3.001969 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:05:37.819430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:05:45.820871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:06:01.824025 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:06:33.829675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:09:00.313011 0.000076 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:09:00.313161 0.117161 tcp 10.0.2.110 49294 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:09:00.460880 0.115592 tcp 10.0.2.110 49295 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:12:37.836125 3.001380 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:12:44.843617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:12:52.845017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:13:08.847839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:13:40.853615 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:19:44.861312 3.000349 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:19:51.867512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:19:59.868929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:20:15.871678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:20:47.878051 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:26:51.884196 3.001067 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:26:58.891343 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:27:06.892768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:27:22.896001 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:27:54.901726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:33:58.908700 3.000914 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:34:05.915756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:34:13.917155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:34:29.920146 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:35:01.925790 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:39:00.321507 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:39:00.321815 0.116837 tcp 10.0.2.110 49296 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:39:00.466058 0.108368 tcp 10.0.2.110 49297 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 18:41:05.931449 3.002026 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:41:12.939152 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:41:20.940443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:41:36.944304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:42:08.949954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:48:12.957220 3.000121 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:48:19.963509 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:48:27.965030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:48:43.967903 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:49:15.973493 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:19.979375 3.002200 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 18:55:26.987026 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:34.988716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:55:50.991418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 18:56:22.997424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:27.003296 3.002130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:02:34.011244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:42.012797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:02:58.015672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:03:30.021559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:09:00.329161 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:09:00.329463 0.114999 tcp 10.0.2.110 49298 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:09:00.490413 0.138676 tcp 10.0.2.110 49299 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:09:02.042904 0.010585 udp 10.0.2.110 50180 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 19:09:02.054126 0.142114 tcp 10.0.2.110 49300 -> 37.19.5.65 80 FSPA* 0 0 13 5502 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:09:34.027605 3.001909 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:09:41.035242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:09:49.036444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:10:05.041868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:10:37.045486 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:16:41.052443 3.000561 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:16:48.059323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:16:56.060227 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:17:12.063402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:17:44.069974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:23:48.076188 3.001143 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:23:55.083257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:24:03.084234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:24:19.087734 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:24:51.093532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:30:55.099665 3.001594 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:31:02.106946 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:31:10.108896 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:31:26.111850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:31:58.117426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:38:02.124543 3.000531 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:38:09.130974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:38:17.132600 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:38:33.135648 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:39:00.336684 0.000119 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:39:00.336884 0.117458 tcp 10.0.2.110 49301 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:39:00.490979 0.117220 tcp 10.0.2.110 49302 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 19:39:05.141868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:45:09.148403 3.000814 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:45:16.154667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:45:24.156504 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:45:40.159785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:46:12.165779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:52:16.171294 3.002166 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:52:23.178559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:52:31.180676 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:52:47.183508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:53:19.189585 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:23.195305 3.002191 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 19:59:30.202779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:38.204586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 19:59:54.207721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:00:26.213092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:06:30.218797 3.001955 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:06:37.226511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:06:45.228486 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:07:01.231710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:07:33.237816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:09:00.344530 0.000052 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:09:00.344777 0.107904 tcp 10.0.2.110 49303 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:09:00.482429 0.117798 tcp 10.0.2.110 49304 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:13:37.243496 3.001538 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:13:44.250706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:13:52.252181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:13:59.662892 0.000060 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:13:59.662990 0.009806 udp 10.0.2.110 50798 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 20:13:59.673301 0.131843 tcp 10.0.2.110 49305 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:14:08.255282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:14:40.261497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:20:44.266896 3.001760 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:20:51.274681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:20:59.276606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:21:15.280014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:21:47.285683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:27:51.290817 3.002364 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:27:58.298499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:28:06.300125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:28:22.303413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:28:54.309545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:34:58.315204 3.002136 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:35:05.322947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:35:13.324326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:35:29.327359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:36:01.333154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:39:00.353323 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:39:00.353642 0.108212 tcp 10.0.2.110 49306 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:39:00.503771 0.116980 tcp 10.0.2.110 49307 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 20:42:05.338942 3.002174 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:42:12.346879 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:42:20.348451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:42:36.350881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:43:08.357515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:49:12.363774 3.001392 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:49:19.370779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:49:27.371987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:49:43.375375 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:50:15.381516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:19.387099 3.002006 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 20:56:26.394605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:34.395775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:56:50.399375 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 20:57:22.404864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:26.411423 3.001053 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:03:33.418861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:41.419749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:03:57.423257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:04:29.429421 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:09:00.052611 0.000052 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:09:00.052700 0.009990 udp 10.0.2.110 59893 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/01 21:09:00.063164 0.174569 tcp 10.0.2.110 49308 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:09:00.360565 0.009841 udp 10.0.2.110 58605 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/01 21:09:00.370784 0.114853 tcp 10.0.2.110 49309 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:09:00.510571 0.114485 tcp 10.0.2.110 49310 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:09:01.082848 0.009823 udp 10.0.2.110 51614 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/01 21:09:01.093131 0.115307 tcp 10.0.2.110 49311 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:09:30.237026 0.000151 tcp 10.0.2.110 49308 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:09:35.048534 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:10:33.435060 3.001930 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/01 21:10:40.442856 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:10:48.443923 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:11:04.447267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:11:36.453016 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:17:40.459584 3.001289 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:17:47.466566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:17:55.467888 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:18:11.471383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:18:43.476782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:24:47.483223 3.001720 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:24:54.490816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:25:02.492165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:25:18.494987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:25:50.501113 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:31:54.506905 3.001759 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:32:01.514803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:32:09.516280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:32:25.519093 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:32:57.525480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:39:00.369048 0.000044 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:39:00.369167 0.105955 tcp 10.0.2.110 49312 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:00.475304 0.000034 tcp 10.0.2.110 49308 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/01 21:39:00.505082 0.117235 tcp 10.0.2.110 49313 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 21:39:01.530779 3.002337 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:39:08.538054 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:39:16.540176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:39:32.543054 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:40:04.549097 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:46:08.555224 3.001213 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:46:15.562464 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:46:23.564076 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:46:39.567029 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:47:11.572563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:53:15.578641 3.002111 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 21:53:22.585972 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:53:30.587532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:53:46.590947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 21:54:18.597220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:22.602770 3.002093 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:00:29.610010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:37.611924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:00:53.615135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:01:25.621070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:07:29.626811 3.001711 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:07:36.634547 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:07:44.635851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:08:00.638513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:08:32.644457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:09:00.376959 0.000080 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:09:00.377120 0.115248 tcp 10.0.2.110 49314 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:09:00.516437 0.114756 tcp 10.0.2.110 49315 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:14:36.650645 3.001515 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:14:43.657871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:14:51.659892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:15:07.662885 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:15:39.668710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:21:43.674450 3.003787 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:21:50.683669 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:21:58.683823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:22:14.687042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:22:46.693012 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:28:50.698351 3.002032 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:28:57.706458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:29:05.708075 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:29:21.710874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:29:53.717013 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:35:57.722172 3.001861 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:36:04.729937 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:36:12.731359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:36:28.734810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:37:00.740752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:39:00.384815 0.000099 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:39:00.384996 0.108677 tcp 10.0.2.110 49316 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:39:00.517089 0.106080 tcp 10.0.2.110 49317 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 22:43:04.747608 3.000604 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:43:11.754024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:43:19.755308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:43:35.758601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:44:07.764888 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:50:11.770931 3.001375 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:50:18.778126 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:50:26.779781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:50:42.782250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:51:14.788547 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:18.795693 3.000911 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 22:57:25.801653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:33.803519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:57:49.806507 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 22:58:21.812814 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:25.818345 3.001726 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:04:32.825866 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:40.827243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:04:56.830304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:05:28.836768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:09:00.392963 0.000074 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:09:00.393112 0.116933 tcp 10.0.2.110 49318 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:09:00.540034 0.115412 tcp 10.0.2.110 49319 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:09:02.047349 0.013419 udp 10.0.2.110 54920 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/01 23:09:02.061321 0.127144 tcp 10.0.2.110 49320 -> 37.19.5.65 80 FSPA* 0 0 13 5377 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:11:32.842871 3.001550 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:11:39.850278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:11:47.851607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:12:03.854633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:12:35.860560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:18:39.865957 3.002028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:18:46.873673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:18:54.875545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:19:10.878467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:19:42.884743 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:25:46.891190 3.000855 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:25:53.897722 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:26:01.899360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:26:17.902166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:26:49.908586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:32:53.914804 3.001715 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:33:00.922250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:33:08.923426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:33:24.926403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:33:56.932089 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:39:00.401036 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:39:00.401143 0.106061 tcp 10.0.2.110 49321 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:39:00.531636 0.115405 tcp 10.0.2.110 49322 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/01 23:40:00.938411 3.001841 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:40:07.945705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:40:15.947596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:40:31.950158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:41:03.956608 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:47:07.962150 3.001984 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:47:14.969881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:47:22.971603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:47:38.974623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:48:10.980017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:54:14.986431 3.001446 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/01 23:54:21.993533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:54:29.995124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:54:45.998017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/01 23:55:18.004580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:22.010630 3.001229 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:01:29.017855 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:37.019208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:01:53.022240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:02:25.028773 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:08:29.034249 3.001405 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:08:36.041645 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:08:44.042868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:09:00.046510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:09:00.409637 0.000082 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:09:00.409804 0.115049 tcp 10.0.2.110 49323 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:09:00.548723 0.106134 tcp 10.0.2.110 49324 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:09:32.051897 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:15:36.059428 3.000778 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:15:43.065986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:15:51.067052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:16:07.070160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:16:39.076132 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:22:43.081986 3.002189 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:22:50.089575 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:22:58.091591 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:23:14.094437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:23:46.100222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:29:50.106763 3.000856 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:29:57.113239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:30:05.114935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:30:21.117827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:30:53.123989 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:36:57.130532 3.001433 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:37:04.137595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:37:12.139253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:37:28.141691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:38:00.147763 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:39:00.416628 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:39:00.416906 0.116950 tcp 10.0.2.110 49325 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:39:00.564601 0.115725 tcp 10.0.2.110 49326 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 00:44:04.153925 3.001530 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:44:11.161209 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:44:19.163156 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:44:35.166144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:45:07.172114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:51:11.177588 3.002582 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:51:18.185536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:51:26.186837 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:51:42.190279 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:52:14.195853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:18.202843 3.000790 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 00:58:25.209724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:33.211118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:58:49.213658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 00:59:21.219968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:25.225470 3.002212 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:05:32.233051 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:40.235251 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:05:56.237796 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:06:28.244186 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:09:00.424353 0.000066 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:09:00.424523 0.114667 tcp 10.0.2.110 49327 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:09:00.564673 0.117067 tcp 10.0.2.110 49328 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:12:32.250253 3.001381 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:12:39.257382 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:12:47.259101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:13:03.261900 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:13:35.267908 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:19:39.273410 3.002154 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:19:46.281377 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:19:54.282842 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:20:10.285759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:20:42.291537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:26:46.297502 3.001937 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:26:53.305677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:27:01.306596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:27:17.309963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:27:49.316612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:33:53.321284 3.002293 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:34:00.329515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:34:08.330641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:34:24.334244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:34:56.340353 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:39:00.432897 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:39:00.433156 0.105993 tcp 10.0.2.110 49329 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:39:00.564173 0.108318 tcp 10.0.2.110 49330 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 01:41:00.346035 3.001714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:41:07.353292 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:41:15.354499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:41:31.357414 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:42:03.363755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:48:07.370055 3.001467 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:48:14.376898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:48:22.379011 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:48:38.381655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:49:10.387493 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:55:14.393668 3.001977 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 01:55:21.400839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:55:29.402372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:55:45.405927 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 01:56:17.411991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:21.417928 3.001546 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:02:28.425536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:36.426527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:02:52.429927 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:03:24.435311 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:09:00.441127 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:09:00.441385 0.110111 tcp 10.0.2.110 49331 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:09:00.580083 0.108487 tcp 10.0.2.110 49332 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:09:28.441508 3.001698 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:09:35.449225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:09:43.450797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:09:59.453789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:10:31.459642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:16:35.466297 3.000798 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:16:42.473458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:16:50.474203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:17:06.477650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:17:38.483793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:23:42.490977 3.000488 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:23:49.497422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:23:57.498823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:24:13.501771 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:24:45.507755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:30:49.513117 3.002421 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:30:56.520655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:31:04.522879 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:31:20.525560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:31:52.531201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:37:56.536891 3.002572 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:38:03.545267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:38:11.546445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:38:27.549882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:38:59.555516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:39:00.448682 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:39:00.448832 0.106571 tcp 10.0.2.110 49333 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:39:00.580816 0.117295 tcp 10.0.2.110 49334 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 02:45:03.561393 3.001870 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:45:10.568739 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:45:18.570238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:45:34.573653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:46:06.579629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:52:10.585361 3.001957 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:52:18.283829 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:52:26.285336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:52:42.288121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:53:14.294475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:18.299883 3.001847 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 02:59:25.307835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:33.309471 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 02:59:49.312000 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:00:21.318063 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:25.324178 3.001773 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:06:32.331925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:40.332947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:06:56.336139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:07:28.342107 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:09:00.797355 0.000104 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:09:00.797552 0.117513 tcp 10.0.2.110 49335 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:09:00.948254 0.108158 tcp 10.0.2.110 49336 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:09:02.781371 0.010187 udp 10.0.2.110 50844 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 03:09:02.795288 0.131975 tcp 10.0.2.110 49337 -> 37.19.5.65 80 FSPA* 0 0 13 5382 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:13:32.348752 3.001257 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:13:39.355812 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:13:47.357680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:14:03.360519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:14:35.366261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:20:39.372114 3.001616 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:20:46.379391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:20:54.381635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:21:10.384578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:21:42.390262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:27:46.396796 3.000999 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:27:53.403693 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:28:01.405327 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:28:17.408164 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:28:49.413929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:34:53.420345 3.001434 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:35:00.427677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:35:08.429248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:35:24.432533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:35:56.438305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:39:00.805018 0.000061 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:39:00.805207 0.117075 tcp 10.0.2.110 49338 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:39:00.950964 0.117098 tcp 10.0.2.110 49339 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 03:42:00.443904 3.001768 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:42:07.451973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:42:15.453544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:42:31.456447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:43:03.462268 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:49:07.468463 3.001130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:49:14.475890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:49:22.477209 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:49:38.480201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:50:10.486017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:56:14.491616 3.001914 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 03:56:21.499737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:56:29.501316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:56:45.503917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 03:57:17.509763 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:21.516375 3.001530 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:03:28.523984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:36.524818 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:03:52.529642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:04:24.533696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:09:02.175025 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:09:02.175298 0.108135 tcp 10.0.2.110 49340 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:09:02.318254 0.108655 tcp 10.0.2.110 49341 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:10:31.384055 3.001594 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:10:38.391638 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:10:46.392733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:11:02.396052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:11:34.402456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:17:38.408161 3.001783 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:17:45.415458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:17:53.417332 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:18:09.419843 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:18:41.425978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:24:45.432083 3.001312 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:24:52.439678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:25:00.441425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:25:16.444008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:25:48.449754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:31:52.455834 3.001919 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:31:59.463653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:32:07.465027 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:32:23.467666 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:32:55.474213 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:38:59.480139 3.001502 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:39:02.183803 0.000095 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:39:02.184008 0.117598 tcp 10.0.2.110 49342 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:39:02.336351 0.117177 tcp 10.0.2.110 49343 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 04:39:06.487522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:39:14.489317 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:39:30.491627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:40:02.497708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:46:06.503478 3.001940 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:46:13.511651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:46:21.513463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:46:37.515967 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:47:09.522310 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:53:13.528010 3.001491 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 04:53:20.535534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:53:28.536821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:53:44.540180 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 04:54:16.545984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:20.552028 3.001568 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:00:27.559701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:35.561131 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:00:51.563660 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:01:23.569961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:27.576223 3.001346 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:07:34.583031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:42.584894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:07:58.587743 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:08:30.593541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:09:02.191318 0.000050 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:09:02.191437 0.106580 tcp 10.0.2.110 49344 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:09:02.328687 0.117646 tcp 10.0.2.110 49345 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:14:34.599756 3.001864 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:14:41.607658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:14:49.609310 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:15:05.612200 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:15:37.618277 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:21:41.623756 3.001910 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:21:48.631549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:21:56.632492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:22:12.635754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:22:44.641450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:28:48.649000 3.000626 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:28:55.655176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:29:03.656829 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:29:19.659758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:29:51.665614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:35:55.671273 3.001791 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:36:02.679455 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:36:10.681099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:36:26.683436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:36:58.690311 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:39:02.199324 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:39:02.199451 0.115184 tcp 10.0.2.110 49346 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:39:02.337807 0.117143 tcp 10.0.2.110 49347 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 05:43:02.695574 3.001995 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:43:09.703442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:43:17.704880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:43:33.707522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:44:05.713526 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:50:09.719433 3.001647 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:50:16.727068 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:50:24.728749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:50:40.731858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:51:12.737909 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:57:16.743617 3.001513 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 05:57:23.750947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:57:31.752914 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:57:47.755221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 05:58:19.761415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:23.768222 3.001308 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:04:30.775333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:38.776841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:04:54.779594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:05:26.785782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:09:02.207443 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:09:02.207595 0.114899 tcp 10.0.2.110 49348 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:09:02.345599 0.108825 tcp 10.0.2.110 49349 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:11:30.791450 3.001896 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:11:37.798935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:11:45.800998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:12:02.895287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:12:34.901371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:18:39.908723 3.001900 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:18:46.915811 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:18:54.917540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:19:10.920218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:19:42.926161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:25:53.941993 3.002247 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:26:00.950377 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:26:08.951881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:26:24.955074 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:26:56.960308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:33:24.972914 2.999895 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:33:31.978544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:33:39.980026 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:33:55.983284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:34:27.989376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:39:02.755720 0.000278 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:39:02.756090 0.106678 tcp 10.0.2.110 49350 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:39:02.886218 0.108825 tcp 10.0.2.110 49351 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 06:40:31.994586 3.002420 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:40:39.002594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:40:47.003640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:41:03.007328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:41:35.012893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:47:39.018643 3.002261 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:47:46.026414 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:47:54.027622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:48:10.032480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:48:42.036902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:54:46.043454 3.001461 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 06:54:53.050694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:55:01.052101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:55:17.055182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 06:55:49.060574 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:01:53.066693 3.001809 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:02:00.074384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:02:08.075527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:02:24.078634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:02:56.084833 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:09:00.090868 3.001465 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:09:02.681556 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:09:02.681743 0.009586 udp 10.0.2.110 62042 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/02 07:09:02.700203 0.228318 tcp 10.0.2.110 49352 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:02.762286 0.115186 tcp 10.0.2.110 49353 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:02.900723 0.117099 tcp 10.0.2.110 49354 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:03.682933 0.117516 tcp 10.0.2.110 49355 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:04.569099 0.010646 udp 10.0.2.110 54778 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 07:09:04.580490 0.129926 tcp 10.0.2.110 49356 -> 37.19.5.65 80 FSPA* 0 0 13 5321 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:07.098319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:09:15.099747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:09:31.102555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:09:32.925724 0.000150 tcp 10.0.2.110 49352 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:09:37.792315 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:10:03.108949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:16:07.114965 3.001402 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:16:14.122353 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:16:22.123562 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:16:38.126457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:17:10.132823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:23:14.138738 3.001405 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:23:21.146274 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:23:29.148175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:23:45.151451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:24:17.157827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:30:21.162944 3.001201 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:30:28.169927 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:30:36.172027 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:30:52.174490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:31:24.180574 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:37:28.186682 3.001663 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:37:35.194171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:37:43.195330 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:37:59.198561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:38:31.204771 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:39:02.772334 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:39:02.772585 0.117094 tcp 10.0.2.110 49357 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:39:02.889813 0.000059 tcp 10.0.2.110 49352 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/02 07:39:02.913935 0.108477 tcp 10.0.2.110 49358 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 07:44:35.210173 3.002135 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:44:42.218017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:44:50.219437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:45:06.222865 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:45:38.229237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:51:42.234610 3.001540 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:51:49.242375 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:51:57.243425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:52:13.246444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:52:45.252791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:58:49.258702 3.001325 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 07:58:56.266436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:59:04.267249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:59:20.270307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 07:59:52.276515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:05:56.282907 3.001031 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:06:03.289983 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:06:11.291300 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:06:27.294617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:06:59.300885 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:09:02.779575 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:09:02.779753 0.115170 tcp 10.0.2.110 49359 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:09:02.918712 0.115131 tcp 10.0.2.110 49360 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:13:03.306318 3.002150 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:13:10.314212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:13:18.315180 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:13:34.318984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:14:06.324630 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:20:10.330323 3.002080 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:20:17.337992 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:20:25.339777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:20:41.342700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:21:13.348820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:27:17.354013 3.001814 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:27:24.361846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:27:32.363578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:27:48.366402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:28:20.372915 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:34:24.378159 3.002314 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:34:31.385921 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:34:39.387052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:34:55.390287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:35:27.396672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:39:02.788612 0.000113 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:39:02.788819 0.115228 tcp 10.0.2.110 49361 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:39:02.928566 0.115045 tcp 10.0.2.110 49362 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 08:41:31.403072 3.000901 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:41:38.410017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:41:46.411008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:42:02.414384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:42:34.420616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:48:38.428089 3.000276 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:48:45.434128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:48:53.435223 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:49:09.438580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:49:41.444201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:55:45.450014 3.001793 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 08:55:52.457641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:56:00.459786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:56:16.462415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 08:56:48.468069 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:02:52.474124 3.001872 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:02:59.481825 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:03:07.482904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:03:23.486176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:03:55.492659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:09:02.796240 0.000081 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:09:02.796403 0.106506 tcp 10.0.2.110 49363 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:09:02.933742 0.114728 tcp 10.0.2.110 49364 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:09:59.498426 3.001379 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:10:06.506125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:10:14.507633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:10:30.510566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:11:02.516490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:17:06.522489 3.001227 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:17:13.529825 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:17:21.531315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:17:37.534175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:18:09.540031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:24:13.546557 3.001524 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:24:20.553473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:24:28.555523 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:24:44.558045 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:25:16.564229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:31:20.570125 3.001565 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:31:27.577300 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:31:35.579455 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:31:51.581803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:32:23.588205 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:38:27.594023 3.001439 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:38:34.601835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:38:42.602985 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:38:58.606077 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:39:02.804163 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:39:02.804289 0.118589 tcp 10.0.2.110 49365 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:39:02.951350 0.108336 tcp 10.0.2.110 49366 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 09:39:30.612014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:45:34.617653 3.002049 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:45:41.626024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:45:49.626803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:46:05.630347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:46:37.635872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:52:41.641803 3.001610 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:52:48.649705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:52:56.651226 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:53:12.653659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:53:44.660338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 09:59:48.666160 3.001398 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 09:59:55.673616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:00:03.674963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:00:19.677867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:00:51.683932 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:06:55.690231 3.001346 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:07:02.697601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:07:10.699185 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:07:26.701760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:07:58.707886 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:09:02.812351 0.000128 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:09:02.812564 0.108397 tcp 10.0.2.110 49367 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:09:02.945930 0.117595 tcp 10.0.2.110 49368 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:14:02.715136 3.000373 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:14:09.721616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:14:17.722677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:14:33.725850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:15:05.732073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:21:09.737718 3.001828 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:21:16.745100 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:21:24.746890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:21:40.749626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:22:12.755922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:28:16.761584 3.002077 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:28:23.769492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:28:31.770767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:28:47.773779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:29:19.779667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:35:23.785941 3.001412 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:35:30.792966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:35:38.795023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:35:54.797905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:36:26.804124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:39:02.820448 0.000076 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:39:02.820606 0.108333 tcp 10.0.2.110 49369 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:39:02.953603 0.114836 tcp 10.0.2.110 49370 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 10:42:30.809683 3.001499 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:42:37.817201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:42:45.818485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:43:01.821949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:43:33.827771 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:49:37.833272 3.002516 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:49:44.841330 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:49:52.842402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:50:08.845868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:50:40.851512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:56:44.858504 3.000589 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 10:56:51.864858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:56:59.866934 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:57:15.869719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 10:57:47.876196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:03:51.881281 3.001758 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:03:58.889232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:04:06.890364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:04:22.894005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:04:54.899431 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:09:02.827634 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:09:02.827802 0.117174 tcp 10.0.2.110 49371 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:09:02.970046 0.117550 tcp 10.0.2.110 49372 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:09:04.572680 0.009988 udp 10.0.2.110 57502 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 11:09:04.583329 0.189695 tcp 10.0.2.110 49373 -> 37.19.5.65 80 FSPA* 0 0 13 5523 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:10:58.906016 3.001578 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:11:05.913036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:11:13.914513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:11:29.917926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:12:01.924029 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:18:05.929643 3.001541 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:18:12.937382 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:18:20.938449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:18:36.941509 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:19:08.948080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:25:12.954381 3.001285 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:25:19.961015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:25:27.962755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:25:43.965391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:26:15.971871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:32:19.978805 3.000489 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:32:26.984998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:32:34.986184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:32:50.989607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:33:22.995730 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:39:02.835987 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:39:02.836139 0.114996 tcp 10.0.2.110 49374 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:39:02.976148 0.117551 tcp 10.0.2.110 49375 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 11:39:27.001329 3.002172 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:39:34.008680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:39:42.010917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:39:58.013199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:40:30.020007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:46:34.026003 3.001307 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:46:41.033072 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:46:49.034172 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:47:05.037372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:47:37.043796 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:53:41.049623 3.001264 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 11:53:48.057009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:53:56.058313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:54:12.061111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 11:54:44.067674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:00:48.073197 3.001782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:00:55.080536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:01:03.082176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:01:19.085612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:01:51.093035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:07:55.096838 3.001942 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:08:02.104954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:08:10.106637 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:08:26.109618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:08:58.115249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:09:02.844856 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:09:02.845021 0.117295 tcp 10.0.2.110 49376 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:09:02.992601 0.115244 tcp 10.0.2.110 49377 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:15:02.121240 3.001574 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:15:09.129114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:15:17.130263 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:15:33.133563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:16:05.139318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:22:09.145571 3.002007 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:22:16.153372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:22:24.155159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:22:40.157145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:23:12.163151 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:29:16.169259 3.001640 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:29:23.176394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:29:31.178274 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:29:47.181634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:30:19.187513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:36:23.193349 3.001377 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:36:30.200817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:36:38.202594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:36:54.204946 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:37:26.210965 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:39:02.852932 0.000094 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:39:02.853464 0.105685 tcp 10.0.2.110 49378 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:39:02.983463 0.117732 tcp 10.0.2.110 49379 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 12:43:30.216967 3.001642 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:43:37.224970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:43:45.225954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:44:01.229621 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:44:33.235126 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:50:37.241010 3.001901 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:50:44.248288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:50:52.249990 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:51:08.253070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:51:40.259481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:57:44.265352 3.001325 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 12:57:51.272818 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:57:59.273904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:58:15.277061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 12:58:47.283156 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:04:51.288905 3.001961 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:04:58.296528 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:05:06.298067 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:05:22.300793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:05:54.306790 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:09:02.860437 0.111952 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:09:02.972773 0.114806 tcp 10.0.2.110 49380 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:09:03.118900 0.108322 tcp 10.0.2.110 49381 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:11:58.363348 3.001433 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:12:05.370801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:12:13.372397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:12:29.375039 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:13:01.381139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:19:05.387044 3.002022 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:19:12.394686 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:19:20.396243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:19:37.170409 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:20:09.176671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:26:13.182561 3.001019 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:26:20.189723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:26:28.191622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:26:44.494665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:27:16.500554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:33:20.506559 3.001852 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:33:27.514170 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:33:35.515548 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:33:51.518792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:34:23.524288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:39:03.430057 0.000098 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:39:03.430259 0.116723 tcp 10.0.2.110 49382 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:39:03.576562 0.114922 tcp 10.0.2.110 49383 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 13:40:27.530355 3.001639 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:40:34.537820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:40:42.539902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:40:58.542742 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:41:30.548676 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:47:34.555025 3.001517 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:47:41.882876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:47:49.884241 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:48:05.886924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:48:37.892945 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:54:41.898888 3.001940 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 13:54:48.906553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:54:56.907892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:55:12.911258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 13:55:44.916876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:01:48.922621 3.001667 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:01:55.930710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:02:03.932274 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:02:19.934899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:02:51.940976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:08:55.946773 3.002173 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:09:02.954484 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:09:03.587422 0.000093 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:09:03.587600 0.108469 tcp 10.0.2.110 49384 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:09:03.719982 0.108694 tcp 10.0.2.110 49385 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:09:10.955852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:09:26.958795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:09:58.964872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:16:02.970394 3.001787 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:16:09.978365 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:16:17.979504 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:16:33.982720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:17:05.988889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:23:09.995112 3.001672 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:23:17.002297 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:23:25.004272 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:23:41.006457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:24:13.012683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:30:17.018827 3.001670 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:30:24.025914 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:30:32.028062 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:30:48.030536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:31:20.036667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:37:24.043427 3.001069 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:37:31.049910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:37:39.051448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:37:55.054730 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:38:27.060550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:39:03.594835 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:39:03.595090 0.108606 tcp 10.0.2.110 49386 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:39:03.726876 0.117321 tcp 10.0.2.110 49387 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 14:44:31.066818 3.001259 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:44:38.074372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:44:46.075624 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:45:02.079024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:45:34.085056 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:51:38.090206 3.002576 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:51:45.098497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:51:53.099410 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:52:09.102855 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:52:41.108964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:58:45.114662 3.001812 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 14:58:52.122278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:59:00.123490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:59:16.126997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 14:59:48.132303 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:05:52.138581 3.001897 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:05:59.146594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:06:07.147623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:06:23.150836 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:06:55.156267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:09:03.603507 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:09:03.603677 0.108489 tcp 10.0.2.110 49388 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:09:03.736426 0.106262 tcp 10.0.2.110 49389 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:09:05.288016 0.009845 udp 10.0.2.110 65489 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 15:09:05.298501 0.116176 tcp 10.0.2.110 49390 -> 37.19.5.65 80 FSPA* 0 0 13 5481 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:12:59.162609 3.001871 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:13:06.169830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:13:14.171511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:13:30.174635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:14:02.191018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:20:06.197144 3.001059 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:20:13.203681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:20:21.205199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:20:37.208399 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:21:09.214845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:27:13.221361 3.001353 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:27:20.227666 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:27:28.229490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:27:44.232128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:28:16.238553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:34:20.244622 3.001609 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:34:27.251592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:34:35.253640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:34:51.256727 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:35:23.262746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:39:03.611258 0.000127 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:39:03.611479 0.108409 tcp 10.0.2.110 49391 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:39:03.748102 0.106162 tcp 10.0.2.110 49392 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 15:41:27.268172 3.001726 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:41:34.275553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:41:42.277746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:41:58.280416 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:42:30.286546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:48:34.292918 3.000844 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:48:41.299528 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:48:49.301042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:49:05.304168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:49:37.310781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:55:41.316371 3.001863 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 15:55:48.323706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:55:56.325521 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:56:12.328057 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 15:56:44.334015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:02:48.339883 3.002368 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:02:55.347793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:03:03.349380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:03:19.352424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:03:51.358283 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:09:03.619371 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:09:03.619545 0.114835 tcp 10.0.2.110 49393 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:09:03.758102 0.114965 tcp 10.0.2.110 49394 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:09:55.364827 3.001215 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:10:02.372126 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:10:10.373622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:10:26.376147 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:10:58.382204 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:17:02.388230 3.001430 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:17:09.395371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:17:17.397378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:17:33.400498 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:18:05.406419 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:24:09.411604 3.002282 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:24:16.419514 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:24:24.421632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:24:40.424791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:25:12.430044 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:31:16.436878 3.000884 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:31:23.443451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:31:31.445099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:31:47.448287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:32:19.454565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:38:23.459676 3.002343 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:38:30.467984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:38:38.469262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:38:54.471786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:39:03.628823 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:39:03.629083 0.115302 tcp 10.0.2.110 49395 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:39:03.775418 0.106230 tcp 10.0.2.110 49396 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 16:39:26.477809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:45:30.484431 3.001090 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:45:37.491524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:45:45.492905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:46:01.496544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:46:33.502606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:52:37.508983 3.000935 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:52:44.515190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:52:52.516881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:53:08.519961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:53:40.525874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:59:44.531919 3.003755 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 16:59:51.541876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 16:59:59.541087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:00:15.543827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:00:47.549880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:06:51.555640 3.002227 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:06:58.563151 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:07:06.565217 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:07:22.568215 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:07:54.573799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:09:03.006711 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:09:03.006859 0.010243 udp 10.0.2.110 60704 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/02 17:09:03.017675 0.174220 tcp 10.0.2.110 49397 -> 37.19.5.22 80 SPA_* 0 0 27 17520 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:09:03.634550 0.010400 udp 10.0.2.110 56284 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/02 17:09:03.645393 0.116870 tcp 10.0.2.110 49398 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:09:03.786007 0.114880 tcp 10.0.2.110 49399 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:09:04.525620 0.115203 tcp 10.0.2.110 49400 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:09:33.191148 0.000162 tcp 10.0.2.110 49397 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:09:37.992521 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:13:58.580128 3.001699 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/02 17:14:05.587990 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:14:13.589124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:14:29.592261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:15:01.597719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:21:05.603803 3.001670 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:21:12.611159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:21:20.612814 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:21:36.615726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:22:08.621786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:28:12.628208 3.001287 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:28:19.635302 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:28:27.637084 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:28:43.639603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:29:15.646023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:35:19.652930 3.000775 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:35:26.660238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:35:34.661194 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:35:50.664208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:36:22.669949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:39:03.642919 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:39:03.643082 0.117420 tcp 10.0.2.110 49401 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:39:03.760642 0.000113 tcp 10.0.2.110 49397 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/02 17:39:03.785269 0.108293 tcp 10.0.2.110 49402 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 17:42:26.675983 3.001590 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:42:33.683412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:42:41.685082 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:42:57.688294 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:43:29.693695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:49:33.700196 3.000983 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:49:40.706933 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:49:48.708807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:50:04.712258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:50:36.717687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:56:40.724464 3.001482 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 17:56:47.730920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:56:55.732438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:57:11.735517 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 17:57:43.741527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:03:47.747766 3.001739 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:03:54.755350 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:04:02.756999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:04:18.759827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:04:50.765814 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:09:03.650801 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:09:03.651068 0.115326 tcp 10.0.2.110 49403 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:09:03.797514 0.115069 tcp 10.0.2.110 49404 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:10:54.771204 3.001841 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:11:01.779442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:11:09.780510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:11:25.783992 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:11:57.789690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:18:01.795471 3.002330 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:18:08.803494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:18:16.804972 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:18:32.807466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:19:04.813919 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:25:08.819189 3.002325 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:25:15.827091 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:25:23.829097 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:25:39.831471 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:26:11.837735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:32:15.844403 3.000879 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:32:22.850920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:32:30.852758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:32:46.856284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:33:19.903083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:39:04.169645 0.000068 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:39:04.169782 0.117038 tcp 10.0.2.110 49405 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:39:04.318423 0.117426 tcp 10.0.2.110 49406 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 18:39:27.914941 3.001243 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:39:34.922349 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:39:42.923619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:39:58.926739 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:40:30.933316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:46:35.940370 3.001613 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:46:42.947777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:46:50.949234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:47:06.952626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:47:38.957989 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:54:07.970183 3.001714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 18:54:14.977535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:54:22.979068 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:54:38.982001 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 18:55:10.988665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:01:14.994560 3.001190 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:01:22.001445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:01:30.003231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:01:46.005824 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:02:18.012279 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:08:27.026175 3.001028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:08:34.032908 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:08:42.034368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:08:58.037315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:09:04.178378 0.000094 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:09:04.178766 0.106056 tcp 10.0.2.110 49407 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:09:04.309163 0.117218 tcp 10.0.2.110 49408 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:09:05.803108 0.011437 udp 10.0.2.110 51064 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 19:09:05.815217 0.107105 tcp 10.0.2.110 49409 -> 37.19.5.65 80 FSPA* 0 0 13 5482 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:09:30.043534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:15:38.054970 3.001699 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:15:45.062465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:15:53.063949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:16:09.066755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:16:41.072846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:22:45.078799 3.001696 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:22:52.086415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:23:00.087572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:23:16.090796 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:23:48.097028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:29:52.103067 3.001823 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:29:59.110247 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:30:07.112394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:30:23.115109 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:30:55.121110 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:36:59.126765 3.001733 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:37:06.134425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:37:14.136212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:37:30.139189 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:38:02.144804 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:39:04.185927 0.000086 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:39:04.186102 0.106097 tcp 10.0.2.110 49410 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:39:04.316877 0.105901 tcp 10.0.2.110 49411 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 19:44:06.150463 3.002588 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:44:13.158708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:44:21.159496 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:44:37.163341 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:45:09.168570 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:51:13.174921 3.001687 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:51:20.182053 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:51:28.184384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:51:44.187035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:52:16.192820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:58:20.199859 3.000280 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 19:58:27.206103 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:58:35.207604 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:58:51.210499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 19:59:23.217175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:05:27.222210 3.002251 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:05:34.230173 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:05:42.231725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:05:58.235166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:06:30.240758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:09:04.193713 0.000089 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:09:04.193889 0.117316 tcp 10.0.2.110 49412 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:09:04.335910 0.106151 tcp 10.0.2.110 49413 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:12:34.246951 3.001739 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:12:41.253930 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:12:49.256040 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:13:05.258370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:13:37.264510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:14:03.979419 0.000061 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:14:03.979555 0.009829 udp 10.0.2.110 57014 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 20:14:03.990978 0.134518 tcp 10.0.2.110 49414 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:19:41.270988 3.001423 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:19:48.277837 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:19:56.279882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:20:12.282741 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:20:44.289036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:26:48.294205 3.002175 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:26:55.302122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:27:03.303777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:27:19.306961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:27:51.312450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:33:55.318614 3.001577 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:34:02.326337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:34:10.327503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:34:26.330761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:34:58.336384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:39:04.202468 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:39:04.202580 0.108587 tcp 10.0.2.110 49415 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:39:04.336850 0.115238 tcp 10.0.2.110 49416 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 20:41:02.343092 3.001281 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:41:09.349894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:41:17.351714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:41:33.354540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:42:05.360984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:48:09.368721 3.000080 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:48:16.373668 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:48:24.375565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:48:40.378303 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:49:12.384244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:55:16.391384 3.001065 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 20:55:23.397933 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:55:31.399595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:55:47.402859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 20:56:19.408428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:02:23.414478 3.001395 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:02:30.422275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:02:38.423871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:02:54.426166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:03:26.432707 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:09:04.210184 0.000060 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:09:04.210317 0.108291 tcp 10.0.2.110 49417 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:09:04.343745 0.115244 tcp 10.0.2.110 49418 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:09:30.438534 3.001718 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:09:37.446316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:09:45.447148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:10:01.450313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:10:33.886975 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:16:37.892828 3.001937 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:16:44.900815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:16:52.901856 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:17:08.905275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:17:40.911032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:23:44.917226 3.001345 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:23:51.924379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:23:59.925926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:24:15.929007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:24:47.934970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:30:51.941873 3.000885 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:30:58.948511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:31:06.949701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:31:22.952861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:31:54.958986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:37:58.964818 3.001841 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:38:05.972318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:38:13.973792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:38:29.977207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:39:01.983061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:39:04.428123 0.000071 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:39:04.428274 0.114669 tcp 10.0.2.110 49419 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:39:04.567012 0.108149 tcp 10.0.2.110 49420 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 21:45:05.988607 3.002216 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:45:12.996161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:45:20.997876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:45:37.001238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:46:09.006785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:52:13.013835 3.000698 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:52:20.020373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:52:28.021462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:52:44.024543 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:53:16.691580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:59:20.698710 3.000988 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 21:59:27.705298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:59:35.706744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 21:59:51.709550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:00:23.715940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:06:27.722138 3.001233 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:06:34.729386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:06:42.730962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:06:58.733425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:07:30.739447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:09:04.756520 0.000068 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:09:04.756643 0.105893 tcp 10.0.2.110 49421 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:09:04.886551 0.117692 tcp 10.0.2.110 49422 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:13:34.745344 3.002064 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:13:41.753406 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:13:49.754976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:14:05.757688 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:14:37.763389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:20:41.770624 3.000492 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:20:48.777181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:20:56.778725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:21:12.781493 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:21:44.787901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:27:48.793830 3.001167 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:27:55.801370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:28:03.802522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:28:19.806019 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:28:51.811329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:34:55.817442 3.002270 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:35:02.825287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:35:10.826440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:35:26.829815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:35:58.835877 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:39:04.765338 0.000086 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:39:04.765748 0.117414 tcp 10.0.2.110 49423 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:39:04.908356 0.117200 tcp 10.0.2.110 49424 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 22:42:02.841817 3.001735 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:42:09.849563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:42:17.850378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:42:33.853480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:43:05.859437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:49:09.865697 3.001487 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:49:16.873161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:49:24.874237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:49:40.877171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:50:12.883687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:56:16.889202 3.002208 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 22:56:23.898018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:56:31.899047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:56:47.902864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 22:57:19.907918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:03:23.913254 3.001837 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:03:30.921083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:03:38.922254 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:03:54.925146 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:04:26.931337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:09:04.774197 0.000123 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:09:04.774480 0.117590 tcp 10.0.2.110 49425 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:09:04.919415 0.106127 tcp 10.0.2.110 49426 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:09:06.514780 0.010631 udp 10.0.2.110 63995 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/02 23:09:06.543797 0.135684 tcp 10.0.2.110 49427 -> 37.19.5.65 80 FSPA* 0 0 13 5602 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:10:30.937640 3.001816 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:10:37.945012 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:10:45.946402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:11:01.949836 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:11:33.955599 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:17:37.961537 3.001547 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:17:44.968522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:17:52.970256 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:18:08.973439 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:18:40.979551 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:24:44.985625 3.001356 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:24:51.992605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:24:59.994485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:25:15.997278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:25:48.003212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:31:52.010389 3.000309 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:31:59.016490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:32:07.018561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:32:23.021046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:32:55.027609 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:38:59.033049 3.002076 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:39:04.781420 0.000124 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:39:04.781644 0.106458 tcp 10.0.2.110 49428 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:39:04.914534 0.108292 tcp 10.0.2.110 49429 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/02 23:39:06.040728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:39:14.041948 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:39:30.045061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:40:02.051004 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:46:06.057382 3.001854 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:46:13.065289 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:46:21.066364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:46:37.069464 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:47:09.075524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:53:13.081411 3.001594 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/02 23:53:20.088524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:53:28.090336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:53:44.093426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/02 23:54:16.099447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:00:20.105416 3.001168 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:00:27.112342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:00:35.113866 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:00:51.117393 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:01:23.123280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:07:27.128882 3.001840 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:07:34.136716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:07:42.138014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:07:58.140830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:08:30.147281 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:09:04.788928 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:09:04.789051 0.109620 tcp 10.0.2.110 49430 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:09:04.922525 0.117382 tcp 10.0.2.110 49431 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:14:34.152977 3.001755 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:14:41.160427 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:14:49.162240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:15:05.164935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:15:37.170801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:21:41.176798 3.002172 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:21:48.184782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:21:56.186367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:22:12.189426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:22:44.195243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:28:48.201687 3.001023 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:28:55.208996 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:29:03.209777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:29:19.212870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:29:51.219066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:35:55.225280 3.001721 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:36:02.232199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:36:10.234363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:36:26.237157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:36:58.243437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:39:04.797112 0.000091 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:39:04.797288 0.115109 tcp 10.0.2.110 49432 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:39:04.936493 0.108221 tcp 10.0.2.110 49433 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 00:43:02.248751 3.001600 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:43:09.256366 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:43:17.257773 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:43:33.261344 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:44:05.267181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:50:09.273106 3.001854 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:50:16.280417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:50:24.281924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:50:40.285104 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:51:12.291333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:57:16.296674 3.002274 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 00:57:23.304121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:57:31.305625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:57:47.308695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 00:58:19.315190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:04:23.320914 3.001623 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:04:30.328095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:04:38.329875 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:04:54.333071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:05:26.338940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:09:04.804784 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:09:04.804901 0.105918 tcp 10.0.2.110 49434 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:09:04.944669 0.117450 tcp 10.0.2.110 49435 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:11:30.344945 3.001425 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:11:37.352474 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:11:45.353891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:12:01.356756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:12:33.362708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:18:37.368498 3.002058 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:18:44.375999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:18:52.378016 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:19:08.380447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:19:40.386513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:25:44.392908 3.001896 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:25:51.400143 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:25:59.401867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:26:15.404762 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:26:47.410841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:32:51.416293 3.002123 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:32:58.424697 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:33:06.425622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:33:22.428434 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:33:54.434798 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:39:04.813019 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:39:04.813353 0.108737 tcp 10.0.2.110 49436 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:39:04.947878 0.108337 tcp 10.0.2.110 49437 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 01:39:58.441243 3.001259 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:40:05.447938 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:40:13.449990 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:40:29.452339 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:41:01.458629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:47:05.464638 3.002028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:47:12.471792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:47:20.473548 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:47:36.476459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:48:08.482886 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:54:12.488285 3.372944 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 01:54:19.866386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:54:27.868275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:54:43.871444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 01:55:15.876845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:01:19.883555 3.001556 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:01:26.890967 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:01:34.892218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:01:50.895295 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:02:22.900825 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:08:26.907095 3.001987 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:08:33.914731 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:08:41.916376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:08:57.918987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:09:04.991477 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:09:04.991749 0.118046 tcp 10.0.2.110 49438 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:09:05.138891 0.115177 tcp 10.0.2.110 49439 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:09:29.925638 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:15:33.930887 3.002076 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:15:40.938881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:15:48.939984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:16:04.942986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:16:36.948887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:22:40.955979 3.021066 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:22:47.982607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:22:55.983960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:23:11.987165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:23:44.984408 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:30:13.149085 3.091583 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:30:20.511982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:30:28.471565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:30:44.251720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:31:16.800555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:37:17.803158 2.999878 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:37:24.772052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:37:32.695572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:37:48.467193 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:38:20.026699 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:39:19.558493 0.011400 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:39:19.572803 0.153458 tcp 10.0.2.110 49440 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:39:19.762383 0.118242 tcp 10.0.2.110 49441 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 02:44:43.585508 2.953441 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:44:50.499965 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:44:58.390948 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:45:14.166540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:45:45.728284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:51:43.229653 3.002075 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:51:50.237712 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:51:58.238673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:52:14.241805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:52:46.248322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:58:50.283996 3.001562 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 02:58:57.301952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:59:05.303114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:59:21.307516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 02:59:53.312224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:05:58.319189 3.002105 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:06:05.327141 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:06:13.328503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:06:29.331655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:07:01.337534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:09:07.929991 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:09:07.930256 0.116869 tcp 10.0.2.110 49442 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:08.072815 0.146221 tcp 10.0.2.110 49443 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:08.926829 0.010394 udp 10.0.2.110 51660 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/03 03:09:09.017407 0.569717 tcp 10.0.2.110 49444 -> 37.19.5.22 80 SPA_* 0 0 28 17574 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:11.072878 0.009810 udp 10.0.2.110 51769 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/03 03:09:11.145256 0.142069 tcp 10.0.2.110 49445 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:11.307393 0.009792 udp 10.0.2.110 52533 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 03:09:11.375666 0.327290 tcp 10.0.2.110 49446 -> 37.19.5.65 80 FSPA* 0 0 13 5578 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:39.586734 0.000170 tcp 10.0.2.110 49444 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:09:44.391683 0.000049 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:13:06.905759 3.001857 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/03 03:13:13.913308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:13:21.914284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:13:37.917976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:14:09.923752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:20:13.930621 3.000948 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:20:20.937039 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:20:28.938861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:20:44.941891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:21:16.947657 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:27:30.967650 3.002312 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:27:38.005363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:27:46.006680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:28:02.009846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:28:34.015705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:34:38.022823 3.001326 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:34:45.029716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:34:53.031325 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:35:09.034017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:35:41.042037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:39:08.249543 0.000091 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:39:08.249715 0.106263 tcp 10.0.2.110 49447 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:39:08.356126 0.000039 tcp 10.0.2.110 49444 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 03:39:08.386532 0.108543 tcp 10.0.2.110 49448 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 03:41:45.046020 3.001906 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:41:52.053885 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:42:00.055267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:42:16.057644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:42:48.063725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:48:53.072375 3.000966 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:49:00.078484 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:49:08.080196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:49:24.083278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:49:56.089475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:56:00.095021 3.002145 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 03:56:07.102862 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:56:15.104229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:56:31.106982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 03:57:03.113648 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:03:07.119105 3.001647 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:03:14.126728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:03:22.128485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:03:38.131519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:04:10.137603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:09:08.265346 0.000075 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:09:08.265499 0.105989 tcp 10.0.2.110 49449 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:09:08.395301 0.117927 tcp 10.0.2.110 49450 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:10:14.142955 3.002367 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:10:21.150761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:10:29.151929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:10:45.155625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:11:17.161005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:17:21.169251 2.999787 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:17:28.174840 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:17:36.176181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:17:52.179489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:18:24.185052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:28.191234 3.001868 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:24:35.198353 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:43.200603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:24:59.202846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:25:31.209175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:31:35.216196 3.001156 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:31:42.222620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:31:50.224312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:32:06.227468 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:32:38.233217 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:38:42.239179 3.001957 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:38:49.246298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:38:57.248276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:39:08.265977 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:39:08.266138 0.117565 tcp 10.0.2.110 49451 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:39:08.408860 0.108151 tcp 10.0.2.110 49452 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 04:39:13.251469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:39:45.266859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:45:49.273244 3.001941 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:45:56.280416 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:46:04.282503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:46:20.285101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:46:52.290971 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:52:56.297911 3.000991 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 04:53:03.305222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:53:11.307032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:53:27.309740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 04:53:59.315165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:00:03.322209 3.000214 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:00:10.328845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:00:18.330258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:00:34.333185 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:01:06.338763 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:10.344920 3.001727 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:07:17.352559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:25.353903 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:07:41.356924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:08:13.363143 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:09:08.284561 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:09:08.285013 0.117511 tcp 10.0.2.110 49453 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:09:08.425748 0.117287 tcp 10.0.2.110 49454 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:14:17.370058 3.000805 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:14:24.376616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:14:32.378165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:14:48.381045 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:15:20.387114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:24.393937 3.000714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:21:31.400900 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:39.402267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:21:55.404869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:22:27.410941 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:28:31.417403 3.001334 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:28:38.424699 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:28:46.426071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:29:02.429037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:29:34.435187 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:35:38.441418 3.001468 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:35:45.448193 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:35:53.450184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:36:09.453109 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:36:41.459252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:39:08.291882 0.000080 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:39:08.292041 0.118073 tcp 10.0.2.110 49455 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:39:08.441744 0.115947 tcp 10.0.2.110 49456 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 05:42:45.464849 3.001687 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:42:52.472477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:43:00.473622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:43:16.476899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:43:48.482680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:49:52.488389 3.002455 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:49:59.496234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:50:07.497861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:50:23.501037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:50:55.507549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:56:59.512946 3.001537 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 05:57:06.520412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:57:14.521510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:57:30.524945 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 05:58:02.531037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:04:06.537305 3.000955 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:04:13.544542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:04:21.545502 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:04:37.548425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:05:09.555095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:09:08.299587 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:09:08.300014 0.117522 tcp 10.0.2.110 49457 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:09:08.443381 0.118044 tcp 10.0.2.110 49458 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:11:13.560594 3.002041 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:11:20.567816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:11:28.569522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:11:44.573008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:12:16.848769 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:18:20.855346 3.001542 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:18:27.862330 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:18:35.863758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:18:51.866683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:19:23.873428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:27.878820 3.002227 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:25:34.886434 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:42.888238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:25:58.891026 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:26:30.897462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:32:34.903083 3.001682 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:32:41.910744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:32:49.911839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:33:05.914652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:33:37.920980 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:39:08.478766 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:39:08.479029 0.108616 tcp 10.0.2.110 49459 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:39:08.615012 0.114703 tcp 10.0.2.110 49460 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 06:39:41.928345 3.000059 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:39:48.934566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:39:56.936000 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:40:12.939309 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:40:44.944749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:46:48.950786 3.001825 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:46:55.958096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:47:03.959936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:47:19.963227 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:47:51.968754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:53:55.974714 3.001818 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 06:54:02.982176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:54:10.983976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:54:26.987154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 06:54:59.003195 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:01:03.009787 3.000519 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:01:10.016654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:01:18.017964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:01:34.021085 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:02:06.026997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:10.032752 3.001798 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:08:17.040160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:25.041595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:08:41.044844 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:09:08.486515 0.000092 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:09:08.486695 0.105958 tcp 10.0.2.110 49461 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:09:08.617793 0.114946 tcp 10.0.2.110 49462 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:09:10.972398 0.010187 udp 10.0.2.110 59533 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 07:09:10.983209 0.129885 tcp 10.0.2.110 49463 -> 37.19.5.65 80 FSPA* 0 0 13 5599 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:09:13.050690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:15:17.056990 3.001469 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:15:24.064462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:15:32.065992 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:15:48.069048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:16:20.074485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:22:24.081049 3.001681 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:22:31.088170 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:22:39.089407 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:22:55.092999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:23:27.098640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:29:31.104764 3.001318 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:29:38.111859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:29:46.113566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:30:02.116740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:30:34.123036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:36:38.128398 3.001670 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:36:45.136234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:36:53.137658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:37:09.141189 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:37:41.146518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:39:08.495101 0.000102 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:39:08.495476 0.114952 tcp 10.0.2.110 49464 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:39:08.634352 0.106085 tcp 10.0.2.110 49465 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 07:43:45.153400 3.001337 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:43:52.159805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:44:00.161487 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:44:16.164584 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:44:48.170966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:50:52.176896 3.001529 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:50:59.184323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:51:07.185780 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:51:23.188786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:51:55.195000 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:57:59.200310 3.001854 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 07:58:06.207718 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:58:14.209940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:58:30.212441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 07:59:02.218541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:05:06.224928 3.001369 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:05:13.232116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:05:21.233436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:05:37.236259 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:06:09.242533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:09:08.502604 0.000089 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:09:08.502785 0.115736 tcp 10.0.2.110 49466 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:09:08.642961 0.114900 tcp 10.0.2.110 49467 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:12:13.248345 3.001918 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:12:20.255761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:12:28.257197 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:12:44.260253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:13:16.266838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:19:20.272343 3.001892 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:19:27.279808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:19:35.281627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:19:51.284383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:20:23.290438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:26:27.296346 3.002042 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:26:34.304203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:26:42.305535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:26:58.308458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:27:30.314143 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:33:34.321635 3.000786 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:33:41.327651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:33:49.329404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:34:05.332584 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:34:37.338646 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:39:08.510022 0.000081 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:39:08.510185 0.117125 tcp 10.0.2.110 49468 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:39:08.653315 0.115109 tcp 10.0.2.110 49469 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 08:40:41.345233 3.001160 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:40:48.351540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:40:56.353386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:41:12.356403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:41:44.362106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:47:48.368207 3.001508 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:47:55.375606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:48:03.377017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:48:19.380127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:48:51.386398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:54:55.392655 3.001162 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 08:55:02.399552 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:55:10.401144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:55:26.404123 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 08:55:58.410323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:02:02.416537 3.001088 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:02:09.423803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:02:17.425566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:02:33.428597 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:03:05.434334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:09:08.519309 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:09:08.519661 0.117130 tcp 10.0.2.110 49470 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:09:08.667833 0.106643 tcp 10.0.2.110 49471 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:09:09.441611 3.000408 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:09:16.447526 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:09:24.449098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:09:40.452378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:10:12.478238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:16:16.484748 3.001341 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:16:23.492244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:16:31.493889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:16:47.496689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:17:19.502252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:23:23.507847 3.002119 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:23:30.515524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:23:38.517373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:23:54.520343 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:24:26.526452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:30:30.531571 3.001966 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:30:37.539692 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:30:45.540971 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:31:01.544521 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:31:33.550449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:37:37.556495 3.001188 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:37:44.563262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:37:52.565491 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:38:08.567778 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:38:40.573915 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:39:08.546462 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:39:08.546722 0.116756 tcp 10.0.2.110 49472 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:39:08.690331 0.117759 tcp 10.0.2.110 49473 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 09:44:44.579943 3.001562 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:44:51.587383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:44:59.588968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:45:15.591857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:45:47.598374 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:51:51.604793 3.000707 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:51:58.611803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:52:06.612952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:52:22.616159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:52:54.622103 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:58:58.628303 3.001627 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 09:59:05.635326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:59:13.636932 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 09:59:29.639864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:00:01.646094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:06:05.712334 3.001809 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:06:12.719724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:06:20.720796 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:06:36.723994 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:07:08.730046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:09:08.573861 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:09:08.574016 0.106389 tcp 10.0.2.110 49474 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:09:08.704936 0.117322 tcp 10.0.2.110 49475 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:13:12.736756 3.000891 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:13:19.743325 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:13:27.745050 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:13:43.747792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:14:15.753859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:20:19.760860 3.000675 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:20:26.767791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:20:34.769280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:20:50.771888 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:21:22.777967 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:27:26.786373 2.999582 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:27:33.791715 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:27:41.793057 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:27:57.795614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:28:29.802203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:34:33.808010 3.001594 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:34:40.815779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:34:48.816854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:35:04.820235 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:35:36.826018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:39:08.582015 0.000046 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:39:08.582266 0.108323 tcp 10.0.2.110 49476 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:39:08.715090 0.108966 tcp 10.0.2.110 49477 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 10:41:40.831723 3.002374 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:41:47.839650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:41:55.841210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:42:11.844391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:42:43.849833 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:48:47.855477 3.002057 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:48:54.863098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:49:02.864884 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:49:18.867816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:49:50.873984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:55:54.879673 3.001697 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 10:56:01.887507 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:56:09.968775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:56:25.972175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 10:56:57.977614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:03:01.985178 3.000554 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:03:08.991229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:03:16.992641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:03:32.995996 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:04:05.002194 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:09:08.627963 0.000043 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:09:08.628234 0.115106 tcp 10.0.2.110 49478 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:09:08.769345 0.117131 tcp 10.0.2.110 49479 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:09:11.288416 0.010617 udp 10.0.2.110 58266 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 11:09:11.315866 0.121949 tcp 10.0.2.110 49480 -> 37.19.5.65 80 FSPA* 0 0 13 5568 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:10:09.008745 3.000799 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:10:16.015793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:10:24.017229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:10:40.019994 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:11:12.025569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:17:16.032813 3.000619 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:17:23.039329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:17:31.041410 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:17:47.044090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:18:19.049887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:24:23.055845 3.001380 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:24:30.063262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:24:38.064944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:24:54.067641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:25:26.076463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:31:30.079742 3.001830 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:31:37.087494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:31:45.088849 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:32:01.092034 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:32:33.097539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:38:37.104154 3.001839 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:38:44.111192 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:38:52.112569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:39:08.115893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:39:08.629062 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:39:08.629244 0.117770 tcp 10.0.2.110 49481 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:08.777103 0.117115 tcp 10.0.2.110 49482 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 11:39:40.121516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:45:44.127973 3.001213 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:45:51.134858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:45:59.136869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:46:15.140067 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:46:47.145944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:52:51.151295 3.002004 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 11:52:58.159516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:53:06.160830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:53:22.163998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:53:54.169999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 11:59:58.176148 3.001672 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:00:05.183450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:00:13.184516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:00:29.187473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:01:01.193359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:07:05.199984 3.001661 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:07:12.207324 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:07:20.208849 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:07:36.211614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:08:08.217868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:09:08.636603 0.000073 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:09:08.636754 0.117133 tcp 10.0.2.110 49483 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:09:08.784572 0.117090 tcp 10.0.2.110 49484 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:14:12.223244 3.001914 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:14:19.230966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:14:27.232597 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:14:43.235427 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:15:15.241412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:21:19.247545 3.001794 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:21:26.255326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:21:34.256396 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:21:50.259786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:22:22.265707 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:28:26.271767 3.001129 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:28:33.279012 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:28:41.280432 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:28:57.283508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:29:29.290176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:35:33.296993 3.000355 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:35:40.303173 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:35:48.304145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:36:04.307087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:36:36.313374 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:39:08.645522 0.000189 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:39:08.645811 0.117500 tcp 10.0.2.110 49485 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:39:08.788600 0.114790 tcp 10.0.2.110 49486 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 12:42:40.320692 3.000703 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:42:47.327124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:42:55.328662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:43:11.331425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:43:43.337338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:49:47.343542 3.001647 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:49:54.351128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:50:02.352153 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:50:18.355210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:50:50.361857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:56:54.367407 3.001832 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 12:57:01.375020 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:57:09.376317 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:57:25.379413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 12:57:57.385506 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:04:01.391714 3.001611 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:04:08.398647 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:04:16.400221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:04:32.403092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:05:04.411086 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:09:08.184009 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:09:08.184176 0.009975 udp 10.0.2.110 56430 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/03 13:09:08.212079 0.311681 tcp 10.0.2.110 49487 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:09:08.729399 0.010199 udp 10.0.2.110 49520 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/03 13:09:08.740071 0.108357 tcp 10.0.2.110 49488 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:09:08.873890 0.115252 tcp 10.0.2.110 49489 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:09:12.060434 0.154808 tcp 10.0.2.110 49490 -> 37.19.5.31 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:09:38.468816 0.000192 tcp 10.0.2.110 49487 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:09:43.179855 0.000068 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:11:08.415157 3.002206 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/03 13:11:15.422604 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:11:23.423922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:11:39.427336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:12:11.433714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:18:15.439653 3.001839 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:18:22.446469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:18:30.458073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:18:46.461066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:19:18.467546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:25:22.473432 3.001525 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:25:29.481122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:25:37.481877 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:25:53.484963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:26:25.491616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:32:29.498373 3.000934 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:32:36.504394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:32:44.506040 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:33:00.509668 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:33:32.515412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:39:08.661198 0.000093 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:39:08.661372 0.115584 tcp 10.0.2.110 49491 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:39:08.777144 0.000048 tcp 10.0.2.110 49487 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 13:39:08.810584 0.108183 tcp 10.0.2.110 49492 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 13:39:36.520830 3.001714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:39:43.528565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:39:51.529870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:40:07.533566 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:40:39.540041 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:46:43.545703 3.001561 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:46:50.552592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:46:58.554347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:47:14.556893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:47:46.562808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:53:50.569779 3.000814 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 13:53:57.576697 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:54:05.578204 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:54:21.581089 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 13:54:53.586931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:00:57.592775 3.002212 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:01:04.600675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:01:12.601858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:01:28.605492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:02:00.611357 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:08:04.617026 3.001898 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:08:11.624605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:08:19.625939 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:08:35.628793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:09:07.634911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:09:08.669167 0.000090 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:09:08.669362 0.115049 tcp 10.0.2.110 49493 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:09:08.816168 0.115394 tcp 10.0.2.110 49494 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:15:11.641931 3.001001 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:15:18.648379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:15:26.649751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:15:42.653192 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:16:14.658674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:22:18.665024 3.001277 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:22:25.672098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:22:33.673757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:22:50.398019 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:23:22.403761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:29:26.410176 3.001300 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:29:33.417578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:29:41.418870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:29:57.422108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:30:29.428070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:36:33.434534 3.000877 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:36:40.441392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:36:48.443308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:37:04.446250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:37:36.452052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:39:09.027227 0.000132 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:39:09.027446 0.106108 tcp 10.0.2.110 49495 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:39:09.158606 0.108341 tcp 10.0.2.110 49496 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 14:43:40.457570 3.001968 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:43:47.465407 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:43:55.466557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:44:11.469764 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:44:43.476348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:50:47.481782 3.001869 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:50:54.489116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:51:02.491236 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:51:18.493629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:51:50.499541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:57:54.505620 3.001708 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 14:58:01.513211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:58:09.514887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:58:25.517467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 14:58:57.523735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:05:01.530013 3.001679 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:05:08.537120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:05:16.538660 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:05:32.541605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:06:04.547696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:09:09.035389 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:09:09.035485 0.117576 tcp 10.0.2.110 49497 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:09:09.178532 0.115312 tcp 10.0.2.110 49498 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:09:11.521506 0.009778 udp 10.0.2.110 59533 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 15:09:11.532085 0.107563 tcp 10.0.2.110 49499 -> 37.19.5.65 80 FSPA* 0 0 13 5625 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:12:08.553367 3.002196 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:12:15.561674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:12:23.562392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:12:39.565590 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:13:11.571425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:19:15.577362 3.002096 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:19:22.585192 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:19:30.586596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:19:46.589902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:20:18.596145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:26:22.601514 3.002156 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:26:29.609447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:26:37.610684 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:26:53.614033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:27:25.619688 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:33:29.626036 3.001173 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:33:36.633385 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:33:44.634656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:34:00.637989 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:34:32.643789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:39:09.043055 0.000100 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:39:09.043241 0.114977 tcp 10.0.2.110 49500 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:39:09.197830 0.115261 tcp 10.0.2.110 49501 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 15:40:36.650267 3.001083 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:40:43.657199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:40:51.658572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:41:07.661726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:41:39.667497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:47:43.673036 3.001946 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:47:50.680867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:47:58.682251 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:48:14.685952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:48:46.691261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:54:50.697546 3.001947 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 15:54:57.705071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:55:05.706449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:55:21.709328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 15:55:53.715336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:01:57.721412 3.001959 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:02:04.728617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:02:12.730340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:02:28.733137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:03:00.740030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:09:04.745346 3.001972 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:09:09.060561 0.000170 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:09:09.060812 0.108515 tcp 10.0.2.110 49502 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:09:09.194732 0.117326 tcp 10.0.2.110 49503 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:09:11.753249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:09:19.754631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:09:35.757252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:10:07.763601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:16:11.769963 3.001565 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:16:18.777372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:16:26.778275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:16:42.781466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:17:14.787678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:23:18.793620 3.001764 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:23:25.800588 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:23:33.802221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:23:49.805196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:24:21.811372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:30:26.818534 3.001632 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:30:33.826663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:30:41.827765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:30:57.830994 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:31:29.836867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:37:33.842443 3.001894 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:37:40.850257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:37:48.851968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:38:04.854418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:38:36.861136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:39:09.540631 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:39:09.541018 0.106266 tcp 10.0.2.110 49504 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:39:09.672332 0.108237 tcp 10.0.2.110 49505 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 16:44:40.867584 3.000855 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:44:47.874251 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:44:55.875901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:45:11.878445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:45:43.885058 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:51:47.890978 3.001266 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:51:54.897876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:52:02.899542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:52:18.902921 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:52:50.908380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:58:54.915062 3.001142 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 16:59:01.921799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:59:09.923599 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:59:25.926782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 16:59:57.932925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:06:01.939147 3.001131 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:06:08.945875 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:06:16.947543 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:06:32.950472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:07:04.956795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:09:09.547680 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:09:09.548035 0.116942 tcp 10.0.2.110 49506 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:09:09.698580 0.117186 tcp 10.0.2.110 49507 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:13:08.962898 3.001521 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:13:15.969884 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:13:23.971450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:13:39.974858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:14:11.980463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:20:15.986401 3.001549 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:20:22.993982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:20:30.995661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:20:46.998687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:21:19.004592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:27:23.012666 3.000069 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:27:30.017868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:27:38.019472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:27:54.022427 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:28:26.028754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:34:30.034737 3.001677 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:34:37.041800 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:34:45.043444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:35:01.046543 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:35:33.052632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:39:09.556013 0.000274 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:39:09.556396 0.107912 tcp 10.0.2.110 49508 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:39:09.688589 0.116955 tcp 10.0.2.110 49509 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 17:41:37.060071 2.999785 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:41:44.066328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:41:52.067215 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:42:08.070254 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:42:40.076890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:48:44.084269 3.000130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:48:51.090007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:48:59.091788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:49:15.094549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:49:47.100935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:55:51.106942 3.000863 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 17:55:58.113738 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:56:06.115104 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:56:22.118029 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 17:56:54.124376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:02:58.130358 3.001865 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:03:05.137899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:03:13.139687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:03:29.142368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:04:01.148469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:09:09.564207 0.000109 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:09:09.564399 0.108248 tcp 10.0.2.110 49510 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:09:09.698201 0.105661 tcp 10.0.2.110 49511 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:10:05.153936 3.002328 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:10:12.162158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:10:20.163587 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:10:36.166378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:11:08.172819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:17:12.178597 3.001257 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:17:19.186155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:17:27.187333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:17:43.190212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:18:15.195990 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:24:19.201942 3.001961 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:24:26.210064 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:24:34.213824 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:24:50.213939 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:25:22.220159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:26.226036 3.002076 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:31:33.233612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:41.235307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:31:57.238387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:32:29.244518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:38:33.250377 3.001747 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:38:40.257486 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:38:48.259491 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:39:04.261993 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:39:09.571610 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:39:09.571703 0.117306 tcp 10.0.2.110 49512 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:39:09.713549 0.115340 tcp 10.0.2.110 49513 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 18:39:36.268139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:45:40.274086 3.001633 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:45:47.281632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:45:55.283048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:46:11.285788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:46:43.292236 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:52:47.298201 3.001828 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 18:52:54.305755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:53:02.307244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:53:18.310150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:53:50.316030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 18:59:54.321974 3.001970 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:00:01.329998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:00:09.330899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:00:25.333881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:00:57.340480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:07:01.346780 3.000849 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:07:08.353452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:07:16.355106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:07:32.358260 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:08:04.363774 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:09:09.580127 0.000113 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:09:09.580345 0.117187 tcp 10.0.2.110 49514 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:09:09.727841 0.105760 tcp 10.0.2.110 49515 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:09:12.007316 0.010724 udp 10.0.2.110 53291 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 19:09:12.018786 0.118792 tcp 10.0.2.110 49516 -> 37.19.5.65 80 FSPA* 0 0 13 5615 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:14:08.370939 3.001820 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:14:15.377867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:14:23.378842 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:14:39.382412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:15:11.388054 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:15.393869 3.002074 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:21:22.401880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:30.402695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:21:46.405930 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:22:18.411787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:28:22.417751 3.001990 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:28:29.425074 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:28:37.427259 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:28:53.429952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:29:25.436258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:35:29.441899 3.002180 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:35:36.449048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:35:44.451023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:36:00.453940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:36:32.460058 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:39:09.587783 0.000086 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:39:09.587989 0.108405 tcp 10.0.2.110 49517 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:39:09.720162 0.108443 tcp 10.0.2.110 49518 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 19:42:36.465388 3.002376 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:42:43.473211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:42:51.474648 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:43:07.477562 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:43:39.483850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:49:43.489823 3.001626 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:49:50.497574 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:49:58.498820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:50:14.501852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:50:46.507774 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:56:50.513930 3.001827 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 19:56:57.521280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:57:05.523001 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:57:21.525994 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 19:57:53.532174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:03:57.538638 3.001023 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:04:04.545607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:04:12.546892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:04:28.549555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:05:00.555870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:09:09.596077 0.000044 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:09:09.596175 0.117085 tcp 10.0.2.110 49519 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:09:09.740052 0.115072 tcp 10.0.2.110 49520 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:11:04.562025 3.001094 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:11:11.569168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:11:19.570451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:11:35.573917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:12:07.579856 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:14:09.744177 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:14:09.744273 0.010259 udp 10.0.2.110 58240 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 20:14:09.756264 0.129557 tcp 10.0.2.110 49521 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:18:11.586817 3.000760 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:18:18.592998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:18:26.594436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:18:42.597533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:19:14.603895 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:18.609987 3.001283 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:25:25.617602 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:33.619111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:25:49.621860 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:26:21.628006 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:25.633404 3.001794 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:32:32.641284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:40.642961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:32:56.645308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:33:28.651825 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:39:09.604615 0.000131 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:39:09.604848 0.117305 tcp 10.0.2.110 49522 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:39:09.747010 0.106013 tcp 10.0.2.110 49523 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 20:39:32.657697 3.001575 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:39:39.665282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:39:47.666619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:40:03.669948 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:40:35.675503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:46:39.681977 3.001287 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:46:46.689234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:46:54.690678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:47:10.693770 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:47:42.699366 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:53:46.705361 3.001692 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 20:53:53.713080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:54:01.714797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:54:17.717579 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 20:54:49.723838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:00:53.729711 3.001521 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:01:00.737298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:01:08.738698 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:01:24.741493 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:01:56.749262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:08:00.753348 3.001823 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:08:07.761415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:08:15.762724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:08:31.765494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:09:03.771736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:09:09.611626 0.000075 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:09:09.611780 0.117117 tcp 10.0.2.110 49524 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:09:09.754946 0.114645 tcp 10.0.2.110 49525 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:15:07.777213 3.001827 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:15:14.785091 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:15:22.786800 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:15:38.789707 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:16:10.795535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:22:14.801349 3.001577 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:22:21.808573 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:22:29.810554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:22:45.813871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:23:17.819640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:29:21.826554 3.000757 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:29:28.832807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:29:36.834605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:29:52.837592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:30:24.843430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:36:28.849100 3.001580 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:36:35.856981 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:36:43.858012 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:36:59.861553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:37:31.867726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:39:09.619457 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:39:09.619610 0.117420 tcp 10.0.2.110 49526 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:39:09.761166 0.115095 tcp 10.0.2.110 49527 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 21:43:35.873404 3.001425 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:43:42.880671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:43:50.882137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:44:06.885793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:44:38.891036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:50:42.897103 3.002070 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:50:49.905019 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:50:57.906498 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:51:13.909417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:51:45.915328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:57:49.921425 3.001181 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 21:57:56.928431 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:58:04.929958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:58:20.933556 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 21:58:52.939540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:04:56.946175 3.000749 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:05:03.952620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:05:11.953962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:05:27.957136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:05:59.963271 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:09:09.628232 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:09:09.628527 0.115045 tcp 10.0.2.110 49528 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:09:09.769469 0.115720 tcp 10.0.2.110 49529 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:12:03.971082 3.000102 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:12:10.976968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:12:18.977801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:12:34.981145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:13:06.987003 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:19:10.992871 3.001928 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:19:18.000582 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:19:26.002426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:19:42.004830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:20:14.011367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:26:18.016907 3.002195 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:26:25.024492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:26:33.026271 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:26:49.029496 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:27:21.035333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:33:25.041473 3.001231 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:33:32.048560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:33:40.049706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:33:56.053140 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:34:28.058936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:39:09.635730 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:39:09.635890 0.114728 tcp 10.0.2.110 49530 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:39:09.776127 0.115073 tcp 10.0.2.110 49531 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 22:40:32.064763 3.001746 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:40:39.072541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:40:47.073765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:41:03.077314 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:41:35.083149 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:47:40.582131 3.000595 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:47:47.588997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:47:55.589798 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:48:11.593321 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:48:43.599475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:54:47.605316 3.001736 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 22:54:54.612724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:55:02.613833 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:55:18.616881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 22:55:50.623139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:01:54.629076 3.002085 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:02:01.636372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:02:09.637709 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:02:25.641026 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:02:57.647037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:09:01.653022 3.001650 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:09:08.660693 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:09:09.275604 0.000086 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:09:09.275861 0.009944 udp 10.0.2.110 50051 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/03 23:09:09.286378 0.164689 tcp 10.0.2.110 49532 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:10.374957 0.010371 udp 10.0.2.110 52767 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/03 23:09:10.385792 0.118418 tcp 10.0.2.110 49533 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:10.535212 0.106148 tcp 10.0.2.110 49534 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:12.741312 0.009746 udp 10.0.2.110 58978 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/03 23:09:12.751613 0.116246 tcp 10.0.2.110 49535 -> 37.19.5.65 80 FSPA* 0 0 13 5718 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:13.850077 0.009745 udp 10.0.2.110 58886 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/03 23:09:13.860387 0.106107 tcp 10.0.2.110 49536 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:16.661723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:09:32.664851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:09:39.451019 0.000183 tcp 10.0.2.110 49532 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:09:44.231270 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:10:04.670788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:16:08.677313 3.001512 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:16:15.684352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:16:23.686292 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:16:39.688888 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:17:11.695367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:23:15.700754 3.002260 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:23:22.708612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:23:30.709910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:23:46.713065 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:24:18.718877 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:30:22.725033 3.001291 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:30:29.732619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:30:37.733937 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:30:53.736557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:31:25.743061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:37:29.748589 3.002178 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:37:36.756745 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:37:44.757851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:38:00.760900 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:38:32.767157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:39:10.382959 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:39:10.383128 0.116886 tcp 10.0.2.110 49537 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:39:10.500209 0.000052 tcp 10.0.2.110 49532 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/03 23:39:10.531337 0.115109 tcp 10.0.2.110 49538 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/03 23:44:36.773292 3.001131 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:44:43.780522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:44:51.782147 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:45:07.784558 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:45:39.790675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:51:43.796884 3.001524 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:51:50.804549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:51:58.805791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:52:14.809044 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:52:46.814884 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:58:50.821670 3.000883 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/03 23:58:57.828553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:59:05.829481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:59:21.832408 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/03 23:59:53.838971 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:05:57.844232 3.001849 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:06:04.852398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:06:12.854033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:06:28.857235 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:07:00.862935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:09:10.391152 0.000117 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:09:10.391353 0.117302 tcp 10.0.2.110 49539 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:09:10.533084 0.117529 tcp 10.0.2.110 49540 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:13:04.869767 3.000839 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:13:11.876209 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:13:19.877330 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:13:35.880433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:14:07.886404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:20:11.893178 3.000864 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:20:18.899792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:20:26.901807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:20:42.904964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:21:14.910356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:27:18.916116 3.002250 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:27:25.923814 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:27:33.925613 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:27:49.929024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:28:21.934882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:34:25.941593 3.000696 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:34:32.948448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:34:40.949955 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:34:56.952343 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:35:28.958760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:39:10.398856 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:39:10.399028 0.117290 tcp 10.0.2.110 49541 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:39:10.548180 0.117516 tcp 10.0.2.110 49542 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 00:41:32.964126 3.002101 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:41:39.971727 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:41:47.973887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:42:03.976572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:42:35.982890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:48:39.989503 3.000392 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:48:46.995676 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:48:54.997607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:49:11.000424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:49:43.006466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:55:47.013282 3.000722 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 00:55:54.019991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:56:02.021725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:56:18.024520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 00:56:50.030964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:02:54.036732 3.001134 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:03:01.043781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:03:09.045766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:03:25.048228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:03:57.054678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:09:10.406953 0.000067 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:09:10.407065 0.106059 tcp 10.0.2.110 49543 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:09:10.543673 0.106344 tcp 10.0.2.110 49544 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:10:01.060360 3.001451 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:10:08.067601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:10:16.069525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:10:32.072777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:11:04.078449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:17:08.085365 3.000742 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:17:15.091751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:17:23.093153 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:17:39.097097 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:18:11.102624 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:24:15.109115 3.000732 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:24:22.116210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:24:30.117635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:24:46.120331 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:25:18.126167 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:31:22.131909 3.002205 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:31:29.139715 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:31:37.141083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:31:53.144692 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:32:25.150310 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:38:29.157067 3.000902 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:38:36.163578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:38:44.165420 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:39:00.168520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:39:10.414826 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:39:10.415000 0.106192 tcp 10.0.2.110 49545 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:39:10.547961 0.117338 tcp 10.0.2.110 49546 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 01:39:32.173984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:45:36.180234 3.001369 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:45:43.187544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:45:51.189003 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:46:07.192228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:46:39.198433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:52:43.205101 3.001114 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:52:50.211344 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:52:58.213593 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:53:14.216210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:53:46.222046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 01:59:50.228618 3.001095 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 01:59:57.235318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:00:05.237360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:00:21.240220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:00:53.246262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:06:57.252143 3.001748 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:07:04.260007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:07:12.261435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:07:28.264184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:08:00.270030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:09:10.423019 0.000047 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:09:10.423113 0.106064 tcp 10.0.2.110 49547 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:09:10.558469 0.117059 tcp 10.0.2.110 49548 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:14:04.276653 3.000808 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:14:11.283462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:14:19.284881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:14:35.288496 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:15:07.294198 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:21:11.300519 3.001413 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:21:18.308047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:21:26.309339 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:21:42.312259 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:22:14.317785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:28:18.323855 3.001748 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:28:25.331604 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:28:33.332789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:28:49.335719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:29:21.342296 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:35:25.349259 3.000701 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:35:32.355799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:35:40.356644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:35:56.359766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:36:28.366110 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:39:10.431238 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:39:10.431614 0.105894 tcp 10.0.2.110 49549 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:39:10.562603 0.117373 tcp 10.0.2.110 49550 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 02:42:32.373161 3.000846 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:42:39.379786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:42:47.383081 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:43:03.383960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:43:35.389726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:49:39.396602 3.001442 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:49:46.403297 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:49:54.404724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:50:10.407834 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:50:42.413839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:56:46.420342 3.000929 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 02:56:53.427017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:57:01.429182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:57:17.431997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 02:57:49.437960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:03:53.444014 3.001611 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:04:00.450991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:04:08.453016 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:04:24.455869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:04:56.461691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:09:10.438971 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:09:10.439078 0.106080 tcp 10.0.2.110 49551 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:09:10.569839 0.117458 tcp 10.0.2.110 49552 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:09:14.104544 0.010165 udp 10.0.2.110 59514 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 03:09:14.168591 0.129521 tcp 10.0.2.110 49553 -> 37.19.5.65 80 FSPA* 0 0 13 5731 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:11:00.467659 3.001807 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:11:07.475644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:11:15.476457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:11:31.479681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:12:03.485881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:18:07.492812 3.001367 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:18:14.499360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:18:22.500978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:18:38.504271 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:19:10.509968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:25:14.516628 3.001173 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:25:21.523316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:25:29.525075 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:25:45.527403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:26:17.533552 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:32:21.540445 3.001121 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:32:28.547005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:32:36.548454 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:32:52.551634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:33:24.557754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:39:10.447467 0.000066 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:39:10.447588 0.115285 tcp 10.0.2.110 49554 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:39:10.605725 0.117833 tcp 10.0.2.110 49555 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 03:39:28.563678 3.001775 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:39:35.570859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:39:43.572751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:39:59.576085 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:40:31.581641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:46:35.588593 3.001205 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:46:42.594998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:46:50.596482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:47:06.599813 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:47:38.605923 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:53:42.611584 3.001722 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 03:53:49.619319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:53:57.620724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:54:13.623898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 03:54:45.629508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:00:49.635260 3.002133 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:00:56.643117 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:01:04.644667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:01:20.647702 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:01:52.653458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:07:56.659396 3.002110 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:08:03.666893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:08:11.668486 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:08:27.671622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:08:59.677529 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:09:10.469805 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:09:10.470177 0.115067 tcp 10.0.2.110 49556 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:09:10.616463 0.105912 tcp 10.0.2.110 49557 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:15:03.683425 3.001769 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:15:10.691267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:15:18.692777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:15:34.695866 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:16:06.701377 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:22:10.707547 3.001843 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:22:17.714839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:22:25.716152 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:22:41.719532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:23:13.725736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:29:17.731159 3.002101 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:29:24.738603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:29:32.740190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:29:48.743578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:30:20.749373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:36:24.755185 3.001655 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:36:31.762684 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:36:39.764213 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:36:55.767111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:37:27.773472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:39:10.463732 0.000104 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:39:10.463942 0.115378 tcp 10.0.2.110 49558 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:39:10.606228 0.117268 tcp 10.0.2.110 49559 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 04:43:31.779439 3.001832 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:43:38.786504 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:43:46.788644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:44:02.791731 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:44:34.797470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:50:38.804593 3.000730 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:50:45.811101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:50:53.812345 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:51:09.815174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:51:41.821470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:57:45.828462 3.000494 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 04:57:52.835210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:58:00.836219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:58:16.838969 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 04:58:48.845625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:04:52.851268 3.001975 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:04:59.858515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:05:07.860014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:05:23.863371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:05:55.869218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:09:10.471694 0.000074 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:09:10.472062 0.115073 tcp 10.0.2.110 49560 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:09:10.619362 0.108687 tcp 10.0.2.110 49561 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:11:59.876245 3.000887 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:12:06.882931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:12:14.884094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:12:30.887126 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:13:02.893680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:19:06.899435 3.001578 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:19:13.906958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:19:21.908031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:19:37.911244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:20:09.917425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:26:13.923538 3.001080 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:26:20.930410 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:26:28.932238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:26:44.935011 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:27:16.941257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:33:20.947127 3.001826 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:33:27.954909 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:33:35.955791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:33:51.959068 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:34:23.964808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:39:10.479308 0.000104 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:39:10.479503 0.108276 tcp 10.0.2.110 49562 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:39:10.618739 0.106903 tcp 10.0.2.110 49563 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 05:40:27.971004 3.002011 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:40:34.978904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:40:42.980446 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:40:58.983124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:41:30.989276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:47:34.994954 3.002090 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:47:42.002558 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:47:50.004383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:48:06.007019 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:48:38.013245 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:54:42.019055 3.002062 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 05:54:49.026639 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:54:57.027813 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:55:13.030821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 05:55:45.036934 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:01:49.042893 3.002113 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:01:56.050147 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:02:04.052416 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:02:20.055319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:02:52.061407 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:08:56.067160 3.001340 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:09:03.074781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:09:10.487265 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:09:10.487361 0.115437 tcp 10.0.2.110 49564 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:09:10.634593 0.115325 tcp 10.0.2.110 49565 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:09:11.076148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:09:27.078889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:09:59.085258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:16:03.092080 3.001727 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:16:10.100605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:16:18.100079 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:16:34.103266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:17:06.108803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:23:10.115510 3.001310 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:23:17.122394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:23:25.123519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:23:41.127061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:24:13.133222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:30:17.139070 3.001233 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:30:24.146316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:30:32.148023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:30:48.150541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:31:20.156883 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:37:24.162209 3.002723 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:37:31.169937 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:37:39.171620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:37:55.174899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:38:27.180575 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:39:10.496001 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:39:10.496352 0.116823 tcp 10.0.2.110 49566 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:39:10.639030 0.114635 tcp 10.0.2.110 49567 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 06:44:31.186880 3.001388 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:44:38.194635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:44:46.195725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:45:02.198719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:45:34.204869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:51:38.211815 3.001058 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:51:45.217894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:51:53.219464 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:52:09.222902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:52:41.228743 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:58:45.234947 3.001842 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 06:58:52.241840 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:59:00.243634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:59:16.246560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 06:59:48.252546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:05:52.259461 3.000948 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:05:59.266319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:06:07.267477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:06:23.270636 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:06:55.276503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:09:10.503413 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:09:10.503514 0.117811 tcp 10.0.2.110 49568 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:09:10.648839 0.117825 tcp 10.0.2.110 49569 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:09:13.489871 0.010874 udp 10.0.2.110 63975 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 07:09:13.501409 0.118300 tcp 10.0.2.110 49570 -> 37.19.5.65 80 FSPA* 0 0 13 5711 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:12:59.282196 3.002211 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:13:06.289869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:13:14.291911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:13:30.294689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:14:02.300512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:20:06.306359 3.004378 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:20:13.317104 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:20:21.315664 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:20:37.318978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:21:09.324559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:27:13.330571 3.001380 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:27:20.338481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:27:28.339505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:27:44.342956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:28:16.348346 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:34:20.355721 3.000929 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:34:27.361772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:34:35.363859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:34:51.366188 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:35:23.372824 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:39:10.511461 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:39:10.511633 0.108360 tcp 10.0.2.110 49571 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:39:10.647573 0.105958 tcp 10.0.2.110 49572 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 07:41:27.377962 3.002209 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:41:34.385614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:41:42.387784 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:41:58.390717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:42:30.396181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:48:34.402653 3.001651 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:48:41.409649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:48:49.411339 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:49:05.414733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:49:39.022858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:55:46.032970 3.001986 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 07:55:53.040659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:56:01.042332 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:56:17.045134 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 07:56:49.051171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:02:56.061878 3.001217 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:03:03.069258 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:03:11.070293 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:03:27.073545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:03:59.079653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:09:11.310030 0.000074 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:09:11.310189 0.106119 tcp 10.0.2.110 49573 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:09:11.446476 0.106311 tcp 10.0.2.110 49574 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:10:28.090761 3.002547 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:10:35.098596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:10:43.100649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:10:59.103196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:11:31.109287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:17:35.115598 3.001030 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:17:42.122794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:17:50.123904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:18:06.127009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:18:38.133583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:24:46.145024 3.001880 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:24:53.152148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:25:01.153835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:25:17.157443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:25:49.163008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:31:57.174376 3.002190 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:32:04.182224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:32:12.183577 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:32:28.186615 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:33:00.192835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:39:04.198430 3.002113 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:39:11.205815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:39:11.318078 0.000081 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:39:11.318238 0.114759 tcp 10.0.2.110 49575 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:39:11.464261 0.106353 tcp 10.0.2.110 49576 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 08:39:19.208128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:39:35.210966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:40:07.216316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:46:11.222686 3.001551 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:46:18.230246 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:46:26.231475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:46:42.234922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:47:14.240715 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:53:18.246526 3.001722 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 08:53:25.254253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:53:33.255458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:53:49.258759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 08:54:21.264288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:00:25.270614 3.001895 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:00:32.277910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:00:40.279736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:00:56.282209 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:01:28.288245 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:07:32.295040 3.001382 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:07:39.302033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:07:47.303580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:08:03.306711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:08:35.312379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:09:10.260677 0.000116 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:09:10.260924 0.009602 udp 10.0.2.110 54254 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/04 09:09:10.272075 0.194984 tcp 10.0.2.110 49577 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:11.326562 0.010631 udp 10.0.2.110 58750 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/04 09:09:11.337759 0.117654 tcp 10.0.2.110 49578 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:11.481696 0.105819 tcp 10.0.2.110 49579 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:15.042744 0.126273 tcp 10.0.2.110 49580 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:40.466680 0.000175 tcp 10.0.2.110 49577 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:09:45.022447 0.000050 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:14:39.318734 3.001777 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/04 09:14:46.325736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:14:54.327761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:15:10.330329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:15:42.336172 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:21:46.342609 3.001642 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:21:53.349756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:22:01.351736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:22:17.354518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:22:49.360337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:28:53.366408 3.001380 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:29:00.374125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:29:08.375718 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:29:24.378274 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:29:56.384238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:36:00.391262 3.000741 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:36:07.397792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:36:15.399015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:36:31.402127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:37:03.408352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:39:11.335196 0.000107 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:39:11.335421 0.117496 tcp 10.0.2.110 49581 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:39:11.453011 0.000034 tcp 10.0.2.110 49577 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/04 09:39:11.477681 0.115003 tcp 10.0.2.110 49582 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 09:43:07.414320 3.001742 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:43:14.422008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:43:22.423076 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:43:38.426009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:44:10.434179 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:50:14.438030 3.001793 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:50:21.445858 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:50:29.447562 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:50:45.449966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:51:17.456542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:57:21.462302 3.001866 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 09:57:28.469622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:57:36.471257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:57:52.474548 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 09:58:24.480454 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:04:28.487584 3.000166 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:04:35.493628 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:04:43.494878 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:04:59.497925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:05:31.504321 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:09:11.342976 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:09:11.343326 0.115047 tcp 10.0.2.110 49583 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:09:11.485021 0.115227 tcp 10.0.2.110 49584 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:11:35.510114 3.001441 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:11:42.517469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:11:50.519284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:12:06.522593 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:12:38.528239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:18:42.534323 3.001452 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:18:49.541401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:18:57.543042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:19:13.546506 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:19:45.552060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:25:49.559091 3.000744 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:25:56.565750 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:26:04.567095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:26:20.571677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:26:52.575846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:32:56.582625 3.001202 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:33:03.589241 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:33:11.591098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:33:27.593849 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:33:59.600061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:39:11.350171 0.000092 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:39:11.350345 0.114771 tcp 10.0.2.110 49585 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:39:11.489760 0.114815 tcp 10.0.2.110 49586 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 10:40:03.606281 3.001419 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:40:10.613249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:40:18.615098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:40:34.618264 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:41:06.623747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:47:10.630512 3.001010 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:47:17.637691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:47:25.639386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:47:41.642252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:48:13.647924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:54:17.653620 3.001813 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 10:54:24.661562 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:54:32.663340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:54:48.665961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 10:55:20.672328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:01:24.677968 3.002092 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:01:31.685158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:01:39.686876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:01:55.689789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:02:27.696047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:08:31.701994 3.001312 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:08:38.709539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:08:46.710862 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:09:02.714236 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:09:11.359168 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:09:11.359302 0.115206 tcp 10.0.2.110 49587 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:09:11.501967 0.108492 tcp 10.0.2.110 49588 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:09:14.286928 0.009900 udp 10.0.2.110 57797 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 11:09:14.297595 0.109525 tcp 10.0.2.110 49589 -> 37.19.5.65 80 FSPA* 0 0 13 5710 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:09:34.719746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:15:38.726429 3.001447 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:15:45.733047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:15:53.735151 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:16:09.737823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:16:41.743723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:22:45.750082 3.001716 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:22:52.757036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:23:00.758824 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:23:16.761586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:23:48.767769 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:29:52.773935 3.001464 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:29:59.781178 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:30:07.782563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:30:23.785918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:30:55.791505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:36:59.797572 3.002330 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:37:06.805466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:37:14.806777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:37:30.810210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:38:02.815806 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:39:11.366512 0.000080 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:39:11.366688 0.115282 tcp 10.0.2.110 49590 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:39:11.508634 0.117684 tcp 10.0.2.110 49591 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 11:44:06.821744 3.001624 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:44:13.829392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:44:21.830644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:44:37.833601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:45:09.839732 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:51:13.845494 3.001985 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:51:20.853610 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:51:28.854911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:51:44.857908 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:52:16.863839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:58:20.869268 3.002194 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 11:58:27.876804 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:58:35.878717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:58:51.882515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 11:59:23.888282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:05:27.893941 3.001258 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:05:34.900984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:05:42.903003 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:05:58.905942 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:06:30.911576 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:09:11.375179 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:09:11.375577 0.108548 tcp 10.0.2.110 49592 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:09:11.507006 0.106279 tcp 10.0.2.110 49593 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:12:34.917528 3.001752 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:12:41.924850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:12:49.926987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:13:05.929631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:13:37.935775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:19:41.942796 3.000232 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:19:48.948847 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:19:56.950868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:20:12.953248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:20:44.959584 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:26:48.967254 3.000318 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:26:55.973546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:27:03.974408 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:27:19.977833 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:27:51.983567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:33:55.990388 3.041139 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:34:03.037196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:34:11.038712 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:34:27.041273 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:34:59.048031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:39:11.392530 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:39:11.392728 0.118105 tcp 10.0.2.110 49594 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:39:11.537285 0.106043 tcp 10.0.2.110 49595 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 12:41:03.053673 3.001705 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:41:10.060741 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:41:18.062810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:41:34.065559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:42:06.071199 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:48:10.077127 3.002351 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:48:17.085023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:48:25.086736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:48:41.089713 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:49:13.095376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:55:17.102243 3.001082 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 12:55:24.108765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:55:32.110489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:55:48.113550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 12:56:20.119995 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:02:24.126144 3.001210 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:02:31.133268 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:02:39.134182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:02:55.137441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:03:27.143404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:09:11.400408 0.000073 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:09:11.400551 0.114826 tcp 10.0.2.110 49596 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:09:11.539818 0.115191 tcp 10.0.2.110 49597 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:09:31.149629 3.001634 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:09:38.157325 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:09:46.158368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:10:02.161685 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:10:34.167366 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:16:38.173046 3.002280 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:16:45.181023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:16:53.182390 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:17:09.185122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:17:41.191469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:23:45.198187 3.000937 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:23:52.204592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:24:00.206728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:24:16.209298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:24:48.215428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:30:52.221990 3.000782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:30:59.229142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:31:07.229926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:31:23.233177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:31:55.239325 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:37:59.244945 3.002269 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:38:06.252674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:38:14.253902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:38:30.257436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:39:02.263405 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:39:11.408719 0.000062 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:39:11.408823 0.116699 tcp 10.0.2.110 49598 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:39:11.551514 0.115037 tcp 10.0.2.110 49599 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 13:45:06.269859 3.001074 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:45:13.276894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:45:21.278288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:45:37.281690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:46:09.287229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:13.293714 3.000870 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:52:20.301029 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:28.301932 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:52:44.304831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:53:16.311539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:20.317589 3.000996 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 13:59:27.324797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:35.326067 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 13:59:51.329494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:00:23.335046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:06:27.341064 3.001622 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:06:34.348222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:06:42.350222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:06:58.353340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:07:30.359153 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:09:11.416232 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:09:11.416536 0.115140 tcp 10.0.2.110 49600 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:09:11.563071 0.117241 tcp 10.0.2.110 49601 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:13:34.366358 3.000703 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:13:41.372976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:13:49.373979 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:14:05.377382 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:14:37.383206 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:20:41.388947 3.001720 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:20:48.396649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:20:56.398233 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:21:12.401014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:21:44.407254 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:27:48.413625 3.003170 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:27:55.422546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:28:03.422372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:28:19.424793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:28:51.431055 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:34:55.436853 3.001525 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:35:02.444654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:35:10.446163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:35:26.449239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:35:58.455212 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:39:11.424180 0.000074 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:39:11.424348 0.108582 tcp 10.0.2.110 49602 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:39:11.563771 0.117357 tcp 10.0.2.110 49603 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 14:42:02.461468 3.001355 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:42:09.468678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:42:17.469693 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:42:33.473302 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:43:05.478823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:49:09.485383 3.001385 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:49:16.492524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:49:24.493583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:49:40.497204 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:50:12.503197 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:16.509223 3.001011 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 14:56:23.516766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:31.517594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:56:47.521157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 14:57:19.527105 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:23.532537 3.002139 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:03:30.540552 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:38.541653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:03:54.544949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:04:26.551049 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:09:11.432870 0.000060 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:09:11.433203 0.114819 tcp 10.0.2.110 49604 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:09:11.578488 0.117001 tcp 10.0.2.110 49605 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:09:14.300397 0.009891 udp 10.0.2.110 52404 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 15:09:14.310945 0.116439 tcp 10.0.2.110 49606 -> 37.19.5.65 80 FSPA* 0 0 13 5643 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:10:30.556555 3.002212 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:10:37.564570 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:10:45.565563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:11:01.569090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:11:33.575082 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:17:37.580706 3.001919 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:17:44.588398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:17:52.589475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:18:08.592396 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:18:40.598978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:24:44.605058 3.001664 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:24:51.612512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:24:59.614229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:25:15.616809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:25:47.622616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:31:51.629053 3.001509 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:31:58.636531 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:32:06.637663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:32:22.640482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:32:54.646561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:38:58.652753 3.001869 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:39:05.660137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:39:11.441184 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:39:11.441294 0.108417 tcp 10.0.2.110 49607 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:39:11.581564 0.106349 tcp 10.0.2.110 49608 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 15:39:13.661297 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:39:29.664409 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:40:01.670565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:05.677027 3.001259 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:46:12.683817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:20.685902 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:46:36.688652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:47:08.694302 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:12.701487 3.000990 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 15:53:19.707817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:27.709472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:53:43.712684 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 15:54:15.719014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:19.725176 3.000866 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:00:26.732476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:34.733436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:00:50.736535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:01:22.742917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:07:26.748639 3.001896 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:07:33.755663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:07:41.757480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:07:57.760554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:08:29.766214 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:09:11.449018 0.000081 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:09:11.449319 0.117438 tcp 10.0.2.110 49609 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:09:11.595202 0.117156 tcp 10.0.2.110 49610 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:14:33.772156 3.002276 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:14:40.779621 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:14:48.781142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:15:04.784644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:15:36.790717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:21:40.796330 3.001614 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:21:47.804094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:21:55.805191 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:22:11.808684 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:22:43.814448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:28:47.819759 3.002447 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:28:54.828267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:29:02.829631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:29:18.832088 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:29:50.838407 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:35:54.844657 3.001083 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:36:01.851510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:09.853429 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:25.856270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:36:57.862465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:39:11.456656 0.000111 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:39:11.456852 0.116984 tcp 10.0.2.110 49611 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:39:11.598440 0.117296 tcp 10.0.2.110 49612 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 16:43:01.868317 3.002141 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:43:08.876225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:43:16.877135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:43:32.880028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:44:04.886510 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:08.893261 3.001414 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:50:15.900193 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:23.901722 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:50:39.904241 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:51:11.910229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:15.915968 3.001896 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 16:57:22.923465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:30.925347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:57:46.928133 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 16:58:18.934603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:04:22.940450 3.002017 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:04:29.947808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:04:37.948947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:04:53.952618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:05:25.958127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:09:11.464300 0.000098 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:09:11.464481 0.115182 tcp 10.0.2.110 49613 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:09:11.611418 0.115306 tcp 10.0.2.110 49614 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:11:29.964444 3.001696 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:11:36.971968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:11:44.973509 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:12:00.976252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:12:32.981984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:18:36.988012 3.001635 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:18:43.995685 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:18:51.997437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:19:08.000221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:19:40.006330 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:25:44.012379 3.001247 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:25:51.019374 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:25:59.021304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:26:15.023806 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:26:47.030319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:32:51.036726 3.000790 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:32:58.043806 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:33:06.045237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:33:22.047904 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:33:54.054520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:39:11.473011 0.000066 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:39:11.473330 0.105914 tcp 10.0.2.110 49615 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:39:11.606465 0.117135 tcp 10.0.2.110 49616 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 17:39:58.060686 3.001088 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:40:05.067450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:40:13.069451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:40:29.072154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:41:01.078028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:05.085080 3.000776 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:47:12.091633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:20.092815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:47:36.096008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:48:08.101738 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:12.107862 3.001882 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 17:54:19.115261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:27.117287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:54:43.119820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 17:55:15.126211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:19.132179 3.001492 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:01:26.139594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:34.141228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:01:50.144167 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:02:22.150089 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:08:26.156401 3.001370 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:08:33.163517 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:08:41.165226 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:08:57.167989 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:09:11.481066 0.000082 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:09:11.481231 0.105872 tcp 10.0.2.110 49617 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:09:11.612181 0.117190 tcp 10.0.2.110 49618 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:09:29.174168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:15:33.179887 3.001765 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:15:40.187456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:15:48.189309 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:16:04.191679 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:16:36.197602 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:22:40.205425 3.000283 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:22:47.211148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:22:55.212487 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:23:11.216111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:23:43.222074 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:29:47.228051 3.001448 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:29:54.235088 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:30:02.236920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:30:18.239787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:30:50.246034 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:36:54.251674 3.001498 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:37:01.259282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:37:09.260772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:37:25.263871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:37:57.269465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:39:11.488656 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:39:11.488774 0.117159 tcp 10.0.2.110 49619 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:39:11.629893 0.115273 tcp 10.0.2.110 49620 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 18:44:01.276738 3.001052 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:44:08.282896 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:44:16.284447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:44:32.287784 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:45:04.294003 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:51:08.299708 3.001712 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:51:15.307079 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:51:23.308697 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:51:39.311944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:52:11.317753 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:58:15.323312 3.001981 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 18:58:22.330887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:58:30.333042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:58:46.335524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 18:59:18.341378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:05:22.348193 3.001196 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:05:29.355327 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:05:37.356768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:05:53.359541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:06:25.366183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:09:10.066945 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:09:10.067075 0.010111 udp 10.0.2.110 61871 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/04 19:09:10.077705 0.174020 tcp 10.0.2.110 49621 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:11.496032 0.009803 udp 10.0.2.110 58413 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/04 19:09:11.506343 0.116731 tcp 10.0.2.110 49622 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:11.654254 0.117337 tcp 10.0.2.110 49623 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:14.303314 0.010317 udp 10.0.2.110 64079 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 19:09:14.314407 0.107624 tcp 10.0.2.110 49624 -> 37.19.5.65 80 FSPA* 0 0 13 5653 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:15.200715 0.106285 tcp 10.0.2.110 49625 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:40.250733 0.000164 tcp 10.0.2.110 49621 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:09:45.022594 0.000061 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:12:29.372868 3.000817 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/04 19:12:36.378793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:12:44.380889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:13:00.383270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:13:32.389879 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:19:36.395118 3.002067 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:19:43.402976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:19:51.404638 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:20:07.407741 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:20:39.413302 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:26:43.420658 3.000944 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:26:50.427385 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:26:58.428222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:27:14.431801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:27:46.437967 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:33:50.443331 3.001729 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:33:57.450633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:34:05.452799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:34:21.455506 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:34:53.461795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:39:11.504321 0.000103 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:39:11.504503 0.117592 tcp 10.0.2.110 49626 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:39:11.622405 0.000031 tcp 10.0.2.110 49621 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/04 19:39:11.655029 0.108267 tcp 10.0.2.110 49627 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 19:40:57.467105 3.002349 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:41:04.475157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:41:12.476956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:41:28.479173 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:42:00.485801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:48:04.491793 3.001075 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:48:11.498872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:48:19.500555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:48:35.503106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:49:07.509772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:55:11.515476 3.001619 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 19:55:18.522524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:55:26.524535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:55:42.527488 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 19:56:14.533401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:02:18.539616 3.001636 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:02:25.547007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:02:33.548124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:02:49.551578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:03:21.557821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:09:11.512811 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:09:11.513115 0.115086 tcp 10.0.2.110 49628 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 20:09:11.660285 0.118003 tcp 10.0.2.110 49629 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 20:09:25.564265 3.000745 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:09:32.570622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:09:40.572568 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:09:56.575010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:10:29.382756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:14:12.339345 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:14:12.339458 0.009584 udp 10.0.2.110 56333 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 20:14:12.350316 0.127612 tcp 10.0.2.110 49630 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/04 20:16:33.388900 3.000936 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:16:40.395658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:16:48.397683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:17:04.400667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:17:36.406334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:23:40.413275 3.000506 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:23:47.420113 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:23:55.421476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:24:11.424270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:24:43.430602 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:30:47.436396 3.001582 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:30:54.443612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:31:02.445717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:31:18.448568 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:31:50.454754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:37:54.460549 3.001669 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:38:01.468177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:38:09.469537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:38:25.472823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:38:57.478183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:39:11.894729 0.000125 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:39:11.894957 0.117644 tcp 10.0.2.110 49631 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 20:39:12.036733 0.117390 tcp 10.0.2.110 49632 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 20:45:01.484660 3.001715 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:45:08.491533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:45:16.493396 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:45:32.496578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:46:04.502351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:52:08.507994 3.001883 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:52:15.515925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:52:23.517195 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:52:39.520211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:53:11.526504 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:59:15.532224 3.001566 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 20:59:22.540083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:59:30.541414 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 20:59:46.544149 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:00:18.550067 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:06:22.556301 3.001498 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:06:29.564005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:06:37.565214 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:06:53.568035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:07:25.574179 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:09:11.899545 0.000115 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:09:11.899758 0.108051 tcp 10.0.2.110 49633 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 21:09:12.037512 0.115267 tcp 10.0.2.110 49634 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 21:13:29.582360 3.790837 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/04 21:13:35.375634 4.006056 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/04 21:13:52.182182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:14:07.957614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:14:37.494991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:20:41.501681 3.000885 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:20:48.508754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:20:58.062729 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:21:14.065619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:21:46.071196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:27:50.077720 3.001171 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:27:57.085113 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:28:05.086348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:28:21.089203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:28:53.095338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:34:57.101434 3.001661 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:35:04.109022 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:35:12.110467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:35:28.113228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:36:00.119274 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:39:16.123190 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:39:16.123293 0.114502 tcp 10.0.2.110 49635 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 21:39:16.266517 0.117208 tcp 10.0.2.110 49636 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 21:42:04.125434 3.001923 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:42:11.133270 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:42:19.134632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:42:35.137038 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:43:07.143114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:49:11.150665 3.000535 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:49:18.156431 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:49:26.158198 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:49:42.161275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:50:14.166936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:56:18.173901 3.000740 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 21:56:25.181131 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:56:33.182157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:56:49.185250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 21:57:21.191319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:03:25.196955 3.001951 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:03:32.204680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:03:40.205893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:03:56.209484 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:04:28.315688 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:09:16.162113 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:09:16.162506 0.114567 tcp 10.0.2.110 49637 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 22:09:16.301262 0.117272 tcp 10.0.2.110 49638 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 22:10:32.322163 3.001010 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:10:39.328991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:10:47.330042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:11:03.333596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:11:35.339690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:17:39.367867 2.999318 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:17:46.373103 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:17:54.374469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:18:10.377867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:18:42.383563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:24:46.389920 3.031160 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:24:53.426611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:25:01.428147 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:25:17.431282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:25:49.437564 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:31:53.443281 3.002106 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:32:00.451137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:32:08.451943 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:32:24.455118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:32:56.461262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:39:00.467552 3.001069 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:39:07.475050 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:39:15.476111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:39:16.694098 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:39:16.694395 0.108986 tcp 10.0.2.110 49639 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 22:39:16.827408 0.108629 tcp 10.0.2.110 49640 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 22:39:31.479307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:40:03.485366 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:46:07.491243 3.002025 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:46:14.498954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:46:22.500365 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:46:38.503619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:47:10.510225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:53:14.515416 3.001610 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 22:53:21.522965 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:53:29.524033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:53:45.527452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 22:54:17.532913 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:00:21.538918 3.001751 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:00:28.546831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:00:36.548531 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:00:52.551224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:01:24.558213 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:07:28.564280 3.000347 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:07:35.570954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:07:43.571875 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:07:59.575323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:08:31.581322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:09:16.178119 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:09:16.178253 0.106105 tcp 10.0.2.110 49641 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 23:09:16.314989 0.108750 tcp 10.0.2.110 49642 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 23:09:21.076515 0.009848 udp 10.0.2.110 51595 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/04 23:09:21.307333 1.507790 tcp 10.0.2.110 49643 -> 37.19.5.65 80 FSPA* 0 0 13 5662 flow=From-Botnet-V1-TCP-Established 1970/01/04 23:14:35.588188 3.000649 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:14:42.594608 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:14:50.596197 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:15:06.599269 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:15:38.605135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:21:42.612148 3.000407 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:21:49.618644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:21:57.619694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:22:13.623352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:22:45.629223 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:28:49.634643 3.001979 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:28:56.642709 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:29:04.643861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:29:20.647362 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:29:52.653056 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:35:56.659616 3.001431 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:36:03.666092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:36:11.667781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:36:27.671020 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:36:59.677177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:39:16.185877 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:39:16.186172 0.114582 tcp 10.0.2.110 49644 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/04 23:39:16.340023 0.117247 tcp 10.0.2.110 49645 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/04 23:43:03.684484 3.000450 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:43:10.690535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:43:18.691628 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:43:34.694752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:44:06.700989 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:50:10.706829 3.001755 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:50:17.714537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:50:25.715831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:50:41.718837 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:51:13.724879 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:57:17.732237 3.000805 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/04 23:57:24.738262 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:57:32.739533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:57:48.743252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/04 23:58:20.748601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:04:24.754802 3.002053 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:04:31.762625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:04:39.764023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:04:55.767092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:05:28.804454 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:09:16.704237 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:09:16.704372 0.114792 tcp 10.0.2.110 49646 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 00:09:16.845716 0.106065 tcp 10.0.2.110 49647 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 00:11:32.810089 3.001582 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:11:39.817537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:11:47.819478 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:12:03.822440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:12:35.828583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:18:39.834446 3.001540 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:18:46.841363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:18:54.843218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:19:10.846684 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:19:42.852230 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:25:46.859522 3.000124 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:25:53.865682 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:26:01.867427 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:26:17.869930 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:26:49.876267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:32:53.881938 3.002299 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:33:00.889780 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:33:08.891163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:33:24.894144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:33:56.900266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:39:16.711679 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:39:16.711985 0.114901 tcp 10.0.2.110 49648 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 00:39:16.850952 0.115247 tcp 10.0.2.110 49649 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 00:40:00.905856 3.003704 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:40:07.915101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:40:15.915364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:40:31.918550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:41:03.923954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:47:07.930348 3.001353 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:47:14.937508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:47:22.939001 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:47:38.941845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:48:10.947871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:54:14.954659 3.000981 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 00:54:21.961749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:54:29.963119 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:54:45.965850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 00:55:17.971761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:01:22.072334 2.997495 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:01:29.076734 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:01:37.078477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:01:53.079957 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:02:30.965527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:08:31.215377 3.001635 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:08:38.222608 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:08:46.224499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:09:02.227617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:09:18.908149 0.000042 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:09:18.908394 0.115118 tcp 10.0.2.110 49650 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 01:09:19.287259 0.117432 tcp 10.0.2.110 49651 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 01:09:34.233593 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:15:38.240561 3.000553 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:15:45.247041 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:15:53.248387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:16:09.251288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:16:41.257335 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:22:45.264634 3.000081 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:22:52.270728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:23:00.272512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:23:16.275007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:23:48.281440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:29:52.294190 2.994527 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:29:59.294342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:30:07.296134 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:30:23.298782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:30:55.305129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:36:59.312541 3.000524 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:37:06.318653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:37:14.319702 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:37:30.322729 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:38:02.329177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:39:18.901305 0.000117 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:39:18.901509 0.106151 tcp 10.0.2.110 49652 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 01:39:19.035795 0.117347 tcp 10.0.2.110 49653 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 01:44:06.335159 3.001281 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:44:13.342774 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:44:21.343815 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:44:37.347305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:45:09.352778 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:51:13.359495 3.001307 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:51:20.366659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:51:28.367834 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:51:44.371089 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:52:16.376973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:58:20.382526 3.001906 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 01:58:27.390509 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:58:35.392176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:58:51.395230 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 01:59:23.400709 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:05:27.407838 3.000715 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:05:34.414328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:05:42.415821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:05:58.418694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:06:30.425129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:09:18.909550 0.000083 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:09:18.909715 0.106340 tcp 10.0.2.110 49654 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 02:09:19.064292 0.115155 tcp 10.0.2.110 49655 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 02:12:34.430933 3.152245 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:12:41.588872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:12:49.589753 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:13:05.753030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:13:37.759534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:19:41.765160 3.002184 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:19:48.772807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:19:56.773927 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:20:12.777311 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:20:44.784379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:26:48.789723 3.001464 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:26:55.796988 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:27:04.038758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:27:20.041433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:27:52.047559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:33:56.053263 3.002134 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:34:03.061273 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:34:11.062516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:34:27.065265 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:34:59.071791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:39:19.167819 0.000114 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:39:19.168017 0.106213 tcp 10.0.2.110 49656 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 02:39:19.321809 0.106128 tcp 10.0.2.110 49657 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 02:41:03.077412 3.002107 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:41:10.084987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:41:18.086631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:41:34.089489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:42:06.095981 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:48:10.102360 3.000575 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:48:17.109207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:48:25.110362 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:48:41.113286 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:49:13.119281 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:55:17.125439 3.002005 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 02:55:24.133059 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:55:32.134512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:55:48.137316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 02:56:20.143629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:02:24.149534 3.002011 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:02:31.157224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:02:39.158806 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:02:55.161261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:03:27.167333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:09:19.183099 0.000087 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:09:19.183512 0.109425 tcp 10.0.2.110 49658 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 03:09:19.322812 0.106655 tcp 10.0.2.110 49659 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 03:09:23.409447 0.009855 udp 10.0.2.110 49231 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 03:09:23.470833 0.146469 tcp 10.0.2.110 49660 -> 37.19.5.65 80 FSPA* 0 0 13 5670 flow=From-Botnet-V1-TCP-Established 1970/01/05 03:09:31.173620 3.001410 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:09:38.181222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:09:46.182441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:10:02.185083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:10:34.391719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:16:38.398046 3.001318 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:16:45.484905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:16:53.486567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:17:09.489474 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:17:41.495567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:23:45.502065 3.001121 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:23:52.509360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:00.510366 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:16.513373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:24:48.519674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:30:52.525109 3.002372 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:30:59.533294 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:31:07.535072 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:31:23.537940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:31:58.958297 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:38:02.964514 3.001608 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:38:09.971715 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:38:17.973881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:38:33.976779 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:39:05.982841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:39:20.965866 0.000093 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:39:20.966042 0.109047 tcp 10.0.2.110 49661 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 03:39:21.107411 0.114842 tcp 10.0.2.110 49662 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 03:45:09.989393 3.000760 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:45:16.996165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:45:24.997445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:45:41.000957 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:46:13.006740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:52:17.012086 3.002070 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:52:24.019768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:52:32.021621 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:52:48.024757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:53:20.030233 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:59:24.036397 3.001766 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 03:59:31.043647 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:59:39.045241 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 03:59:57.231928 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:00:29.237757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:06:33.243489 3.001517 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:06:40.250687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:06:48.252910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:07:04.255768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:07:36.261857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:09:22.035155 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:09:22.035425 0.118295 tcp 10.0.2.110 49663 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 04:09:22.177573 0.116821 tcp 10.0.2.110 49664 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 04:13:40.267265 3.002120 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:13:47.274749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:13:55.277183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:14:11.279926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:14:43.286218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:20:47.291393 3.001473 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:20:54.299271 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:02.300736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:18.303329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:21:50.309177 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:27:54.315058 3.001842 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:28:01.323184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:28:09.324183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:28:25.327785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:28:57.333661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:35:01.339005 3.002572 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:35:08.346973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:35:16.348695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:35:32.351544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:36:04.359605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:39:22.044285 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:39:22.044390 0.106372 tcp 10.0.2.110 49665 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 04:39:22.174554 0.116873 tcp 10.0.2.110 49666 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 04:42:08.364698 3.000408 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:42:15.370887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:42:23.372096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:42:39.375203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:43:11.531972 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:49:15.537414 3.001963 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:49:22.545430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:49:30.546875 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:49:46.549876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:50:18.555842 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:56:22.562176 3.000749 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 04:56:29.569150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:56:37.570176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:56:53.573694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 04:57:25.579545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:03:29.585326 3.001887 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:03:36.593205 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:03:44.594572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:04:00.597811 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:04:32.603273 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:09:21.083554 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:09:21.083758 0.009754 udp 10.0.2.110 60369 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/05 05:09:21.128285 0.254757 tcp 10.0.2.110 49667 -> 37.19.5.22 80 SPA_* 0 0 27 17520 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:09:23.115437 0.010229 udp 10.0.2.110 59656 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/05 05:09:23.126175 0.115464 tcp 10.0.2.110 49668 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:09:23.267131 0.109006 tcp 10.0.2.110 49669 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:09:26.985898 0.010678 udp 10.0.2.110 51199 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/05 05:09:27.134702 0.174705 tcp 10.0.2.110 49670 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:09:51.382864 0.000149 tcp 10.0.2.110 49667 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:09:55.988457 0.000120 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:10:36.609689 3.001782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/05 05:10:43.617317 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:10:51.618130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:11:07.621444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:11:39.707353 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:17:43.713609 3.001325 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:17:50.721237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:17:58.722762 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:18:14.725418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:18:46.731360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:24:50.738088 3.251499 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:24:57.995791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:05.997065 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:21.999816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:25:54.005864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:31:58.011805 3.002067 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:32:05.019457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:32:13.020979 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:32:29.023606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:33:01.029663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:39:05.036463 3.001296 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:39:13.075213 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:39:21.076162 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:39:22.780595 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:39:22.780869 0.108898 tcp 10.0.2.110 49671 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:39:22.889913 0.000053 tcp 10.0.2.110 49667 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/05 05:39:22.916360 0.117233 tcp 10.0.2.110 49672 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 05:39:37.079275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:40:09.085251 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:46:13.091679 3.000942 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:46:20.098713 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:46:28.100159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:46:44.103472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:47:16.109476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:53:30.120010 3.001627 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 05:53:37.126765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:53:45.128451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:54:01.131265 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 05:54:34.199207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:00:56.211183 3.001568 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:01:03.218626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:11.220267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:27.223176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:01:59.228901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:08:03.234714 3.001813 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:08:10.242417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:08:18.243981 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:08:34.247158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:09:06.252804 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:09:23.309038 0.000052 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:09:23.309126 0.117410 tcp 10.0.2.110 49673 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 06:09:23.450261 0.115257 tcp 10.0.2.110 49674 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 06:15:10.258579 3.002102 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:15:17.266724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:15:25.267719 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:15:41.271136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:16:14.038187 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:18.044237 3.001639 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:22:25.051811 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:33.053094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:22:49.055880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:23:21.061910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:29:25.068116 3.001517 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:29:32.075760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:29:40.077098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:29:56.079659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:30:28.085763 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:36:32.091839 3.002122 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:36:39.099765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:36:47.101154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:37:03.104378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:37:35.110154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:39:23.698088 0.000060 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:39:23.698335 0.117448 tcp 10.0.2.110 49675 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 06:39:23.839551 0.106375 tcp 10.0.2.110 49676 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 06:43:39.116838 3.001142 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:43:46.122980 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:43:54.125078 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:44:10.127767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:44:45.308744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:50:50.225160 3.002373 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:50:57.233022 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:05.234877 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:21.237559 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:51:53.243472 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:58:01.256490 3.000816 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 06:58:08.263062 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:58:16.264409 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:58:32.267092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 06:59:04.273706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:05:08.279494 3.001704 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:05:15.287180 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:05:23.288449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:05:39.291718 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:06:11.297321 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:09:25.690164 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:09:25.690513 0.115697 tcp 10.0.2.110 49677 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 07:09:25.837721 0.116894 tcp 10.0.2.110 49678 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 07:09:29.739516 0.009768 udp 10.0.2.110 51848 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 07:09:29.749982 0.110331 tcp 10.0.2.110 49679 -> 37.19.5.65 80 FSPA* 0 0 13 5630 flow=From-Botnet-V1-TCP-Established 1970/01/05 07:12:15.304143 3.001126 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:12:22.310999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:12:33.997380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:12:50.000560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:13:22.006583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:19:29.016680 3.002118 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:19:36.024253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:19:44.025905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:20:00.028809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:20:32.034631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:26:36.040676 3.002287 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:26:43.048524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:26:51.049683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:27:07.053250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:27:39.058594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:33:43.064854 3.001941 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:33:50.072350 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:33:58.073689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:34:14.077138 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:34:46.082775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:39:27.840077 0.000094 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:39:27.840252 0.105744 tcp 10.0.2.110 49680 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 07:39:27.970011 0.117419 tcp 10.0.2.110 49681 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 07:40:50.841003 3.000410 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:40:57.847160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:41:05.849150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:41:21.851605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:41:53.857698 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:47:57.863783 3.001542 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:48:04.871605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:48:12.873045 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:48:28.875935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:49:00.881562 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:04.888608 3.000924 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 07:55:11.895590 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:19.896846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:55:35.900051 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 07:56:07.905951 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:11.913112 3.000725 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:02:18.919120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:26.920561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:02:42.923909 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:03:14.929608 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:18.936053 3.001352 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:09:25.943372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:28.445778 0.000045 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:09:28.445867 0.106262 tcp 10.0.2.110 49682 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 08:09:28.575848 0.117464 tcp 10.0.2.110 49683 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 08:09:33.945070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:09:49.947941 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:10:21.953931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:25.959719 3.001726 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:16:32.967450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:40.968890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:16:56.972112 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:17:29.668689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:23:33.675237 3.001547 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:23:40.682229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:23:48.683721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:24:06.569518 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:24:38.865852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:30:42.871532 3.002327 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:30:49.879441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:30:57.880838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:31:13.883560 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:31:45.889859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:37:49.895541 3.002142 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:37:56.903465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:38:04.904929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:38:20.907856 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:38:52.913913 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:39:29.257696 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:39:29.257953 0.117478 tcp 10.0.2.110 49684 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 08:39:29.399531 0.117140 tcp 10.0.2.110 49685 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 08:44:56.919218 3.002381 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:45:03.927144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:11.929100 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:27.931613 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:45:59.937580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:03.943338 3.002114 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:52:10.950849 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:18.952597 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:52:34.955382 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:53:06.961916 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:59:11.938848 3.001656 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 08:59:18.946305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:59:26.947672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 08:59:42.950746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:00:14.957425 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:06:18.964990 2.999875 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:06:25.970652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:06:33.971775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:06:49.974667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:07:21.980945 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:09:29.736974 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:09:29.737312 0.106059 tcp 10.0.2.110 49686 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 09:09:29.867891 0.117319 tcp 10.0.2.110 49687 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 09:13:25.988239 3.000712 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:13:32.994503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:13:41.787349 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:13:57.789924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:14:29.795800 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:20:33.801682 3.002165 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:20:40.809441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:20:48.811548 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:21:04.813962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:21:36.820040 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:27:40.825479 3.002433 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:27:47.833171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:27:55.835017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:28:11.837777 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:28:43.844170 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:34:47.850667 3.001029 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:34:54.857438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:35:02.859046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:35:18.862022 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:35:50.868191 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:39:30.145976 0.000073 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:39:30.146288 0.117425 tcp 10.0.2.110 49688 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 09:39:30.294047 0.114831 tcp 10.0.2.110 49689 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 09:41:54.873801 3.001984 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:42:01.881444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:42:09.883046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:42:25.885876 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:43:00.896243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:06.494553 3.001908 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:49:13.502121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:21.503882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:49:37.506468 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:50:09.512975 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:16.522787 3.001988 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 09:56:23.530382 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:31.531810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:56:47.534657 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 09:57:19.541098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:23.546570 3.002308 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:03:30.554752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:38.556038 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:03:54.559176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:04:26.565334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:09:32.406528 0.000062 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:09:32.406636 0.108150 tcp 10.0.2.110 49690 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 10:09:32.538877 0.116971 tcp 10.0.2.110 49691 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 10:10:35.577618 3.001835 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:10:42.585565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:10:50.587121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:11:06.590106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:11:38.596043 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:17:42.602434 3.001433 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:17:49.609628 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:17:57.610820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:18:13.613952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:18:45.619820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:24:49.626271 3.001535 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:24:56.633093 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:25:04.634956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:25:20.637958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:25:52.643830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:31:56.650067 3.001491 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:32:03.657490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:32:11.658748 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:32:27.661746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:32:59.667656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:39:03.744599 3.001308 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:39:10.751190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:39:18.753313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:39:32.444611 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:39:32.444786 0.117002 tcp 10.0.2.110 49692 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 10:39:32.586410 0.117042 tcp 10.0.2.110 49693 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 10:39:34.755882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:40:06.761810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:46:10.767792 3.002202 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:46:17.775547 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:46:25.776861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:46:41.779623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:47:13.786441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:18.983438 3.002011 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 10:53:25.990906 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:33.992768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:53:49.995413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 10:54:22.001606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:00:26.008316 3.001216 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:00:33.015157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:00:41.016772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:00:57.019534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:01:29.025787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:07:37.037274 3.001911 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:07:44.044747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:07:52.045892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:08:08.049429 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:08:40.055494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:09:33.033501 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:09:33.033635 0.108293 tcp 10.0.2.110 49694 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 11:09:33.173530 0.114761 tcp 10.0.2.110 49695 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 11:09:36.862836 0.011385 udp 10.0.2.110 59942 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 11:09:36.874956 0.118383 tcp 10.0.2.110 49696 -> 37.19.5.65 80 FSPA* 0 0 13 5648 flow=From-Botnet-V1-TCP-Established 1970/01/05 11:15:00.064789 3.461623 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:15:07.532340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:15:15.533653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:15:31.537080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:16:03.543242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:22:07.549388 3.001502 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:22:14.556589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:22:22.558036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:22:38.560788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:23:10.566893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:29:14.572760 3.002028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:29:21.580898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:29:29.581817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:29:45.585536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:30:17.590875 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:36:21.596878 3.001454 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:36:28.604223 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:36:36.605679 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:36:52.608545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:37:24.615137 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:39:33.262143 0.000083 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:39:33.262355 0.105882 tcp 10.0.2.110 49697 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 11:39:33.403521 0.115095 tcp 10.0.2.110 49698 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 11:43:28.621562 3.000677 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:43:35.628610 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:43:43.629785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:43:59.632761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:44:32.239527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:50:36.245580 3.001555 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:50:43.253090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:50:51.254877 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:51:07.257911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:51:39.263408 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:57:43.269212 3.002368 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 11:57:50.277364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:57:58.278317 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:58:14.281383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 11:58:46.287773 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:04:50.293662 3.001679 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:04:57.301312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:05:05.302349 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:05:21.305848 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:05:53.311540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:09:33.569842 0.000092 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:09:33.570027 0.108216 tcp 10.0.2.110 49699 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 12:09:33.705912 0.114807 tcp 10.0.2.110 49700 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 12:11:57.318035 3.001050 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:12:04.324911 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:12:12.326716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:12:28.329400 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:13:01.216623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:19:05.223557 3.001203 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:19:14.263119 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:19:22.264905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:19:38.267499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:20:10.563762 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:26:14.569641 3.002187 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:26:21.577309 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:26:29.579085 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:26:45.581838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:27:17.587813 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:33:21.593800 3.001835 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:33:28.601283 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:33:36.602966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:33:52.605658 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:34:24.612315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:39:35.160200 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:39:35.160400 0.105676 tcp 10.0.2.110 49701 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 12:39:35.292538 0.114853 tcp 10.0.2.110 49702 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 12:40:28.617534 3.002060 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:40:35.625786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:40:43.626697 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:40:59.629626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:41:31.635899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:47:35.641830 3.001961 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:47:42.649368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:47:50.650571 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:48:06.653899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:48:38.660331 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:54:42.665696 3.002092 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 12:54:49.673495 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:54:59.579937 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:55:15.580607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 12:55:47.586632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:01:51.592512 3.001625 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:01:58.599942 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:02:06.601539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:02:22.605035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:02:54.610563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:08:58.616347 3.002215 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:09:05.624080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:09:13.635787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:09:29.638963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:09:36.099649 0.000286 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:09:36.100037 0.117585 tcp 10.0.2.110 49703 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 13:09:36.242124 0.108287 tcp 10.0.2.110 49704 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 13:10:01.644841 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:16:05.651409 3.000934 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:16:13.148687 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:16:21.149910 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:16:37.153423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:17:09.159127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:23:13.164754 3.002447 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:23:20.272689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:23:28.274314 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:23:44.277352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:24:16.283351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:30:20.290365 3.000930 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:30:27.297163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:30:35.298110 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:30:51.301428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:31:25.299859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:37:29.305992 3.001561 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:37:36.423561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:37:44.424954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:38:00.428542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:38:33.516211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:39:37.941129 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:39:37.941309 0.114680 tcp 10.0.2.110 49705 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 13:39:38.079927 0.106146 tcp 10.0.2.110 49706 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 13:44:40.526029 3.001476 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:44:47.533396 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:44:55.535367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:45:11.538072 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:45:43.544467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:51:50.554439 3.001722 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:51:57.561889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:52:05.563747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:52:21.566192 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:52:53.572823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:59:22.584667 3.041406 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 13:59:29.631944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:59:37.633171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 13:59:53.636462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:00:25.642260 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:06:29.908380 3.002362 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:06:36.916300 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:06:44.917611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:07:00.921127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:07:32.926809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:09:38.088444 0.000052 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:09:38.088532 0.105865 tcp 10.0.2.110 49707 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 14:09:38.219070 0.114589 tcp 10.0.2.110 49708 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 14:13:36.932834 3.001366 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:13:43.940032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:13:51.941453 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:14:07.944890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:14:39.950898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:20:43.956959 3.001448 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:20:50.964273 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:20:58.965556 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:21:14.968327 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:21:46.974726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:27:50.981850 3.000147 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:27:57.987869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:28:05.989383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:28:21.995017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:28:53.998424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:34:58.004269 3.002083 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:35:05.012437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:35:13.013451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:35:29.016931 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:36:01.022705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:39:38.097090 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:39:38.097200 0.114729 tcp 10.0.2.110 49709 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 14:39:38.241173 0.105897 tcp 10.0.2.110 49710 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 14:42:05.029163 3.001315 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:42:12.036032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:42:21.840014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:42:37.843251 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:43:09.849498 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:49:13.855128 3.001923 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:49:20.862444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:49:28.863963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:49:44.867404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:50:16.872929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:56:20.879011 3.001572 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 14:56:27.886433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:56:35.888414 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:56:51.890899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 14:57:23.897206 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:03:27.903698 3.001099 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:03:34.910917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:03:42.912231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:03:58.915380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:04:30.921163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:09:37.256079 0.000071 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:09:37.256227 0.009867 udp 10.0.2.110 64480 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/05 15:09:37.266616 0.375547 tcp 10.0.2.110 49711 -> 37.19.5.22 80 SPA_* 0 0 23 17304 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:09:39.005458 0.010412 udp 10.0.2.110 57351 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/05 15:09:39.016275 0.108131 tcp 10.0.2.110 49712 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:09:39.148775 0.105828 tcp 10.0.2.110 49713 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:09:42.773644 0.012340 udp 10.0.2.110 55481 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 15:09:42.786521 0.118448 tcp 10.0.2.110 49714 -> 37.19.5.65 80 FSPA* 0 0 13 5609 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:09:44.160201 0.117622 tcp 10.0.2.110 49715 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:10:07.443232 0.000164 tcp 10.0.2.110 49711 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:10:34.926646 3.002063 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/05 15:10:41.934158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:10:49.935975 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:11:05.939059 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:11:37.944761 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:17:41.951286 3.211542 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:17:49.169561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:17:57.170966 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:18:13.693860 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:18:45.700474 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:24:49.707043 3.000852 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:24:56.713542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:25:04.714986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:25:20.718237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:25:52.724528 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:31:56.730040 3.002092 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:32:03.737090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:32:11.738955 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:32:27.741872 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:32:59.747680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:39:03.755280 3.000160 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:39:10.761520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:39:18.762889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:39:34.765675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:39:39.354382 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:39:39.354529 0.117359 tcp 10.0.2.110 49716 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:39:39.472058 0.000024 tcp 10.0.2.110 49711 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/05 15:39:39.515078 0.114773 tcp 10.0.2.110 49717 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 15:40:06.771629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:46:10.778843 3.000552 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:46:17.785038 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:46:25.786958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:46:41.789642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:47:13.795775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:53:17.801495 3.002025 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 15:53:24.809338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:53:32.810886 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:53:48.813685 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 15:54:20.819550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:00:24.827123 3.000198 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:00:31.833174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:00:39.834452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:00:55.837622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:01:27.843821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:07:31.849984 3.001486 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:07:38.857272 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:07:46.858698 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:08:02.861426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:08:34.867649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:09:39.362603 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:09:39.362772 0.115187 tcp 10.0.2.110 49718 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 16:09:39.501706 0.106408 tcp 10.0.2.110 49719 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 16:14:38.873777 3.001933 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:14:45.881520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:14:53.882418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:15:09.885423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:15:41.891483 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:21:45.898164 3.001460 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:21:52.905387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:22:00.906794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:22:16.909938 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:22:48.915426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:28:52.922043 3.001324 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:28:59.928863 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:29:07.931045 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:29:23.933947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:29:55.940122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:35:59.945620 3.001698 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:36:06.953120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:36:14.954530 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:36:30.958016 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:37:02.963602 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:39:39.370625 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:39:39.370887 0.117418 tcp 10.0.2.110 49720 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 16:39:39.511668 0.108020 tcp 10.0.2.110 49721 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 16:43:06.970819 3.000264 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:43:13.977093 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:43:21.978380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:43:37.981799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:44:09.987569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:50:13.994263 3.001244 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:50:21.001071 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:50:29.002610 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:50:45.005827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:51:17.012243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:57:21.017397 3.001723 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 16:57:28.024925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:57:36.026801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:57:52.029497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 16:58:24.035459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:04:28.041494 3.001722 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:04:35.048816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:04:43.050786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:04:59.053615 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:05:31.059387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:09:39.378293 0.000041 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:09:39.378372 0.114628 tcp 10.0.2.110 49722 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 17:09:39.516281 0.126004 tcp 10.0.2.110 49723 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 17:11:35.065589 3.001894 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:11:42.073404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:11:50.074554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:12:06.077533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:12:38.083756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:18:42.090222 3.000720 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:18:49.097246 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:18:57.098681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:19:13.101814 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:19:45.107231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:25:49.114135 3.001266 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:25:56.120920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:26:04.122564 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:26:20.125049 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:26:52.131111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:32:56.137038 3.001891 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:33:03.144893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:33:11.146413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:33:27.149400 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:33:59.155415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:39:39.387120 0.000088 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:39:39.387307 0.117868 tcp 10.0.2.110 49724 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 17:39:39.531314 0.117620 tcp 10.0.2.110 49725 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 17:40:03.162054 3.963208 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:40:11.701369 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:40:19.702473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:40:35.705434 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:41:07.711797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:47:11.717756 3.001798 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:47:18.724850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:47:26.726435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:47:42.729533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:48:14.735900 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:54:29.747388 3.001487 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 17:54:36.754671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:54:44.756110 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:55:00.759495 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 17:55:32.764970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:01:53.775925 3.001755 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:02:00.783275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:02:08.784745 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:02:24.788211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:02:56.793735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:09:00.801392 3.000495 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:09:07.807208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:09:15.808632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:09:31.812093 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:09:40.145959 0.000048 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:09:40.146062 0.108221 tcp 10.0.2.110 49726 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 18:09:40.285305 0.109172 tcp 10.0.2.110 49727 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 18:10:03.827846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:16:07.834409 3.000967 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:16:14.841065 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:16:22.842970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:16:38.845716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:17:10.851361 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:23:14.857701 3.001679 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:23:21.864816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:23:29.866259 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:23:45.869540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:24:17.875450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:30:21.881769 3.001295 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:30:28.889305 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:30:36.890230 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:30:52.893835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:31:24.899444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:37:28.905544 3.002011 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:37:35.913170 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:37:43.914853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:37:59.917233 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:38:31.923612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:39:40.474791 0.000101 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:39:40.474972 0.115097 tcp 10.0.2.110 49728 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 18:39:40.614625 0.108259 tcp 10.0.2.110 49729 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 18:44:36.611470 3.001012 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:44:43.618017 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:44:51.619384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:45:07.622674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:45:39.628723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:51:43.635002 3.000849 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:51:50.641607 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:51:58.643816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:52:14.646231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:52:46.653037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:58:50.658011 3.002198 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 18:58:57.665845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:59:05.667285 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:59:21.670591 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 18:59:53.676785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:05:57.682336 3.001541 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:06:04.689521 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:06:12.691652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:06:28.694060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:07:00.700780 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:09:40.482257 0.000099 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:09:40.482441 0.114946 tcp 10.0.2.110 49730 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 19:09:40.622486 0.115017 tcp 10.0.2.110 49731 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 19:09:44.189763 0.010919 udp 10.0.2.110 50929 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 19:09:44.201295 0.116599 tcp 10.0.2.110 49732 -> 37.19.5.65 80 FSPA* 0 0 13 5595 flow=From-Botnet-V1-TCP-Established 1970/01/05 19:13:04.706401 3.002025 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:13:11.713589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:13:20.446462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:13:36.449331 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:14:08.455616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:20:12.461588 3.001814 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:20:19.468826 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:20:27.470630 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:20:43.473593 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:21:15.479610 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:27:19.485464 3.001432 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:27:26.493136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:27:34.493967 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:27:50.497118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:28:22.503722 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:34:26.509601 3.001682 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:34:33.517005 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:34:41.518572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:34:57.521630 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:35:29.527242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:39:40.840624 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:39:40.840919 0.117142 tcp 10.0.2.110 49733 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 19:39:40.985300 0.114930 tcp 10.0.2.110 49734 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 19:41:33.533827 3.001415 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:41:40.540854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:41:48.542455 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:42:04.545239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:42:36.551249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:48:40.558450 3.000931 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:48:47.564730 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:48:55.566378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:49:11.569389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:49:43.575227 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:55:47.581169 3.002124 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 19:55:54.588840 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:56:02.589861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:56:18.592847 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 19:56:50.599269 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:02:54.605082 3.001452 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:03:01.612556 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:03:09.614200 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:03:25.617147 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:03:57.623081 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:09:40.848443 0.000067 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:09:40.848585 0.106452 tcp 10.0.2.110 49735 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 20:09:40.980125 0.108181 tcp 10.0.2.110 49736 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 20:10:01.629770 3.001481 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:10:08.636492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:10:16.638473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:10:32.641035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:11:04.647187 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:17:08.652752 3.001875 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:17:15.660661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:17:23.662388 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:17:39.665307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:18:11.671473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:24:15.676599 3.001897 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:24:22.684346 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:24:30.685795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:24:46.689285 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:25:18.694778 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:31:22.701058 3.001790 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:31:29.708651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:31:37.710318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:31:53.713076 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:32:25.719157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:38:29.725209 3.001465 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:38:36.732710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:38:44.734283 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:39:00.737114 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:39:32.742782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:39:40.857105 0.000128 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:39:40.857331 0.114850 tcp 10.0.2.110 49737 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 20:39:41.005305 0.136663 tcp 10.0.2.110 49738 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 20:45:36.748640 3.002094 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:45:43.756540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:45:51.757603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:46:07.761109 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:46:39.766887 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:52:43.773043 3.001967 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:52:50.780331 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:52:58.782174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:53:14.784889 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:53:46.791002 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 20:59:50.796251 3.002191 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 20:59:57.804591 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:00:05.806083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:00:21.809184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:00:53.815288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:06:57.821204 3.001509 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:07:04.828816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:07:12.830313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:07:28.833690 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:08:00.839257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:09:40.864287 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:09:40.864442 0.108542 tcp 10.0.2.110 49739 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 21:09:41.005251 0.108731 tcp 10.0.2.110 49740 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 21:14:04.845372 3.000998 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:14:11.852435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:14:19.855769 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:14:35.856908 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:14:52.784075 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:14:52.784176 0.009669 udp 10.0.2.110 55032 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 21:14:52.794482 0.127798 tcp 10.0.2.110 49741 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/05 21:15:18.261786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:21:17.423837 2.965532 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:21:24.334846 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:21:32.226868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:21:51.723757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:22:23.507087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:28:21.045596 3.002190 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:28:28.053304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:28:36.054830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:28:52.057864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:29:24.063579 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:35:29.071212 3.002033 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:35:36.078871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:35:44.080197 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:36:00.083469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:36:32.089605 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:39:42.985543 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:39:42.985680 0.108376 tcp 10.0.2.110 49742 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 21:39:43.121328 0.115266 tcp 10.0.2.110 49743 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 21:42:36.096223 3.000713 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:42:43.102505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:42:51.104512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:43:07.106883 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:43:39.243160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:49:52.252056 3.032392 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:49:59.289692 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:50:07.291512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:50:23.294624 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:50:55.300558 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:56:59.306407 3.001468 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 21:57:06.313445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:57:14.315206 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:57:30.318095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 21:58:02.324462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:04:06.329824 3.002310 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:04:13.337680 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:04:21.339101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:04:37.342348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:05:09.708957 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:09:43.244398 0.000078 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:09:43.244556 0.117065 tcp 10.0.2.110 49744 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 22:09:43.385781 0.108178 tcp 10.0.2.110 49745 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 22:11:13.714440 3.001876 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:11:20.722301 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:11:28.724115 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:11:44.726797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:12:16.732734 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:18:20.739461 3.000817 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:18:27.745899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:18:35.747373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:18:51.751118 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:19:23.756810 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:25:27.762230 3.142087 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:25:34.910665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:25:42.911816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:25:58.914705 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:26:30.921250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:32:35.358178 3.000869 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:32:42.365175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:32:50.366727 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:33:06.369723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:33:38.375766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:39:42.382886 3.000205 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:39:43.513097 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:39:43.513214 0.114356 tcp 10.0.2.110 49746 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 22:39:43.652473 0.117372 tcp 10.0.2.110 49747 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 22:39:49.388806 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:39:57.390096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:40:13.393488 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:40:45.399742 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:46:49.405590 3.001462 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:46:56.413231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:47:04.995609 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:47:20.998594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:47:53.054573 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:53:57.060754 3.001016 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 22:54:04.127832 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:54:12.129678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:54:28.132622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 22:55:00.138526 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:01:04.144350 3.001807 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:01:11.151495 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:01:19.153006 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:01:35.156514 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:02:07.162356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:08:11.167876 3.002366 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:08:18.176126 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:08:26.177499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:08:42.180234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:09:14.186455 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:09:43.841459 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:09:43.841574 0.117152 tcp 10.0.2.110 49748 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 23:09:43.990188 0.117283 tcp 10.0.2.110 49749 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 23:09:47.879859 0.011044 udp 10.0.2.110 62027 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/05 23:09:47.891569 0.119267 tcp 10.0.2.110 49750 -> 37.19.5.65 80 FSPA* 0 0 13 5590 flow=From-Botnet-V1-TCP-Established 1970/01/05 23:15:18.193098 3.000825 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:15:25.199484 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:15:33.201501 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:15:49.203982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:16:21.210479 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:22:25.216197 3.001925 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:22:32.343805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:22:40.345284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:22:56.348611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:23:28.354752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:29:32.360505 3.002015 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:29:39.368111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:29:47.369136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:30:03.372704 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:30:35.378232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:36:39.384821 3.001399 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:36:46.391852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:36:54.393653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:37:10.396024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:37:42.402350 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:39:43.890229 0.000085 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:39:43.890412 0.117375 tcp 10.0.2.110 49751 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/05 23:39:44.034963 0.115145 tcp 10.0.2.110 49752 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/05 23:43:46.408843 3.001190 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:43:53.415765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:44:01.507368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:44:17.510346 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:44:49.516996 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:50:53.882750 3.002026 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:51:00.890557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:51:08.891586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:51:24.895122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:51:56.901295 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:58:00.907080 3.001872 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/05 23:58:07.914664 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:58:15.915738 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:58:31.918999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/05 23:59:05.006520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:05:09.013842 3.000057 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:05:16.020015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:05:24.021597 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:05:40.024060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:06:12.030361 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:09:44.647751 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:09:44.648056 0.106100 tcp 10.0.2.110 49753 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 00:09:44.779360 0.117449 tcp 10.0.2.110 49754 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 00:12:16.035938 3.002241 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:12:23.043734 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:12:31.045166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:12:47.048276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:13:20.036409 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:19:24.041791 3.001931 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:19:31.049512 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:19:39.050392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:19:55.053519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:20:30.053944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:26:34.060257 3.001122 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:26:41.067751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:26:49.068992 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:27:05.072060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:27:37.078326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:33:41.083822 3.002072 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:33:48.091469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:33:56.092667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:34:12.095751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:34:44.102283 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:39:46.589586 0.000052 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:39:46.589685 0.108127 tcp 10.0.2.110 49755 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 00:39:46.728572 0.115638 tcp 10.0.2.110 49756 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 00:40:48.107465 3.002463 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:40:55.115336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:41:03.117148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:41:19.120259 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:41:51.126157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:47:55.131809 3.001780 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:48:02.139650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:48:10.141120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:48:26.143683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:48:58.840984 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:55:02.847584 3.001142 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 00:55:09.854198 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:55:17.855538 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:55:33.858781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 00:56:05.864703 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:02:09.870631 3.002255 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:02:16.878242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:02:24.879980 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:02:40.882978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:03:12.888962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:09:16.895970 3.000925 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:09:23.902313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:09:31.903573 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:09:45.017161 0.000082 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:09:45.017321 0.009707 udp 10.0.2.110 60883 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/06 01:09:45.027558 0.177602 tcp 10.0.2.110 49757 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:09:46.927161 0.010127 udp 10.0.2.110 51571 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/06 01:09:46.937777 0.114992 tcp 10.0.2.110 49758 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:09:47.077761 0.114508 tcp 10.0.2.110 49759 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:09:47.906823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:09:52.131389 0.009875 udp 10.0.2.110 65053 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/06 01:09:52.141783 0.117602 tcp 10.0.2.110 49760 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:10:15.204473 0.000128 tcp 10.0.2.110 49757 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:10:19.913008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:16:23.919957 3.000391 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:16:30.925922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:16:38.927742 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:16:54.930426 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:17:26.936766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:23:30.943294 3.001433 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:23:37.950127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:23:45.951442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:24:01.955051 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:24:33.960973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:30:37.966384 3.112305 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:30:45.084864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:30:53.315844 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:31:09.319024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:31:41.325586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:37:45.331995 3.001128 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:37:52.338727 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:38:00.340240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:38:16.342878 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:38:48.349459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:39:47.085544 0.000136 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:39:47.085766 0.117194 tcp 10.0.2.110 49761 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:39:47.203114 0.000075 tcp 10.0.2.110 49757 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 01:39:47.226521 0.115105 tcp 10.0.2.110 49762 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 01:44:52.354979 3.002067 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:44:59.362743 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:45:07.364130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:45:23.367417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:45:55.373163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:51:59.378591 3.002304 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:52:06.386225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:52:14.387821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:52:30.391276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:53:02.397261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:59:06.402556 3.001930 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 01:59:13.410417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:59:21.411864 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 01:59:37.415314 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:00:09.421105 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:06:13.427142 3.001390 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:06:20.434418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:06:28.436130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:06:44.929968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:07:16.935549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:09:47.333799 0.000062 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:09:47.333904 0.259051 tcp 10.0.2.110 49763 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 02:09:47.616583 0.106514 tcp 10.0.2.110 49764 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 02:13:20.941727 3.001349 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:13:27.949356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:13:35.951066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:13:51.953494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:14:24.820643 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:20:28.826622 3.001882 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:20:35.834127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:20:43.835710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:20:59.838629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:21:31.844978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:27:35.851662 3.001158 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:27:42.858139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:27:50.859504 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:28:06.862855 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:28:38.869148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:34:44.938029 3.001550 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:34:51.945586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:34:59.947109 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:35:15.950106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:35:47.956125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:39:48.774272 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:39:48.774375 0.108353 tcp 10.0.2.110 49765 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 02:39:48.913338 0.117387 tcp 10.0.2.110 49766 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 02:41:51.961945 3.001612 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:41:58.969095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:42:06.970895 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:42:24.966891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:42:56.973161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:49:00.979052 3.001646 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:49:07.986208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:49:15.987740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:49:31.990626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:50:03.996290 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:56:08.002174 3.001914 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 02:56:15.009694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:56:23.011172 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:56:39.014197 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 02:57:11.020492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:03:15.026411 3.002322 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:03:22.033701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:03:30.035565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:03:46.038296 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:04:18.044371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:09:49.764459 0.000125 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:09:49.764687 0.117019 tcp 10.0.2.110 49767 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 03:09:49.906038 0.108361 tcp 10.0.2.110 49768 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 03:09:53.611529 0.011122 udp 10.0.2.110 64264 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 03:09:53.623255 0.118811 tcp 10.0.2.110 49769 -> 37.19.5.65 80 FSPA* 0 0 13 5605 flow=From-Botnet-V1-TCP-Established 1970/01/06 03:10:22.049924 3.002491 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:10:29.058146 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:10:37.059695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:10:53.062633 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:11:25.068612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:17:29.074229 3.002056 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:17:36.082123 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:17:44.083378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:18:00.086609 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:18:32.092960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:24:36.098175 3.001720 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:24:43.105824 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:24:51.107421 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:25:07.110701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:25:39.116602 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:31:43.121947 3.002205 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:31:50.129580 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:31:58.131466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:32:14.134811 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:32:46.140508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:38:50.146765 3.001128 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:38:57.153944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:39:05.154973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:39:21.158619 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:39:49.771491 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:39:49.771592 0.117508 tcp 10.0.2.110 49770 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 03:39:49.912527 0.117655 tcp 10.0.2.110 49771 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 03:39:53.164214 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:45:57.169869 3.002130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:46:04.177548 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:46:12.179116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:46:28.181978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:47:00.458781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:53:04.464563 3.001745 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 03:53:11.471983 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:53:19.474021 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:53:35.476503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 03:54:07.482998 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:00:11.489381 3.000607 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:00:18.496124 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:00:26.497650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:00:42.500429 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:01:14.506452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:07:18.513590 3.000632 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:07:25.520389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:07:33.521350 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:07:49.524567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:08:21.530442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:09:49.899743 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:09:49.899849 0.114866 tcp 10.0.2.110 49772 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 04:09:50.038686 0.115272 tcp 10.0.2.110 49773 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 04:14:25.536400 3.001817 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:14:32.544323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:14:40.545854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:14:56.548524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:15:28.554324 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:21:32.561370 3.000798 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:21:39.567757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:21:47.569225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:22:03.572329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:22:35.578837 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:28:39.585907 3.000263 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:28:46.592182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:28:54.593581 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:29:10.596278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:29:42.602221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:35:46.608384 3.001825 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:35:53.616167 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:36:01.617511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:36:17.620694 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:36:49.626395 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:39:49.907961 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:39:49.908058 0.114927 tcp 10.0.2.110 49774 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 04:39:50.053492 0.108781 tcp 10.0.2.110 49775 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 04:42:53.632165 3.001997 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:43:00.639740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:43:08.641552 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:43:24.644439 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:43:56.650569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:50:00.655667 3.002283 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:50:07.663618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:50:15.665511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:50:31.668308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:51:03.674448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:57:07.681072 3.000834 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 04:57:14.687682 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:57:22.689009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:57:38.692635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 04:58:10.698049 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:04:14.704129 3.001837 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:04:21.711923 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:04:29.713337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:04:45.716287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:05:17.722477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:09:49.915225 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:09:49.915364 0.108247 tcp 10.0.2.110 49776 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 05:09:50.046981 0.117954 tcp 10.0.2.110 49777 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 05:11:21.728606 3.001663 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:11:28.736094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:11:36.736968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:11:52.740561 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:12:24.747216 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:18:28.752346 3.001893 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:18:35.759476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:18:43.761142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:18:59.763936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:19:32.681530 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:25:36.688135 3.000932 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:25:43.695360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:25:51.696492 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:26:07.699489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:26:39.705782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:32:43.711410 3.001804 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:32:50.718868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:32:58.720569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:33:14.723402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:33:46.729675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:39:50.364326 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:39:50.364495 0.114753 tcp 10.0.2.110 49778 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 05:39:50.504092 0.108799 tcp 10.0.2.110 49779 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 05:39:50.735855 3.001264 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:39:57.742901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:40:05.744781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:40:21.747432 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:40:53.753222 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:46:57.759923 3.001128 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:47:04.767014 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:47:12.768354 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:47:28.771659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:48:00.777878 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:54:04.783710 3.001333 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 05:54:11.791291 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:54:19.792674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:54:35.795730 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 05:55:07.801759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:01:26.024566 3.113985 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:01:33.080654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:01:40.970885 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:01:56.753845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:03:26.804732 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:09:35.837185 2.985694 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:09:42.776536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:09:50.674608 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:10:06.447612 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:10:56.841247 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:11:24.894641 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:11:24.894747 0.115248 tcp 10.0.2.110 49780 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 06:11:25.034229 0.136408 tcp 10.0.2.110 49781 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 06:16:56.880758 3.303778 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/06 06:17:11.604040 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:17:18.621064 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:17:26.914589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:17:42.683092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:18:14.670088 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:24:13.173220 2.959783 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:24:20.072536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:24:27.954042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:24:43.702546 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:25:15.221477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:31:13.627108 2.948278 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:31:20.525744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:31:28.400181 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:31:44.147507 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:32:15.659723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:38:14.117830 2.962740 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:38:21.018655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:38:28.901417 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:38:44.661651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:39:16.162629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:41:14.655315 0.000065 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:41:14.655472 0.118491 tcp 10.0.2.110 49782 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 06:41:14.808070 0.106195 tcp 10.0.2.110 49783 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 06:45:14.719537 2.952494 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:45:21.629277 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:45:29.509830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:45:45.268840 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:46:16.791322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:52:42.908294 2.958428 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:52:49.810031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:52:57.685438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:53:13.457453 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:53:45.014541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 06:59:45.116668 3.001311 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 06:59:52.124157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:00:00.125298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:00:16.128541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:00:48.134332 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:06:52.140054 3.002420 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:06:59.147712 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:07:07.149162 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:07:23.152449 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:07:55.158448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:10:59.404999 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:10:59.405245 0.115651 tcp 10.0.2.110 49784 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 07:10:59.544623 0.106545 tcp 10.0.2.110 49785 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 07:11:03.193165 0.029308 udp 10.0.2.110 60899 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 07:11:03.223182 0.152062 tcp 10.0.2.110 49786 -> 37.19.5.65 80 FSPA* 0 0 13 5589 flow=From-Botnet-V1-TCP-Established 1970/01/06 07:13:59.164451 3.014520 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:14:06.188867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:14:14.173234 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:14:30.176439 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:15:02.182549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:21:06.188737 3.001271 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:21:13.195700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:21:21.197830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:21:37.200767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:22:09.207036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:28:13.211847 3.002194 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:28:20.219609 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:28:28.220968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:28:44.224155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:29:16.230595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:35:20.237622 3.000282 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:35:27.244455 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:35:35.245136 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:35:51.249105 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:36:23.254284 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:40:59.412944 0.000104 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:40:59.413142 0.117384 tcp 10.0.2.110 49787 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 07:40:59.554238 0.115006 tcp 10.0.2.110 49788 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 07:42:27.261334 3.000350 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:42:34.268010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:42:42.268961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:42:58.272453 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:43:30.278062 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:49:34.283676 3.002120 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:49:41.291424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:49:49.293148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:50:05.296261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:50:37.302186 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:56:41.311283 2.998458 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 07:56:48.317096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:56:56.316926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:57:12.320122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 07:57:44.326242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:03:48.332063 3.001812 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:03:55.359799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:04:03.340897 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:04:19.344127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:04:51.349482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:10:56.356554 3.002568 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:10:59.421845 0.000155 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:10:59.422095 0.114970 tcp 10.0.2.110 49789 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 08:10:59.560527 0.106383 tcp 10.0.2.110 49790 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 08:11:03.365503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:11:11.366403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:11:27.369237 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:11:59.376986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:18:03.380674 3.002299 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:18:10.388916 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:18:18.389700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:18:34.393471 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:19:06.399672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:25:10.405916 3.000483 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:25:17.412866 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:25:25.414661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:25:41.417415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:26:13.423434 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:32:17.429369 3.001606 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:32:24.436744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:32:32.438463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:32:48.441155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:33:20.447319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:39:24.452500 3.002859 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:39:31.461583 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:39:39.462394 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:39:55.465294 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:40:27.470726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:40:59.429501 0.000140 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:40:59.429728 0.106069 tcp 10.0.2.110 49791 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 08:40:59.559542 0.117248 tcp 10.0.2.110 49792 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 08:46:31.477301 3.001779 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:46:38.486600 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:46:46.486208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:47:02.488899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:47:34.498891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:53:38.500940 3.001782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 08:53:45.508696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:53:53.509542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:54:09.513089 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 08:54:41.519229 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:00:45.525588 3.001814 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:00:52.533220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:01:00.540189 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:01:16.536656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:01:48.543078 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:07:54.551870 3.001947 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:08:01.559278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:08:09.560968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:08:25.564360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:08:57.570329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:10:59.437270 0.000090 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:10:59.437445 0.115520 tcp 10.0.2.110 49793 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 09:10:59.581436 0.106062 tcp 10.0.2.110 49794 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 09:15:01.576465 3.001382 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:15:08.583347 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:15:16.584997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:15:32.588171 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:16:04.594287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:22:08.599877 3.001612 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:22:15.607300 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:22:23.608866 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:22:39.611950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:23:11.618020 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:29:15.623400 3.002212 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:29:22.631466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:29:30.632870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:29:46.635853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:30:18.641709 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:36:22.647885 3.001559 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:36:29.655098 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:36:37.658595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:36:53.660125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:37:25.671760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:40:59.445287 0.000111 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:40:59.445483 0.115170 tcp 10.0.2.110 49795 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 09:40:59.593021 0.106106 tcp 10.0.2.110 49796 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 09:43:29.671734 3.001765 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:43:36.679637 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:43:44.680735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:44:00.683851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:44:32.690090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:51:44.704622 3.000729 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:51:51.711290 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:51:59.712861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:52:15.715505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:52:47.721390 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:59:03.735376 3.001084 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 09:59:10.742533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:59:18.743819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 09:59:34.746956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:00:06.753016 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:06:14.764194 3.002033 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:06:21.772439 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:06:29.773581 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:06:45.776928 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:07:17.782844 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:10:59.452874 0.000081 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:10:59.453034 0.110152 tcp 10.0.2.110 49797 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 10:10:59.590892 0.117399 tcp 10.0.2.110 49798 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 10:13:21.788817 3.001787 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:13:28.798172 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:13:36.797767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:13:52.800808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:14:24.806793 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:20:28.813644 3.001022 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:20:35.820415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:20:43.823189 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:20:59.824847 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:21:31.830282 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:27:35.836864 3.001304 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:27:42.844345 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:27:50.845245 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:28:06.848514 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:28:38.854563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:34:42.862922 2.998760 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:34:49.867721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:34:57.869370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:35:13.872594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:35:45.878819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:40:59.460719 0.000098 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:40:59.460896 0.117666 tcp 10.0.2.110 49799 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 10:40:59.602080 0.117463 tcp 10.0.2.110 49800 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 10:41:49.884491 3.001612 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:41:56.892227 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:42:04.893386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:42:20.896506 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:42:52.902473 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:48:56.908645 3.001605 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:49:03.915635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:49:11.917240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:49:27.920418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:49:59.926436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:56:03.932726 3.001117 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 10:56:10.939737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:56:18.941453 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:56:34.944539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 10:57:06.949868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:03:15.963152 3.002130 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:03:22.970831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:03:30.972631 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:03:46.975737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:04:18.981542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:10:25.991730 3.001701 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:10:32.999805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:10:41.000701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:10:57.004456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:10:57.400345 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:10:57.400537 0.024926 udp 10.0.2.110 50698 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/06 11:10:57.426122 0.177914 tcp 10.0.2.110 49801 -> 37.19.5.22 80 SPA_* 0 0 25 17412 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:10:59.468104 0.026155 udp 10.0.2.110 61876 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/06 11:10:59.494727 0.127653 tcp 10.0.2.110 49802 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:10:59.646305 0.115449 tcp 10.0.2.110 49803 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:11:03.197626 0.025254 udp 10.0.2.110 60530 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 11:11:03.223560 0.118519 tcp 10.0.2.110 49804 -> 37.19.5.65 80 FSPA* 0 0 13 5615 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:11:04.636048 0.115491 tcp 10.0.2.110 49805 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:11:27.602979 0.000193 tcp 10.0.2.110 49801 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:11:29.010569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:17:33.015736 3.001780 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:17:40.026520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:17:48.024856 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:18:04.027789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:18:36.033735 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:24:40.040976 3.000483 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:24:47.047190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:24:55.048642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:25:11.051860 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:25:43.057640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:31:47.082797 2.982747 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:31:54.070951 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:32:02.072520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:32:18.075758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:32:50.084045 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:38:54.087674 3.001700 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:39:01.095173 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:39:09.096695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:39:25.099532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:39:57.106286 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:40:59.477175 0.000126 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:40:59.477390 0.117394 tcp 10.0.2.110 49806 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:40:59.594895 0.000061 tcp 10.0.2.110 49801 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 11:40:59.626284 0.114700 tcp 10.0.2.110 49807 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 11:46:01.111328 3.002042 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:46:08.119154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:46:16.120691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:46:32.124159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:47:04.129606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:53:11.140271 3.001272 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 11:53:18.147477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:53:26.148896 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:53:42.152422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 11:54:14.159447 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:00:18.164264 3.001464 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:00:25.178304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:00:33.173117 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:00:49.175789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:01:21.181959 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:07:25.188054 3.001356 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:07:32.196044 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:07:40.197352 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:07:56.200018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:08:28.205739 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:10:59.485232 0.000097 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:10:59.485410 0.117184 tcp 10.0.2.110 49808 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 12:10:59.626468 0.115151 tcp 10.0.2.110 49809 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 12:14:32.212701 3.081817 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:14:39.274150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:14:47.240805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:15:03.243851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:15:35.249828 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:21:39.257280 3.000285 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:21:46.263188 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:21:54.264524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:22:10.268168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:22:42.273897 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:28:46.279446 3.038673 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:28:53.300315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:29:01.298456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:29:17.301861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:29:49.307743 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:35:53.323817 3.107387 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:36:00.400485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:36:08.352686 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:36:24.355762 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:36:56.372036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:40:59.494501 0.027534 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:40:59.522167 0.114772 tcp 10.0.2.110 49810 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 12:40:59.666357 0.115035 tcp 10.0.2.110 49811 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 12:43:00.378026 3.163755 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:43:07.510375 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:43:15.438462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:43:31.409401 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:44:03.425859 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:50:07.446915 3.035759 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:50:14.464376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:50:22.460662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:50:38.470544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:51:10.479591 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:57:14.496343 3.090904 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 12:57:21.557783 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:57:29.514857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:57:45.519679 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 12:58:17.523590 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:04:21.529452 3.073169 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:04:28.581275 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:04:36.548160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:04:52.551848 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:05:24.557564 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:10:59.501130 0.265450 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:10:59.766735 0.267204 tcp 10.0.2.110 49812 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 13:11:00.062866 0.236261 tcp 10.0.2.110 49813 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 13:11:28.573087 3.014196 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:11:35.590782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:11:43.592714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:11:59.595190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:12:31.601795 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:18:35.627359 3.237766 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:18:42.835079 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:18:50.761522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:19:07.146389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:19:40.355365 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:25:42.682279 3.256634 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:25:50.033166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:25:57.952435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:26:13.813107 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:26:45.709678 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:32:49.716075 3.167125 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:32:57.372714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:33:05.274265 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:33:21.074176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:33:52.743843 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:39:57.174417 3.079285 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:40:04.215595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:40:12.121281 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:40:27.933915 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:40:59.509307 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:40:59.509403 0.247789 tcp 10.0.2.110 49814 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 13:40:59.784527 0.108463 tcp 10.0.2.110 49815 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 13:40:59.784707 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:47:03.783413 3.042555 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:47:10.801713 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:47:18.803032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:47:35.010113 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:48:06.821398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:54:10.827232 3.115712 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 13:54:17.913942 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:54:25.846692 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:54:41.849412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 13:55:13.855363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:01:21.868163 3.026654 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:01:28.884975 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:01:36.886280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:01:52.889438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:02:24.895600 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:08:28.901189 3.139956 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:08:36.081850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:08:44.008048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:08:59.933485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:09:32.073458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:10:59.517733 0.032256 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:10:59.550064 0.135495 tcp 10.0.2.110 49816 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 14:10:59.715136 0.114582 tcp 10.0.2.110 49817 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 14:15:36.969813 3.047886 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:15:43.998949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:15:51.985979 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:16:07.989167 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:16:39.994751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:22:44.000492 3.002349 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:22:51.009183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:22:59.206074 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:23:15.104158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:23:47.018956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:29:51.025229 3.123750 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:29:58.115938 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:30:06.050225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:30:22.046898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:30:54.052741 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:36:58.065010 3.019408 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:37:05.076061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:37:13.077588 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:37:29.080681 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:38:01.086671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:40:59.535254 0.032241 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:40:59.567637 0.105787 tcp 10.0.2.110 49818 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 14:40:59.697582 0.105676 tcp 10.0.2.110 49819 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 14:44:05.092050 3.263040 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:44:12.321121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:44:20.246536 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:44:36.114641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:45:08.532356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:52:10.139889 3.444624 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:52:17.558072 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:52:25.483983 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:52:41.329252 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:53:13.168533 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:59:24.174434 3.045178 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 14:59:31.196036 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:59:39.193018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 14:59:55.196133 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:00:27.202418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:06:33.211682 3.001714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:06:40.218651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:06:48.220232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:07:04.223134 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:07:36.229117 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:10:59.544098 0.000079 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:10:59.544219 0.117157 tcp 10.0.2.110 49820 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 15:10:59.686059 0.108277 tcp 10.0.2.110 49821 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 15:11:03.212291 0.012972 udp 10.0.2.110 50819 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 15:11:03.225911 0.146806 tcp 10.0.2.110 49822 -> 37.19.5.65 80 FSPA* 0 0 13 5562 flow=From-Botnet-V1-TCP-Established 1970/01/06 15:13:42.238716 3.010943 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:13:49.264096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:13:57.266928 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:14:13.269827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:14:45.276078 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:20:49.284134 3.013028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:20:56.299356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:21:04.300664 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:21:20.303724 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:21:52.309569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:28:00.321822 3.001529 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:28:07.328929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:28:15.330569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:28:31.333520 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:29:03.339535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:35:10.349565 3.023947 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:35:17.367232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:35:25.368912 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:35:41.372195 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:36:13.377728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:40:59.551347 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:40:59.551461 0.116771 tcp 10.0.2.110 49823 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 15:40:59.692940 0.114965 tcp 10.0.2.110 49824 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 15:42:17.383565 3.002114 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:42:24.390708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:42:32.393429 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:42:48.395772 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:43:20.401909 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:49:24.408071 3.011421 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:49:31.426700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:49:39.426892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:49:55.429538 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:50:27.435929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:56:31.441560 3.002012 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 15:56:38.449302 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:56:46.450850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:57:02.453892 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 15:57:34.460095 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:03:39.468443 3.000990 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:03:46.474557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:03:54.476588 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:04:10.479263 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:04:42.485191 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:10:56.495591 3.001360 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:10:59.559192 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:10:59.559351 0.128208 tcp 10.0.2.110 49825 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 16:10:59.701034 0.115098 tcp 10.0.2.110 49826 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 16:11:03.503202 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:11:11.504563 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:11:27.507440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:11:59.513754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:18:03.519994 3.010749 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:18:10.536927 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:18:18.538248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:18:34.541525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:19:06.548916 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:25:16.561496 3.002756 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:25:23.568997 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:25:31.570881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:25:47.574184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:26:19.580737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:32:23.586728 3.010772 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:32:30.603630 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:32:38.605087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:32:54.608333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:33:26.614343 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:39:31.621618 3.001782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:39:38.629103 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:39:46.630333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:40:02.633556 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:40:34.639168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:40:59.567425 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:40:59.567533 0.105902 tcp 10.0.2.110 49827 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 16:40:59.699090 0.105799 tcp 10.0.2.110 49828 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 16:46:38.645379 3.001698 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:46:45.653115 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:46:53.654527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:47:09.657757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:47:41.663542 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:53:45.670227 3.015316 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 16:53:52.686847 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:54:00.688555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:54:16.691489 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 16:54:48.697578 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:00:52.703915 3.001204 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:00:59.710916 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:01:07.712691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:01:23.715456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:01:55.720950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:07:59.727487 3.001468 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:08:06.735290 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:08:14.739525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:08:30.739403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:09:02.745634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:10:59.576275 0.000159 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:10:59.576538 0.106080 tcp 10.0.2.110 49829 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 17:10:59.707155 0.106031 tcp 10.0.2.110 49830 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 17:15:06.753073 3.053066 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:15:13.789356 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:15:21.770155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:15:37.773458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:16:09.779405 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:22:23.790898 3.022622 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:22:30.809627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:22:38.809088 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:22:54.812108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:23:27.040351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:29:30.834870 3.021201 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:29:37.852100 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:29:45.852833 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:30:01.855740 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:30:33.861802 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:36:37.868119 3.001349 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:36:44.875505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:36:52.876760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:37:08.879807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:37:40.889476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:40:59.583612 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:40:59.583877 0.107988 tcp 10.0.2.110 49831 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 17:40:59.718916 0.117385 tcp 10.0.2.110 49832 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 17:43:44.893423 3.011824 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:43:51.909281 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:43:59.910802 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:44:15.913959 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:44:47.922982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:51:58.932094 3.049681 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:52:05.961934 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:52:13.952767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:52:29.954339 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:53:01.961452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:59:16.971993 3.001378 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 17:59:23.979130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:59:31.982610 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 17:59:47.984100 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:00:19.990326 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:06:29.003864 3.011528 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:06:36.020726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:06:44.022196 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:07:00.024996 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:07:32.031007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:10:59.591235 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:10:59.591492 0.107908 tcp 10.0.2.110 49833 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 18:10:59.728551 0.117382 tcp 10.0.2.110 49834 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 18:13:38.040109 3.011535 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:13:45.057527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:13:53.058774 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:14:09.062254 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:14:41.067767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:20:45.073412 3.002128 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:20:52.081534 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:21:00.082746 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:21:16.089285 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:21:48.091820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:27:55.102263 3.013356 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:28:02.119642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:28:10.120987 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:28:26.128418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:28:58.129569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:35:02.136496 3.011685 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:35:09.153731 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:35:17.162723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:35:33.158272 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:36:05.164106 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:40:59.599655 0.000048 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:40:59.599746 0.116985 tcp 10.0.2.110 49835 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 18:40:59.740415 0.117398 tcp 10.0.2.110 49836 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 18:42:09.170709 3.001036 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:42:16.177798 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:42:24.179077 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:42:40.182309 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:43:12.188238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:49:16.194402 3.001589 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:49:23.201535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:49:31.203842 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:49:47.206826 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:50:19.212257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:56:23.218316 3.032489 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 18:56:30.235599 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:56:38.237241 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:56:54.240163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 18:57:26.246467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:03:33.256155 3.017562 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:03:40.273674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:03:48.275342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:04:04.277974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:04:36.288671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:10:50.294392 3.011897 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:10:57.312228 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:10:59.608656 0.000050 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:10:59.608747 0.116928 tcp 10.0.2.110 49837 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 19:10:59.750238 0.105899 tcp 10.0.2.110 49838 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 19:11:03.220540 0.010058 udp 10.0.2.110 62506 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 19:11:03.231229 0.140183 tcp 10.0.2.110 49839 -> 37.19.5.65 80 FSPA* 0 0 13 5550 flow=From-Botnet-V1-TCP-Established 1970/01/06 19:11:05.315480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:11:21.316978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:11:53.323211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:17:57.330088 3.000388 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:18:04.336379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:18:12.337572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:18:28.340757 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:19:00.346529 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:25:11.352935 3.011285 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:25:18.370219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:25:26.371535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:25:42.374828 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:26:14.380666 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:32:18.386632 3.001976 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:32:25.394435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:32:33.395484 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:32:49.398647 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:33:21.406218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:39:25.411561 3.001029 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:39:32.417443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:39:40.419554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:39:56.422481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:40:28.428726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:40:59.616707 0.000043 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:40:59.616792 0.114284 tcp 10.0.2.110 49840 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 19:40:59.754577 0.114586 tcp 10.0.2.110 49841 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 19:46:32.434962 3.001417 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:46:39.441891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:46:47.443574 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:47:03.448386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:47:35.453183 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:53:39.459451 3.020928 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 19:53:46.476008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:53:54.477341 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:54:10.482587 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 19:54:42.486973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:00:46.492814 3.033832 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:00:53.509817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:01:01.511514 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:01:17.514450 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:01:49.520598 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:07:53.528153 3.000213 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:08:00.533905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:08:08.535415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:08:24.538351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:08:56.544854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:10:59.623271 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:10:59.623370 0.106383 tcp 10.0.2.110 49842 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 20:10:59.755539 0.117235 tcp 10.0.2.110 49843 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 20:15:00.550496 3.001678 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:15:07.557878 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:15:15.559725 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:15:31.562363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:16:03.568497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:22:18.580276 3.001984 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:22:25.587585 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:22:33.589220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:22:49.592238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:23:21.597941 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:29:25.604645 3.014225 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:29:32.621663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:29:40.623244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:29:56.626456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:30:28.632554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:36:32.638605 3.011455 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:36:39.655513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:36:47.657092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:37:03.662747 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:37:35.666611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:40:59.631673 0.000076 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:40:59.631830 0.115282 tcp 10.0.2.110 49844 -> 37.19.5.31 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 20:40:59.770886 0.108473 tcp 10.0.2.110 49845 -> 37.19.5.31 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 20:43:39.673742 3.033240 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:43:46.689710 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:43:54.691279 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:44:10.694632 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:44:42.699653 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:51:53.713186 3.001196 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:52:00.719922 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:52:08.721502 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:52:24.724781 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:52:56.729873 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:59:11.741886 3.002145 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 20:59:18.749243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:59:26.751279 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 20:59:42.754501 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:00:14.760233 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:06:22.771698 4.655319 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:06:31.382572 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:06:39.285852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:06:55.102046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:07:26.723643 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:10:57.409065 0.000044 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:10:57.409173 0.011116 udp 10.0.2.110 59870 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/06 21:10:57.420843 0.485949 tcp 10.0.2.110 49846 -> 37.19.5.22 80 SPA_* 0 0 26 17466 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:10:59.688969 0.010516 udp 10.0.2.110 58508 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/06 21:10:59.699903 0.106323 tcp 10.0.2.110 49847 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:10:59.829914 0.116898 tcp 10.0.2.110 49848 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:11:04.772525 0.114812 tcp 10.0.2.110 49849 -> 37.19.5.10 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:11:27.597190 0.000197 tcp 10.0.2.110 49846 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:13:31.820353 3.000520 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/06 21:13:38.826398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:13:46.829829 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:14:02.830874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:14:34.837243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:16:01.146817 0.000111 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:16:01.147021 0.010157 udp 10.0.2.110 59237 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 21:16:01.157729 0.118585 tcp 10.0.2.110 49850 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:20:38.843855 3.000899 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:20:45.850595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:20:53.852231 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:21:09.854673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:21:41.862714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:27:45.867657 3.011364 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:27:52.884392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:28:00.886182 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:28:16.888946 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:28:48.895000 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:34:52.901713 3.059663 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:34:59.943043 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:35:07.919789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:35:23.923786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:35:55.929165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:40:59.647225 0.000098 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:40:59.647408 0.117588 tcp 10.0.2.110 49851 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:40:59.765148 0.000066 tcp 10.0.2.110 49846 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/06 21:40:59.789290 0.108229 tcp 10.0.2.110 49852 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 21:41:59.935154 3.001571 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:42:06.942457 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:42:14.943818 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:42:30.947433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:43:02.953250 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:49:06.958583 3.002073 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:49:13.965808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:49:21.967776 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:49:37.970700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:50:09.977143 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:56:13.982916 3.146551 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 21:56:21.100720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:56:29.033896 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:56:45.004765 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 21:57:17.010786 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:03:26.024348 3.004992 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:03:33.031501 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:03:41.032900 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:03:57.035880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:04:29.041789 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:10:43.052717 3.001906 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:10:50.059541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:10:58.061201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:10:59.655544 0.000128 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:10:59.655771 0.117148 tcp 10.0.2.110 49853 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 22:10:59.797414 0.115127 tcp 10.0.2.110 49854 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 22:11:14.064257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:11:46.070323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:17:50.075914 3.015880 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:17:57.093798 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:18:05.095440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:18:21.098389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:18:53.104627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:25:00.115124 3.013631 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:25:07.132441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:25:15.133873 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:25:31.136670 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:26:03.142982 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:32:07.149891 3.012469 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:32:14.166224 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:32:22.167677 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:32:38.170672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:33:10.177961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:39:14.183177 3.011260 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:39:21.200706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:39:29.201874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:39:45.204884 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:40:17.210695 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:40:59.663012 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:40:59.663276 0.108184 tcp 10.0.2.110 49855 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 22:40:59.794732 0.116897 tcp 10.0.2.110 49856 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 22:46:21.217110 3.001267 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:46:28.226665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:46:36.225371 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:46:52.228490 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:47:24.234988 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:53:28.240621 3.001806 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 22:53:35.247942 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:53:43.249498 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:53:59.252954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 22:54:31.263054 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:00:35.265206 3.003002 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:00:42.272078 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:00:50.273216 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:01:06.276285 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:01:38.282787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:07:42.288492 3.003750 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:07:49.298491 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:07:57.297099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:08:13.300096 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:08:45.306752 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:10:59.671269 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:10:59.671547 0.106408 tcp 10.0.2.110 49857 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 23:10:59.802621 0.118667 tcp 10.0.2.110 49858 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 23:11:03.221756 0.010975 udp 10.0.2.110 63839 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/06 23:11:03.233441 0.118852 tcp 10.0.2.110 49859 -> 37.19.5.65 80 FSPA* 0 0 13 5638 flow=From-Botnet-V1-TCP-Established 1970/01/06 23:14:49.311635 3.022633 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:14:56.339788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:15:04.342485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:15:20.344462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:15:52.350240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:22:01.364478 3.012408 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:22:08.384448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:22:16.382661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:22:32.385570 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:23:04.391318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:29:08.397689 3.001585 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:29:15.404964 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:29:23.406669 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:29:39.409620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:30:11.415427 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:36:15.421551 3.011664 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:36:22.438796 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:36:30.440226 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:36:46.443480 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:37:18.449458 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:40:59.679716 0.017089 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:40:59.696894 0.106073 tcp 10.0.2.110 49860 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/06 23:40:59.830664 0.115319 tcp 10.0.2.110 49861 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/06 23:43:22.455236 3.012016 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:43:29.472965 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:43:37.474532 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:43:53.477759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:44:25.483485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:50:29.489772 3.015192 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:50:36.507176 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:50:44.508539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:51:00.511444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:51:32.517206 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:57:36.523020 3.331553 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/06 23:57:43.817854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:57:51.752042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:58:07.602589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/06 23:58:39.561590 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:04:45.570303 3.264267 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:04:52.805522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:05:00.730161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:05:16.592832 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:05:50.004421 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:10:59.687109 0.000060 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:10:59.687384 0.106263 tcp 10.0.2.110 49862 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 00:10:59.818316 0.106097 tcp 10.0.2.110 49863 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 00:11:52.613716 3.002283 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:11:59.621616 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:12:07.623318 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:12:23.626319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:12:56.044367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:18:59.658131 3.001653 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:19:06.691173 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:19:14.690516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:19:30.690424 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:20:02.695656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:26:06.702073 3.002410 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:26:13.709551 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:26:21.711047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:26:37.714180 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:27:10.822091 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:33:13.735421 3.002582 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:33:20.743596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:33:28.745256 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:33:44.748257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:34:16.754443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:40:20.760209 3.001751 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:40:27.767611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:40:36.506613 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:40:52.299266 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:41:00.103637 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:41:00.103742 0.106085 tcp 10.0.2.110 49864 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 00:41:00.234972 0.115214 tcp 10.0.2.110 49865 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 00:41:23.917435 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:47:27.804407 3.001675 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:47:34.811448 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:47:42.813322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:47:58.816358 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:48:30.822208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:54:34.827658 3.001852 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 00:54:41.835430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:54:49.837138 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:55:05.839497 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 00:55:37.846639 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:01:44.867168 3.001006 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:01:52.061141 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:01:59.988527 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:02:15.878399 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:02:48.766244 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:08:51.890675 3.001044 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:08:58.897665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:09:06.899363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:09:23.023082 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:09:54.918122 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:10:59.703778 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:10:59.703896 0.115030 tcp 10.0.2.110 49866 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 01:10:59.849118 0.117764 tcp 10.0.2.110 49867 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 01:15:58.923921 3.002492 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:16:05.931986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:16:13.933135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:16:33.930068 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:17:06.229184 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:23:05.968746 3.001591 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:23:12.976311 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:23:20.977263 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:23:36.979992 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:24:08.986440 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:30:12.994000 3.000187 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:30:19.999469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:30:28.001278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:30:44.004257 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:31:16.010201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:37:20.016387 3.002048 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:37:27.023669 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:37:35.025624 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:37:51.028340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:38:23.034479 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:40:59.712183 0.000071 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:40:59.712306 0.116864 tcp 10.0.2.110 49868 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 01:40:59.853881 0.108295 tcp 10.0.2.110 49869 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 01:44:27.039842 3.001916 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:44:34.047852 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:44:42.049499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:44:58.054101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:45:30.058378 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:52:20.070465 3.004282 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:52:27.077991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:52:35.079524 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:52:51.082588 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:53:23.088629 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:59:28.096039 3.011420 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 01:59:35.112949 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:59:43.114651 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 01:59:59.117808 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:00:31.126709 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:06:35.130545 3.001027 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:06:42.137383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:06:50.138842 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:07:06.141785 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:07:38.148614 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:10:59.720069 0.000074 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:10:59.720235 0.114979 tcp 10.0.2.110 49870 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 02:10:59.864679 0.108134 tcp 10.0.2.110 49871 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 02:13:42.154490 3.011096 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:13:49.171236 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:13:57.172920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:14:13.175978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:14:45.181721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:20:49.188071 3.001334 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:20:56.196626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:21:04.196776 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:21:20.200001 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:21:52.206370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:27:56.223346 3.000052 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:28:03.229853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:28:11.230733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:28:27.233869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:28:59.241421 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:35:03.245762 3.004666 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:35:10.253220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:35:18.254944 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:35:34.257717 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:36:06.263601 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:40:59.727282 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:40:59.727455 0.115333 tcp 10.0.2.110 49872 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 02:40:59.868201 0.115072 tcp 10.0.2.110 49873 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 02:42:10.270029 3.006714 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:42:17.278917 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:42:25.278691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:42:41.281577 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:43:13.295913 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:49:17.293479 3.001946 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:49:24.300720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:49:32.302672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:49:48.305769 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:50:20.311714 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:56:24.320378 2.998990 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 02:56:31.324804 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:56:39.326493 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:56:55.329408 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 02:57:27.335388 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:03:33.344250 3.001828 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:03:40.352178 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:03:48.354470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:04:04.356364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:04:36.362686 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:10:40.368265 3.003276 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:10:47.375708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:10:55.377334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:10:59.736145 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:10:59.736247 0.115013 tcp 10.0.2.110 49874 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 03:10:59.881184 0.106623 tcp 10.0.2.110 49875 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 03:11:03.226658 0.009738 udp 10.0.2.110 52739 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 03:11:03.237097 0.108038 tcp 10.0.2.110 49876 -> 37.19.5.65 80 FSPA* 0 0 13 5586 flow=From-Botnet-V1-TCP-Established 1970/01/07 03:11:11.380325 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:11:43.386255 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:17:47.392830 3.001497 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:17:54.399462 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:18:02.401239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:18:18.404411 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:18:50.410121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:24:54.416956 3.003801 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:25:01.423776 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:25:09.425470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:25:25.428280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:25:57.440108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:32:01.441495 3.000424 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:32:08.447867 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:32:16.449225 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:32:32.452466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:33:04.458443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:39:08.463852 3.001988 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:39:15.471564 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:39:23.473039 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:39:39.480570 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:40:11.482868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:40:59.744325 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:40:59.744421 0.114810 tcp 10.0.2.110 49877 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 03:40:59.885936 0.114648 tcp 10.0.2.110 49878 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 03:46:15.488600 3.001028 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:46:22.495565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:46:30.497141 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:46:46.499962 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:47:18.510726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:53:22.513173 3.000661 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 03:53:29.520350 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:53:37.521219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:53:53.524203 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 03:54:25.529764 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:00:29.537070 3.000853 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:00:36.543794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:00:44.544540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:01:00.549256 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:01:32.554432 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:07:36.560419 3.001301 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:07:43.569738 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:07:51.568977 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:08:07.572253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:08:39.578416 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:10:59.752687 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:10:59.752812 0.115064 tcp 10.0.2.110 49879 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 04:10:59.892683 0.115069 tcp 10.0.2.110 49880 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 04:14:43.584531 3.001758 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:14:50.591603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:14:58.594606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:15:14.595412 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:15:46.601819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:21:50.608468 3.001279 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:21:57.615654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:22:05.617211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:22:21.620135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:22:53.626152 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:28:57.632138 3.001797 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:29:04.638999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:29:12.640991 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:29:28.643554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:30:00.649874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:36:04.655803 3.001383 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:36:11.663428 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:36:19.666620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:36:35.668597 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:37:07.674288 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:40:59.761177 0.000063 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:40:59.761299 0.115377 tcp 10.0.2.110 49881 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 04:40:59.904670 0.117940 tcp 10.0.2.110 49882 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 04:43:11.683066 2.998537 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:43:18.687557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:43:26.688976 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:43:42.692015 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:44:14.697862 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:50:18.704456 3.001052 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:50:25.710923 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:50:33.712988 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:50:49.715794 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:51:21.721888 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:57:25.729024 3.000136 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 04:57:32.735368 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:57:40.736760 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:57:56.739304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 04:58:28.746193 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:04:32.753159 3.000576 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:04:39.759165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:04:47.760759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:05:03.763999 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:05:35.769947 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:10:59.769598 0.000077 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:10:59.769715 1.760676 tcp 10.0.2.110 49883 -> 37.19.5.10 80 FSPA* 0 0 11 996 flow=From-Botnet-V1-TCP-Established 1970/01/07 05:10:59.913111 0.115729 tcp 10.0.2.110 49884 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 05:11:39.775521 3.002006 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:11:46.783348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:11:54.787116 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:12:10.787816 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:12:42.794755 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:18:46.801135 3.000690 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:18:53.807404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:19:01.808940 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:19:17.811691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:19:49.818516 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:25:53.824712 3.000968 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:26:00.831267 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:26:08.832790 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:26:24.836308 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:26:56.841611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:33:00.848322 3.002079 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:33:07.855338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:33:15.856751 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:33:31.859515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:34:03.865845 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:40:07.872938 3.000323 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:40:14.879129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:40:22.880731 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:40:38.884372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:40:59.775615 0.000111 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:40:59.775809 0.118133 tcp 10.0.2.110 49885 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 05:40:59.917666 0.118015 tcp 10.0.2.110 49886 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 05:41:10.889392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:47:14.896457 3.001057 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:47:21.903162 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:47:29.904547 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:47:45.907531 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:48:17.914398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:54:21.920335 3.011767 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 05:54:28.927166 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:54:36.930221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:54:52.931445 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 05:55:24.937537 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:01:32.949808 3.004685 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:01:39.957076 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:01:47.958502 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:02:03.961144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:02:35.967617 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:08:39.973314 3.003443 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:08:46.982974 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:08:54.982052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:09:10.985144 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:09:42.991185 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:10:59.784341 0.000059 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:10:59.784467 0.116735 tcp 10.0.2.110 49887 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 06:10:59.925573 0.118060 tcp 10.0.2.110 49888 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 06:15:46.998489 3.000249 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:15:54.004801 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:16:02.006322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:16:18.009190 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:16:50.015470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:22:54.022340 3.000744 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:23:01.028870 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:23:09.029800 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:23:25.033530 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:23:57.039379 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:30:01.045355 3.001274 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:30:08.052044 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:30:16.054477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:30:32.057175 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:31:04.063413 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:37:08.070332 3.000401 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:37:15.076611 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:37:23.078048 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:37:39.081192 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:38:11.087120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:40:59.791613 0.000053 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:40:59.791757 0.117293 tcp 10.0.2.110 49889 -> 37.19.5.10 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 06:40:59.934424 0.108931 tcp 10.0.2.110 49890 -> 37.19.5.10 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 06:44:15.093548 3.012561 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:44:22.110791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:44:30.112002 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:44:46.114935 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:45:18.121219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:52:18.127807 3.001675 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:52:25.135010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:52:34.890280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:52:50.689073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:53:22.284073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:59:31.171038 3.001196 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 06:59:38.177683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 06:59:46.179138 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:00:02.182467 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:00:34.188463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:06:38.194461 3.001824 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:06:45.202150 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:06:53.204011 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:07:09.209404 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:07:41.212348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:10:57.409485 0.000089 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:10:57.409656 0.010025 udp 10.0.2.110 63972 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/07 07:10:57.420349 0.177877 tcp 10.0.2.110 49891 -> 37.19.5.22 80 SPA_* 0 0 28 17574 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:10:59.800412 0.009864 udp 10.0.2.110 53974 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/07 07:10:59.810730 0.126936 tcp 10.0.2.110 49892 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:10:59.969131 0.117747 tcp 10.0.2.110 49893 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:11:03.227631 0.011266 udp 10.0.2.110 49397 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 07:11:03.239677 0.116631 tcp 10.0.2.110 49894 -> 37.19.5.65 80 FSPA* 0 0 13 5577 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:11:04.875152 0.010175 udp 10.0.2.110 65216 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/07 07:11:04.903115 0.117828 tcp 10.0.2.110 49895 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:11:27.597116 0.000201 tcp 10.0.2.110 49891 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:13:45.218478 3.001261 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/07 07:13:52.225557 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:14:00.227046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:14:16.230361 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:14:48.236345 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:20:52.242342 3.001857 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:20:59.249549 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:21:07.251120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:21:23.253971 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:21:55.260304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:27:59.266325 3.005939 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:28:06.276868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:28:14.275083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:28:30.278280 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:29:02.284094 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:35:06.289561 3.002095 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:35:13.297334 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:35:21.298650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:35:37.302311 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:36:09.308214 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:40:59.807650 0.000066 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:40:59.807793 0.117488 tcp 10.0.2.110 49896 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:40:59.925383 0.000087 tcp 10.0.2.110 49891 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/07 07:40:59.949928 0.118826 tcp 10.0.2.110 49897 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 07:42:13.313861 3.001924 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:42:20.321452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:42:28.322880 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:42:44.326218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:43:16.331963 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:49:20.342005 2.997410 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:49:27.345436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:49:35.346797 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:49:51.349924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:50:23.355978 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:56:27.361608 3.002124 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 07:56:34.369423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:56:42.370977 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:56:58.373823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 07:57:30.380592 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:03:35.387424 3.001642 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:03:42.395246 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:03:50.398456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:04:06.399135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:04:38.406148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:10:42.410475 3.002735 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:10:49.418995 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:10:57.419924 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:10:59.821899 0.000069 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:10:59.822048 0.108584 tcp 10.0.2.110 49898 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 08:10:59.959999 0.108361 tcp 10.0.2.110 49899 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 08:11:13.423336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:11:45.429547 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:17:49.435762 3.001408 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:17:56.442696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:18:04.444351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:18:20.447174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:18:52.452787 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:24:56.458484 3.002498 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:25:03.466667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:25:11.468201 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:25:27.471080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:25:59.477584 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:32:03.484497 3.000237 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:32:10.490108 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:32:18.492083 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:32:34.495130 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:33:06.501163 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:39:10.509115 2.999756 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:39:17.515018 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:39:25.516168 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:39:41.518818 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:40:13.525121 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:40:59.823541 0.000113 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:40:59.823752 0.114962 tcp 10.0.2.110 49900 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 08:40:59.963435 0.117559 tcp 10.0.2.110 49901 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 08:46:17.531819 3.001042 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:46:24.538087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:46:32.540191 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:46:48.543037 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:47:20.549227 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:53:24.554847 3.013439 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 08:53:31.574370 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:53:39.574469 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:53:55.577232 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 08:54:27.583047 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:00:31.589187 3.001460 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:00:38.596805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:00:46.597959 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:01:02.601200 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:01:34.606956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:07:38.613090 3.011578 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:07:45.630129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:07:53.631933 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:08:09.634929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:08:41.641052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:10:59.832157 0.000051 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:10:59.832250 0.108286 tcp 10.0.2.110 49902 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 09:10:59.970263 0.117378 tcp 10.0.2.110 49903 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 09:14:45.652967 3.006208 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:14:52.664369 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:15:00.665649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:15:16.670372 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:15:48.674868 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:21:52.681645 3.000988 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:21:59.688567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:22:07.689487 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:22:23.692929 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:22:55.699219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:28:59.705126 3.002023 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:29:06.712336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:29:14.713873 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:29:30.716895 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:30:02.723034 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:36:06.729267 3.001246 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:36:13.736482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:36:21.737656 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:36:37.741039 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:37:09.748667 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:40:59.840248 0.000047 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:40:59.840370 0.108573 tcp 10.0.2.110 49904 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 09:40:59.976954 0.114829 tcp 10.0.2.110 49905 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 09:43:13.753556 3.011156 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:43:20.769886 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:43:28.771773 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:43:44.774857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:44:16.780954 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:50:20.786997 3.022355 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:50:27.804364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:50:35.805905 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:50:51.809070 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:51:23.814926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:57:27.834553 3.016515 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 09:57:34.848496 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:57:42.849463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:57:58.852689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 09:58:30.859164 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:04:35.867752 3.030540 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:04:42.883780 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:04:50.885342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:05:06.888374 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:05:38.893850 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:10:59.847658 0.027502 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:10:59.875328 0.837336 tcp 10.0.2.110 49906 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 10:11:00.736617 0.108717 tcp 10.0.2.110 49907 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 10:11:42.910203 3.359723 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:11:50.241316 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:11:58.162594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:12:14.009423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:12:45.938539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:18:49.945267 3.024309 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:18:56.962080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:19:04.963423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:19:20.966827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:19:52.982595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:25:56.989075 3.027313 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:26:04.008128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:26:12.007322 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:26:28.010423 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:27:00.016589 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:33:04.033414 3.024737 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:33:11.049851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:33:19.051102 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:33:35.054403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:34:07.060442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:40:11.080274 3.306670 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:40:18.353120 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:40:26.276465 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:40:42.125817 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:40:59.857557 0.018775 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:40:59.876495 0.106270 tcp 10.0.2.110 49908 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 10:41:00.014180 0.116948 tcp 10.0.2.110 49909 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 10:41:14.104515 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:47:18.110862 3.020710 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:47:25.128286 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:47:33.129354 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:47:49.132415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:48:21.138355 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:54:25.143936 3.001869 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 10:54:32.151640 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:54:40.153239 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:54:56.156459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 10:55:28.162521 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:01:36.173609 3.002080 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:01:43.181256 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:01:51.183125 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:02:07.190890 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:02:39.193240 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:08:43.199076 3.001198 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:08:50.205641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:08:58.206891 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:09:14.212528 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:09:46.215854 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:10:59.863757 0.000231 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:10:59.864058 0.114894 tcp 10.0.2.110 49910 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 11:11:00.003801 0.114863 tcp 10.0.2.110 49911 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 11:11:03.232306 0.009934 udp 10.0.2.110 62028 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 11:11:03.243002 0.128821 tcp 10.0.2.110 49912 -> 37.19.5.65 80 FSPA* 0 0 13 5586 flow=From-Botnet-V1-TCP-Established 1970/01/07 11:15:50.222022 3.011501 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:15:57.239329 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:16:05.240844 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:16:21.244187 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:16:53.250569 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:22:57.255765 3.025573 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:23:04.273186 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:23:12.274767 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:23:28.277823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:24:00.283830 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:30:04.289352 3.002249 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:30:11.297360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:30:19.298721 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:30:35.302233 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:31:07.307595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:37:11.317483 2.998411 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:37:18.321099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:37:26.323028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:37:42.327101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:38:14.331595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:40:59.872785 0.000125 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:40:59.872995 0.117685 tcp 10.0.2.110 49913 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 11:41:00.015455 0.117700 tcp 10.0.2.110 49914 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 11:44:18.339317 3.013550 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:44:25.381723 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:44:33.356380 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:44:49.359836 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:45:21.368706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:52:18.378450 3.023993 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:52:25.395595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:52:33.397351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:52:49.399553 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:53:21.406002 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:59:30.419161 3.001836 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 11:59:37.430672 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 11:59:45.430384 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:00:01.431174 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:00:33.436727 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:06:37.442773 3.028209 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:06:44.460210 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:06:52.462470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:07:08.464754 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:07:40.470939 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:10:59.879877 0.000046 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:10:59.879974 0.127544 tcp 10.0.2.110 49915 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 12:11:00.031669 0.115108 tcp 10.0.2.110 49916 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 12:13:44.477375 3.017949 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:13:51.810315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:13:59.732128 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:14:15.579002 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:14:47.514968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:20:51.522363 3.062859 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:20:58.565333 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:21:09.454061 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:21:25.228471 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:21:56.779995 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:27:58.565997 3.000612 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:28:05.572699 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:28:13.573383 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:28:29.577080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:29:01.583127 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:35:05.601821 3.027234 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:35:12.616539 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:35:20.617939 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:35:36.620576 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:36:08.627052 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:40:59.887649 0.113737 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:41:00.001525 0.116890 tcp 10.0.2.110 49917 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 12:41:00.142353 0.117670 tcp 10.0.2.110 49918 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 12:42:12.643086 3.101723 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:42:19.717443 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:42:27.662230 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:42:43.664899 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:43:16.012087 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:49:19.678634 3.025078 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:49:26.694575 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:49:34.696236 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:49:50.699058 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:50:22.704882 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:56:26.720441 3.018857 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 12:56:33.739188 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:56:41.739715 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:56:57.743033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 12:57:29.749000 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:03:35.758463 3.061947 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:03:42.795410 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:03:50.777023 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:04:06.779328 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:04:38.788630 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:10:42.792199 3.113165 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:10:49.879298 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:10:57.810788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:10:59.896392 0.000072 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:10:59.896513 0.114857 tcp 10.0.2.110 49919 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 13:11:00.041063 0.117061 tcp 10.0.2.110 49920 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 13:11:13.813661 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:11:45.820007 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:17:49.826973 3.089536 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:17:56.901057 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:18:04.846475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:18:20.847642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:18:52.853803 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:24:56.860339 3.058423 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:25:03.894261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:25:11.878986 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:25:27.881838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:25:59.887831 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:32:03.893934 3.110197 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:32:10.973451 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:32:23.498310 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:32:39.285662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:33:10.845696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:39:10.941080 3.229808 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:39:18.137033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:39:26.060441 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:39:47.391951 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:40:21.400006 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:41:06.661865 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:41:06.662021 0.108323 tcp 10.0.2.110 49921 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 13:41:06.802009 0.114936 tcp 10.0.2.110 49922 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 13:46:20.326440 3.058164 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:46:27.335219 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:46:35.219820 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:46:52.886893 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:47:24.435716 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:53:25.046226 3.026631 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 13:53:32.063249 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:53:40.065057 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:53:56.067573 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 13:54:28.074485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:00:32.080511 3.070415 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:00:39.129736 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:00:47.098871 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:01:03.101885 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:01:35.107827 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:07:39.115129 3.117134 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:07:46.202074 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:07:54.132851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:08:10.135579 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:08:42.141662 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:10:59.912031 0.016951 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:10:59.929089 0.115211 tcp 10.0.2.110 49923 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 14:11:00.069511 0.116974 tcp 10.0.2.110 49924 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 14:14:46.157595 3.022757 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:14:53.175056 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:15:01.176654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:15:17.179363 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:15:49.185835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:21:53.521452 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:21:59.741532 1.974212 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 2 294 flow=Background 1970/01/07 14:22:05.668019 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:22:19.730920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:22:35.510623 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:23:07.064753 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:29:06.176654 2.963054 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:29:13.088066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:29:20.980060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:29:36.761211 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:30:08.311066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:36:07.278887 3.025185 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:36:14.277010 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:36:22.288361 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:36:38.291676 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:37:10.297565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:40:59.920144 0.318007 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:41:00.238390 0.114438 tcp 10.0.2.110 49925 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 14:41:00.381927 0.115137 tcp 10.0.2.110 49926 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 14:43:14.304114 3.025423 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:43:21.320926 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:43:29.322626 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:43:45.325442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:44:17.331503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:50:21.337890 3.025232 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:50:28.365359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:50:36.366643 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:50:52.369386 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:51:24.375531 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:57:28.382377 3.169086 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 14:57:35.522238 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:57:43.446718 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:57:59.413771 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 14:58:31.419914 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:04:37.428496 3.065041 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:04:44.466734 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:04:53.006242 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:05:08.810008 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:05:40.465956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:10:59.928389 0.010906 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:10:59.939380 0.117236 tcp 10.0.2.110 49927 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 15:11:00.081411 0.116982 tcp 10.0.2.110 49928 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 15:11:03.235353 0.010194 udp 10.0.2.110 57867 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 15:11:03.246230 0.859123 tcp 10.0.2.110 49929 -> 37.19.5.65 80 FSPA* 0 0 13 5677 flow=From-Botnet-V1-TCP-Established 1970/01/07 15:11:44.471998 3.001590 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:11:51.479642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:12:04.751430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:12:20.526647 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:12:52.077208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:18:51.506657 3.034844 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:18:58.524276 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:19:06.525420 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:19:22.528285 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:19:54.534896 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:25:58.539876 3.024784 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:26:05.557848 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:26:13.559500 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:26:29.562673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:27:01.570364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:33:05.574115 3.025083 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:33:12.592319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:33:20.596415 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:33:36.596585 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:34:08.602689 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:40:12.609998 3.022648 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:40:19.626420 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:40:27.627483 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:40:43.630526 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:40:59.936677 0.000100 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:40:59.936877 0.117493 tcp 10.0.2.110 49930 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 15:41:00.078003 0.117309 tcp 10.0.2.110 49931 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 15:41:15.636613 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:47:19.642244 3.026671 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:47:26.669901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:47:34.671399 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:47:50.674704 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:48:22.680438 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:54:26.686855 3.000633 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 15:54:33.693749 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:54:41.695226 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:54:57.698420 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 15:55:29.704503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:01:36.715468 3.028758 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:01:43.732336 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:01:51.733669 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:02:12.415111 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:02:43.971809 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:08:43.859253 2.955073 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:08:50.766299 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:08:58.767544 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:09:14.770733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:09:46.776758 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:10:59.943774 0.000179 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:10:59.944041 0.116739 tcp 10.0.2.110 49932 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 16:11:00.084913 0.106246 tcp 10.0.2.110 49933 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 16:15:50.782034 3.026065 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:15:57.799511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:16:05.802634 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:16:21.804775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:16:53.810839 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:22:57.816857 3.079403 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:23:04.868920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:23:12.835625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:23:28.838869 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:24:00.844918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:30:04.850779 3.001437 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:30:11.858353 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:30:19.859660 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:30:35.862838 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:31:07.868603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:37:11.882047 3.018939 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:37:18.892367 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:37:26.893403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:37:42.896791 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:38:14.902525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:40:59.951871 0.000067 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:40:59.951994 0.115296 tcp 10.0.2.110 49934 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 16:41:00.093220 0.117070 tcp 10.0.2.110 49935 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 16:44:18.909218 3.015980 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:44:25.926338 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:44:33.927422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:44:49.930594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:45:21.937530 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:52:17.947532 3.021782 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:52:24.964936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:52:32.966422 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:52:48.969392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:53:20.975307 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:59:29.988367 3.060457 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 16:59:37.023554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 16:59:45.007513 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:00:01.010500 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:00:33.018463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:06:37.022941 3.053860 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:06:44.055862 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:06:52.041391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:07:08.044398 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:07:40.050554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:10:57.409482 0.000058 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:10:57.409601 0.009526 udp 10.0.2.110 61172 <-> 8.8.8.8 53 CON 0 0 2 156 flow=From-Botnet-V1-DNS 1970/01/07 17:10:57.419737 0.179928 tcp 10.0.2.110 49936 -> 37.19.5.22 80 SPA_* 0 0 28 17574 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:10:59.959468 0.009668 udp 10.0.2.110 56108 <-> 8.8.8.8 53 CON 0 0 2 202 flow=From-Botnet-V1-DNS 1970/01/07 17:10:59.969580 0.108091 tcp 10.0.2.110 49937 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:11:00.106185 0.114616 tcp 10.0.2.110 49938 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:11:05.016391 0.108905 tcp 10.0.2.110 49939 -> 37.19.5.82 80 FSPA* 0 0 10 1494 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:11:27.579065 0.000139 tcp 10.0.2.110 49936 -> 37.19.5.22 80 A_FA 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:13:44.057771 3.022013 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 INT 0 3 441 flow=Background 1970/01/07 17:13:51.074178 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:13:59.075389 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:14:15.078603 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:14:47.706073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:20:51.100760 3.019472 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:20:58.118031 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:21:06.129505 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:21:22.132161 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:21:54.138522 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:27:58.145234 3.112345 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:28:05.229387 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:28:13.165221 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:28:29.166485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:29:01.173604 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:35:05.179797 3.035415 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:35:12.205898 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:35:20.216220 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:35:36.210482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:36:08.219186 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:40:59.968161 0.022171 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:40:59.990517 0.117576 tcp 10.0.2.110 49940 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:41:00.108308 0.000031 tcp 10.0.2.110 49936 37.19.5.22 80 RA_ 0 0 2 108 flow=Background 1970/01/07 17:41:00.137673 0.115372 tcp 10.0.2.110 49941 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 17:42:12.222749 3.001560 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:42:19.229835 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:42:27.231248 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:42:43.234292 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:43:15.240685 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:49:19.246693 3.029374 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:49:26.263790 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:49:34.265668 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:49:50.268155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:50:22.274361 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:56:26.280421 3.023383 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 17:56:33.297659 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:56:41.299145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:56:57.302637 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 17:57:29.308247 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:03:35.317416 3.090796 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:03:42.382476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:03:50.346348 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:04:06.349331 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:04:38.355160 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:10:42.361124 3.002095 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:10:49.368598 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:10:57.370406 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:10:59.975980 0.000056 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:10:59.976088 0.114861 tcp 10.0.2.110 49942 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 18:11:00.122417 0.114648 tcp 10.0.2.110 49943 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 18:11:13.373696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:11:45.379286 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:17:49.385159 3.002020 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:17:56.393009 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:18:04.394360 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:18:20.397216 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:18:52.403093 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:24:56.412127 3.015909 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:25:03.426618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:25:11.428243 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:25:27.430977 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:25:59.437099 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:32:03.442848 3.026303 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:32:10.470595 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:32:18.474988 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:32:34.474977 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:33:06.480676 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:39:10.487245 3.001597 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:39:17.494671 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:39:25.496476 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:39:41.498768 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:40:13.505264 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:40:59.984626 0.000127 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:40:59.984861 0.117011 tcp 10.0.2.110 49944 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 18:41:00.131448 0.108195 tcp 10.0.2.110 49945 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 18:46:17.513415 3.016808 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:46:24.528313 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:46:32.530101 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:46:48.533301 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:47:20.539430 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:53:24.546235 3.023905 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 18:53:31.562433 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:53:39.566391 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:53:55.567142 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 18:54:27.573028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:00:31.580250 3.014959 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:00:38.596470 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:00:46.597618 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:01:02.601158 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:01:34.607278 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:07:38.612686 3.036824 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:07:45.630652 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:07:53.631883 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:08:09.634981 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:08:41.641072 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:10:59.992062 0.000054 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:10:59.992209 0.106116 tcp 10.0.2.110 49946 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 19:11:00.122875 0.108287 tcp 10.0.2.110 49947 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 19:11:03.239672 0.009877 udp 10.0.2.110 65530 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 19:11:03.250424 0.115815 tcp 10.0.2.110 49948 -> 37.19.5.65 80 FSPA* 0 0 13 5677 flow=From-Botnet-V1-TCP-Established 1970/01/07 19:14:45.647143 3.021303 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:14:52.664444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:15:00.666109 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:15:16.669053 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:15:48.676463 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:21:52.681339 3.745565 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:22:00.384519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:22:08.284060 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:22:24.087598 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:22:55.709049 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:28:59.715766 3.026417 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:29:06.738304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:29:14.733861 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:29:30.736961 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:30:02.746477 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:36:06.749189 3.028187 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:36:13.772165 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:36:21.768442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:36:37.771149 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:37:09.776950 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:41:00.000837 0.040902 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:41:00.041884 0.108433 tcp 10.0.2.110 49949 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 19:41:00.181763 0.108713 tcp 10.0.2.110 49950 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 19:43:13.783276 3.016289 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:43:20.800675 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:43:28.801918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:43:44.809132 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:44:16.811080 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:50:20.817480 3.022901 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:50:27.834437 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:50:35.835798 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:50:51.839066 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:51:23.844973 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:57:27.851180 3.050347 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 19:57:34.883766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:57:42.869970 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:57:58.872958 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 19:58:30.879154 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:04:34.885286 3.022424 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:04:41.902628 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:04:49.903853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:05:05.907188 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:05:37.913554 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:11:00.008288 0.033752 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:11:00.042225 0.132908 tcp 10.0.2.110 49951 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 20:11:00.198365 0.125038 tcp 10.0.2.110 49952 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 20:11:41.921309 2.999292 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:11:50.896834 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:11:58.798429 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:12:14.593819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:12:46.208953 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:18:48.953036 3.025277 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:18:55.969901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:19:03.971665 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:19:19.975028 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:19:51.981027 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:25:55.986821 3.019306 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:26:03.004555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:26:11.005711 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:26:27.009042 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:26:59.016514 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:33:03.031034 3.013109 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:33:10.048397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:33:18.050215 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:33:34.052759 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:34:06.058764 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:40:10.064415 3.002043 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:40:17.072508 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:40:25.073654 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:40:41.076843 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:41:00.016703 0.000099 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:41:00.016893 0.115359 tcp 10.0.2.110 49953 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 20:41:00.157029 0.117837 tcp 10.0.2.110 49954 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 20:41:13.082855 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:47:17.089210 3.025545 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:47:24.106567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:47:32.107519 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:47:48.110894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:48:20.117024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:54:24.122917 3.008200 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 20:54:31.130312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:54:39.131444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:54:55.134644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 20:55:27.140782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:01:34.150762 3.057982 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:01:41.190245 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:01:49.169894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:02:05.173323 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:02:37.179205 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:08:41.185476 3.030865 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:08:48.202968 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:08:56.204456 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:09:12.206995 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:09:44.213169 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:11:00.102899 0.000070 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:11:00.103043 0.117009 tcp 10.0.2.110 49955 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 21:11:00.244227 0.108365 tcp 10.0.2.110 49956 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 21:15:48.219580 3.022109 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:15:55.238207 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:16:01.661535 0.000064 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:16:01.661718 0.033528 udp 10.0.2.110 57387 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 21:16:01.695866 0.146647 tcp 10.0.2.110 49957 -> 37.19.5.19 80 FSPA* 0 0 10 980 flow=From-Botnet-V1-TCP-Established 1970/01/07 21:16:03.242679 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:16:19.296503 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:16:51.247167 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:22:55.252858 3.036220 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:23:02.270555 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:23:10.272057 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:23:26.344364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:23:58.568032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:30:02.286543 3.027707 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:30:09.314708 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:30:17.316310 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:30:33.318720 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:31:05.331766 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:37:09.332273 3.017454 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:37:16.348358 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:37:24.349807 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:37:40.352894 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:38:12.359038 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:41:00.031767 0.000219 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:41:00.032067 0.199766 tcp 10.0.2.110 49958 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 21:41:00.164515 0.184601 tcp 10.0.2.110 49959 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 21:44:16.365391 3.001634 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:44:23.372596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:44:31.373855 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:44:47.378930 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:45:19.382936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:52:15.393687 3.029329 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:52:22.412198 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:52:30.412586 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:52:46.417685 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:53:18.421535 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:59:26.435643 3.021713 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 21:59:33.450351 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:59:41.452641 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 21:59:57.455485 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:00:29.461392 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:06:33.467290 3.023701 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:06:40.484851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:06:48.486357 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:07:04.489567 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:07:36.495487 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:11:00.040234 0.000055 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:11:00.040330 0.106445 tcp 10.0.2.110 49960 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 22:11:00.172275 0.115263 tcp 10.0.2.110 49961 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 22:13:40.501238 3.001872 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:13:47.508936 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:13:55.509696 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:14:11.513419 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:14:43.519055 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:20:53.305699 3.135884 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:21:00.385828 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:21:08.276145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:21:24.050180 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:21:55.596444 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:27:55.060966 3.023202 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:28:02.077620 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:28:10.079046 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:28:26.082272 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:28:58.088208 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:35:02.105200 3.000744 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:35:09.111488 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:35:17.112918 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:35:33.116139 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:36:05.121792 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:41:00.438685 0.000075 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:41:00.438837 0.117441 tcp 10.0.2.110 49962 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 22:41:00.606778 0.114942 tcp 10.0.2.110 49963 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 22:42:09.128425 3.001415 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:42:16.135649 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:42:24.136713 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:42:40.139499 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:43:12.147874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:49:16.176262 2.997451 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:49:23.179788 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:49:31.181337 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:49:47.184155 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:50:19.189782 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:56:23.196522 3.001336 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 22:56:30.203403 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:56:38.204956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:56:54.208157 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 22:57:26.213956 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:03:32.222576 3.001854 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:03:39.230335 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:03:47.231805 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:04:03.235024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:04:35.240881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:10:39.248539 3.024939 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:10:46.264385 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:10:54.265819 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:11:00.446407 0.000073 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:11:00.446556 0.108169 tcp 10.0.2.110 49964 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 23:11:00.578501 0.117146 tcp 10.0.2.110 49965 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 23:11:04.053250 0.009939 udp 10.0.2.110 55113 <-> 8.8.8.8 53 CON 0 0 2 170 flow=From-Botnet-V1-DNS 1970/01/07 23:11:04.144319 0.127673 tcp 10.0.2.110 49966 -> 37.19.5.65 80 FSPA* 0 0 13 5650 flow=From-Botnet-V1-TCP-Established 1970/01/07 23:11:10.268843 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:11:42.274700 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:17:46.287802 3.017888 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:17:53.298030 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:18:01.299540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:18:17.302799 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:18:49.308511 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:24:53.315126 3.001665 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:25:00.322148 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:25:08.327020 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:25:24.326693 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:25:56.332744 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:32:00.338930 3.000994 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:32:07.346135 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:32:15.347606 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:32:31.351304 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:33:03.356650 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:39:07.362604 3.002361 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:39:14.370272 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:39:22.371418 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:39:38.375032 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:40:10.380726 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:41:00.455057 0.000084 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:41:00.455219 0.117181 tcp 10.0.2.110 49967 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/07 23:41:00.595502 0.105989 tcp 10.0.2.110 49968 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/07 23:46:14.386467 3.001956 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:46:21.396952 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:46:29.395496 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:46:45.398482 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:47:17.404701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:53:41.021011 2.959873 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/07 23:53:47.932728 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:53:55.823545 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:54:11.603881 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/07 23:54:43.175312 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:00:42.205435 2.964519 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:00:49.119571 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:00:57.015599 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:01:12.802674 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:01:44.370907 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:07:43.422594 2.956737 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:07:50.330884 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:07:58.216359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:08:14.004115 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:08:45.581883 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:11:05.619260 0.000049 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:11:05.619353 0.117482 tcp 10.0.2.110 49969 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 00:11:05.761234 0.117392 tcp 10.0.2.110 49970 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/08 00:14:44.657800 2.960488 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:14:51.568397 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:14:59.452494 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:15:15.240745 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:15:46.807033 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:21:49.518152 3.022151 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:21:56.534737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:22:04.535540 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:22:20.538466 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:22:52.544596 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:28:56.549817 3.029629 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:29:03.572287 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:29:11.569145 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:29:27.572593 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:29:59.579261 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:36:03.585389 3.038241 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:36:10.601218 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:36:18.605340 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:36:34.606376 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:37:06.612375 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:41:00.470016 0.073490 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:41:00.543634 0.115205 tcp 10.0.2.110 49971 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 00:41:00.804078 0.117665 tcp 10.0.2.110 49972 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/08 00:43:10.620615 2.999508 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:43:17.625733 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:43:25.627442 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:43:41.644319 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:44:13.635853 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:50:17.642381 3.001395 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:50:24.649823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:50:32.651002 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:50:48.654129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:51:20.660594 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:57:24.666596 3.030426 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 00:57:31.683627 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:57:39.686297 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:57:55.688436 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 00:58:27.694558 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:04:36.928024 3.052846 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:04:43.960107 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:04:51.946857 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:05:07.949821 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:05:39.956035 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:11:00.733530 0.035363 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:11:00.769033 0.108579 tcp 10.0.2.110 49973 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 01:11:01.056077 0.114688 tcp 10.0.2.110 49974 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/08 01:11:43.962030 3.001365 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:11:50.969104 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:11:58.970541 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:12:14.984402 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:12:46.989663 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:18:50.995479 3.025269 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:18:58.013342 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:19:06.014823 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:19:22.017625 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:19:54.024373 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:25:58.029895 3.001676 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:26:05.037090 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:26:13.038925 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:26:29.041960 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:27:01.047920 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:33:05.055147 3.023641 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:33:12.071359 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:33:20.072851 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:33:36.078264 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:34:08.081704 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:40:12.087875 3.001648 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:40:19.095129 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:40:27.096628 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:40:43.099739 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:41:00.708653 0.000090 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:41:00.708833 0.105664 tcp 10.0.2.110 49975 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 01:41:00.838326 0.115344 tcp 10.0.2.110 49976 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/08 01:41:15.105737 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:47:19.112606 3.000669 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:47:26.119024 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:47:34.120622 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:47:50.123587 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:48:22.129756 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:54:26.137135 3.000118 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 01:54:33.143073 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:54:41.144568 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:54:57.147775 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 01:55:29.153812 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:01:39.169132 3.027228 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:01:46.185701 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:01:54.187092 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:02:10.190525 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:02:42.196550 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:08:47.203819 3.001699 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:08:54.211253 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:09:02.212691 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:09:18.215673 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:09:50.221565 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:11:00.719188 0.000057 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:11:00.719286 0.117976 tcp 10.0.2.110 49977 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 02:11:00.862251 0.114739 tcp 10.0.2.110 49978 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established 1970/01/08 02:15:54.227716 3.026560 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:16:01.246315 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:16:09.246874 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:16:25.249706 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:16:57.255459 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:23:01.261487 3.026835 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:23:08.280644 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:23:16.280159 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:23:32.283901 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:24:04.289683 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:30:08.295759 3.022476 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:30:15.313364 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:30:23.314878 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:30:39.317635 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:31:11.323642 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:37:15.329346 3.023142 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 3 441 flow=Background 1970/01/08 02:37:22.357078 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:37:30.358475 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:37:46.361481 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:38:18.367655 0.000000 udp fe80::31aa:edaf:e8df:b0f1 546 -> ff02::1:2 547 REQ 0 1 147 flow=Background 1970/01/08 02:41:00.772334 0.000097 arp 10.0.2.110 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:41:00.772523 0.108459 tcp 10.0.2.110 49979 -> 37.19.5.82 80 FSPA* 0 0 10 942 flow=From-Botnet-V1-TCP-Established 1970/01/08 02:41:00.975871 0.117727 tcp 10.0.2.110 49980 -> 37.19.5.82 80 FSPA* 0 0 10 931 flow=From-Botnet-V1-TCP-Established