StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:06.288661 3.004424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:00:06.527365 3.131678 arp 10.0.2.19 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:06.659507 1.992735 arp 0.0.0.0 who 10.0.2.19 INT 3 126 flow=Background-ARP 1970/01/01 01:00:06.659668 0.000000 ipv6-icmp :: 135 -> ff02::1:ffce:e387 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:06.659730 3.994903 ipv6-icmp fe80::d5e6:502a:54ce:e387 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:06.659810 0.500422 ipv6-icmp fe80::d5e6:502a:54ce:e387 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:11.609098 0.000000 udp 10.0.2.19 53951 -> 8.8.8.8 53 INT 0 1 76 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:00:11.688745 0.000264 arp 10.0.2.2 who 10.0.2.19 CON 2 84 flow=Background-ARP 1970/01/01 01:00:12.607842 0.079411 udp 10.0.2.19 53951 <-> 8.8.4.4 53 CON 0 0 2 168 flow=From-Botnet-V1-DNS 1970/01/01 01:00:12.688036 0.086187 udp 10.0.2.19 63633 <-> 8.8.4.4 53 CON 0 0 2 180 flow=From-Botnet-V1-DNS 1970/01/01 01:00:13.298734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:14.660761 0.000000 ipv6-icmp fe80::d5e6:502a:54ce:e387 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:21.300599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:37.303188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:01:09.309250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:04:45.460937 0.099760 udp fe80::d5e6:502a:54ce:e387 61897 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:04:45.461128 0.099921 udp 10.0.2.19 61372 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:04:45.461244 0.099805 icmp 10.0.2.2 0x000b -> 10.0.2.19 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:04:45.760989 1.501388 udp 10.0.2.19 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V1-UDP-Attempt 1970/01/01 01:04:48.085092 0.000156 arp 10.0.2.19 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:04:48.085402 0.079112 udp 10.0.2.19 60060 <-> 8.8.8.8 53 CON 0 0 2 217 flow=From-Botnet-V1-DNS 1970/01/01 01:04:48.165309 0.338817 tcp 10.0.2.19 49158 -> 94.127.78.125 80 FSPA* 0 0 26 16459 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:04:53.522214 0.343896 tcp 10.0.2.19 49159 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:04:58.869855 0.337804 tcp 10.0.2.19 49160 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:04.207685 0.348114 tcp 10.0.2.19 49161 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:09.555417 0.347501 tcp 10.0.2.19 49162 -> 94.127.78.125 80 FSPA* 0 0 25 16486 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:14.903146 0.399575 tcp 10.0.2.19 49163 -> 94.127.78.125 80 SPA_* 0 0 10 4110 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:15.722090 0.080275 udp 10.0.2.19 55070 <-> 8.8.8.8 53 CON 0 0 2 346 flow=From-Botnet-V1-DNS 1970/01/01 01:05:15.803297 0.571604 tcp 10.0.2.19 49164 -> 199.101.114.117 80 SPA_* 0 0 7 1241 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:16.295534 0.082670 udp 10.0.2.19 63229 <-> 8.8.8.8 53 CON 0 0 2 317 flow=From-Botnet-V1-DNS 1970/01/01 01:05:16.379093 0.546347 tcp 10.0.2.19 49165 -> 199.101.115.1 80 SPA_* 0 0 11 4407 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:16.996269 0.079632 udp 10.0.2.19 53112 <-> 8.8.8.8 53 CON 0 0 2 217 flow=From-Botnet-V1-DNS 1970/01/01 01:05:17.076620 0.712059 tcp 10.0.2.19 49166 -> 94.127.78.125 80 SPA_* 0 0 116 80411 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:18.036106 0.117714 udp 10.0.2.19 53325 <-> 8.8.8.8 53 CON 0 0 2 276 flow=From-Botnet-V1-DNS 1970/01/01 01:05:18.154585 2.204548 tcp 10.0.2.19 49167 -> 217.212.238.59 80 SRPA* 0 0 11 4466 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:21.040007 0.079815 udp 10.0.2.19 51711 <-> 8.8.8.8 53 CON 0 0 2 243 flow=From-Botnet-V1-DNS 1970/01/01 01:05:21.120625 1.046645 tcp 10.0.2.19 49168 -> 94.127.76.80 80 SRPA* 0 0 8 1105 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:22.627600 1.157268 tcp 10.0.2.19 49164 -> 199.101.114.117 80 PA_PA 0 0 11 2538 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:23.598488 0.470075 tcp 10.0.2.19 49166 -> 94.127.78.125 80 PA_PA 0 0 116 83205 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:24.232275 0.085808 udp 10.0.2.19 61667 <-> 8.8.8.8 53 CON 0 0 2 346 flow=From-Botnet-V1-DNS 1970/01/01 01:05:24.318697 0.184990 tcp 10.0.2.19 49169 -> 199.101.114.117 80 SPA_* 0 0 8 2275 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:55.018230 0.000236 tcp 10.0.2.19 49169 -> 199.101.114.117 80 FA_A 0 0 2 108 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:55.135084 0.000000 tcp 10.0.2.19 49164 -> 199.101.114.117 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:55.135230 0.000000 tcp 10.0.2.19 49165 -> 199.101.115.1 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:55.135339 0.000000 tcp 10.0.2.19 49166 -> 94.127.78.125 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:05:55.154974 0.000000 tcp 10.0.2.19 49163 -> 94.127.78.125 80 RA_ 0 0 1 54 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:04.914743 0.000753 tcp 10.0.2.19 49169 -> 199.101.114.117 80 RA_F* 0 0 5 498 flow=From-Botnet-V1-TCP-Established 1970/01/01 01:07:04.914971 0.000110 arp 10.0.2.19 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:07:13.317077 2.999638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:07:20.322997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:28.324133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:44.327263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:08:16.333251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:20.340877 3.000180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:14:27.347114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:35.348651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:51.351036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:15:23.357368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:27.364706 3.010271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:21:34.381227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:42.382161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:58.384937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:30.391609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:34.399647 3.000790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:28:41.416902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:49.415923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:05.419254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:37.425348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:41.432192 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:35:48.438961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:56.440166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:12.443329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:44.459660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:42:48.466588 3.000083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:42:55.472341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:03.474224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:19.477089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:51.483419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:49:55.491144 2.999458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:50:02.496823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:10.497920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:26.501068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:58.507495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:02.515181 2.999969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:57:09.520757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:17.521837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:33.525350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:58:05.531555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:09.538990 3.000148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:04:16.544615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:24.546272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:40.548997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:05:12.555036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:16.563082 2.999682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:11:23.568980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:31.570132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:47.572718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:12:19.578925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:23.587043 2.999962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:18:30.592683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:38.593725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:54.596903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:19:26.603343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background