StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:06.322298 3.004414 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:00:06.492479 2.003226 arp 0.0.0.0 who 10.0.2.20 INT 3 126 flow=Background-ARP 1970/01/01 01:00:06.492664 0.000000 ipv6-icmp :: 135 -> ff02::1:ffc9:c808 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:06.492721 3.995579 ipv6-icmp fe80::1dfe:6c38:93c9:c808 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:06.492799 0.500546 ipv6-icmp fe80::1dfe:6c38:93c9:c808 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:06.546678 2.955328 arp 10.0.2.20 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:11.033782 0.000000 udp 10.0.2.20 55590 -> 8.8.8.8 53 INT 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:00:11.112938 0.000442 arp 10.0.2.2 who 10.0.2.20 CON 2 84 flow=Background-ARP 1970/01/01 01:00:12.030149 0.080707 udp 10.0.2.20 55590 <-> 8.8.4.4 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/01 01:00:12.111646 0.079345 udp 10.0.2.20 58306 <-> 8.8.4.4 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/01 01:00:13.331990 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:14.494357 0.000000 ipv6-icmp fe80::1dfe:6c38:93c9:c808 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:21.333885 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:37.337109 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:01:09.342799 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:05:13.156798 0.096583 udp fe80::1dfe:6c38:93c9:c808 49656 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:05:13.157120 0.096572 udp 10.0.2.20 50591 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:13.157240 0.096452 icmp 10.0.2.2 0x000b -> 10.0.2.20 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:05:13.454212 1.501700 udp 10.0.2.20 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:15.791626 0.000165 arp 10.0.2.20 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:05:15.791944 0.080225 udp 10.0.2.20 50360 <-> 8.8.8.8 53 CON 0 0 2 217 flow=From-Botnet-V2-DNS 1970/01/01 01:05:15.873050 0.350476 tcp 10.0.2.20 49158 -> 94.127.78.125 80 FSPA* 0 0 32 17223 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:21.316273 0.342752 tcp 10.0.2.20 49159 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:26.663627 0.341009 tcp 10.0.2.20 49160 -> 94.127.78.125 80 FSPA* 0 0 25 16486 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:32.011466 0.345943 tcp 10.0.2.20 49161 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:37.359044 0.342682 tcp 10.0.2.20 49162 -> 94.127.78.125 80 FSPA* 0 0 31 17250 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:42.706537 0.399526 tcp 10.0.2.20 49163 -> 94.127.78.125 80 SPA_* 0 0 10 3670 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:43.421885 0.080567 udp 10.0.2.20 49809 <-> 8.8.8.8 53 CON 0 0 2 346 flow=From-Botnet-V2-DNS 1970/01/01 01:05:43.503235 0.544194 tcp 10.0.2.20 49164 -> 199.101.114.117 80 SPA_* 0 0 7 1253 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:43.937350 0.079172 udp 10.0.2.20 56709 <-> 8.8.8.8 53 CON 0 0 2 317 flow=From-Botnet-V2-DNS 1970/01/01 01:05:44.017192 0.544039 tcp 10.0.2.20 49165 -> 199.101.115.1 80 SPA_* 0 0 11 4407 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:44.629536 0.079500 udp 10.0.2.20 52340 <-> 8.8.8.8 53 CON 0 0 2 217 flow=From-Botnet-V2-DNS 1970/01/01 01:05:44.709658 0.343007 tcp 10.0.2.20 49166 -> 94.127.78.125 80 FSPA* 0 0 31 17027 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:50.057640 0.849744 tcp 10.0.2.20 49167 -> 94.127.78.125 80 SPA_* 0 0 94 64608 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:50.994000 0.080311 udp 10.0.2.20 50814 <-> 8.8.8.8 53 CON 0 0 2 276 flow=From-Botnet-V2-DNS 1970/01/01 01:05:51.075124 0.095482 tcp 10.0.2.20 49168 -> 217.212.238.59 80 SPA_* 0 0 5 470 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:56.585268 0.212903 tcp 10.0.2.20 49168 -> 217.212.238.59 80 RA_PA 0 0 6 3996 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:57.342487 0.079229 udp 10.0.2.20 51816 <-> 8.8.8.8 53 CON 0 0 2 243 flow=From-Botnet-V2-DNS 1970/01/01 01:05:57.422454 4.731113 tcp 10.0.2.20 49169 -> 94.127.76.80 80 SPA_* 0 0 7 1051 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:02.543572 0.000000 tcp 10.0.2.20 49169 -> 94.127.76.80 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:02.922299 2.946564 tcp 10.0.2.20 49164 -> 199.101.114.117 80 PA_PA 0 0 25 5832 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:03.113558 0.090296 udp 10.0.2.20 59934 <-> 8.8.8.8 53 CON 0 0 2 267 flow=From-Botnet-V2-DNS 1970/01/01 01:06:03.204543 0.751472 tcp 10.0.2.20 49170 -> 199.101.114.28 80 SPA_* 0 0 10 2482 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:03.829585 2.354750 tcp 10.0.2.20 49167 -> 94.127.78.125 80 PA_PA 0 0 120 84006 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:06.318409 0.080026 udp 10.0.2.20 52053 <-> 8.8.8.8 53 CON 0 0 2 346 flow=From-Botnet-V2-DNS 1970/01/01 01:06:06.398977 0.183591 tcp 10.0.2.20 49171 -> 199.101.114.117 80 SPA_* 0 0 8 2275 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.673136 0.027100 tcp 10.0.2.20 49171 -> 199.101.114.117 80 RA_PA 0 0 2 336 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.802802 0.000000 tcp 10.0.2.20 49164 -> 199.101.114.117 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.803041 0.000000 tcp 10.0.2.20 49165 -> 199.101.115.1 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.803242 0.000000 tcp 10.0.2.20 49167 -> 94.127.78.125 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.803452 0.000000 tcp 10.0.2.20 49170 -> 199.101.114.28 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:11.883211 0.000000 tcp 10.0.2.20 49163 -> 94.127.78.125 80 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:07:13.350493 2.999710 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:07:20.356632 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:28.358101 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:44.360782 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:08:16.367269 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:20.374490 2.999750 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:14:27.380642 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:35.381954 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:51.384632 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:15:23.390959 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:27.535091 3.003876 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:21:34.544334 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:42.545598 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:58.548975 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:30.554909 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:34.564919 2.997662 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:28:41.568720 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:49.569969 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:05.573197 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:37.588711 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:41.596796 3.000054 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:35:48.602710 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:56.603901 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:12.607249 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:44.612777 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:42:48.620803 2.999821 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:42:55.626126 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:03.628184 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:19.631139 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:51.636579 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:49:55.644565 3.000010 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:50:02.650674 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:10.651778 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:26.654782 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:58.661031 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:02.666627 3.002357 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:57:09.674348 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:17.675642 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:33.678932 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:58:05.684590 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:09.692762 2.999953 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:04:16.698494 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:24.700495 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:40.702927 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:05:12.708834 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:16.716602 2.999919 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:11:23.722507 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:31.723392 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:47.727027 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:12:19.732864 0.000000 udp fe80::1dfe:6c38:93c9:c808 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background