[User] src_ip: 192.168.1.30, src_port: 65, dst_ip: 192.168.1.152, dst_port: 65, proto: tcp, service: -, duration: 0.032276, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 240, dst_pkts: 6, dst_ip_bytes: 240, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.152, src_port: 35525, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000462, src_bytes: 0, dst_bytes: 298, conn_state: SHR, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 2, dst_ip_bytes: 354, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 43496, dst_ip: 192.168.1.184, dst_port: 443, proto: tcp, service: -, duration: 0.000259, src_bytes: 0, dst_bytes: 0, conn_state: S1, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 112, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.152, src_port: 34296, dst_ip: 192.168.1.152, dst_port: 10502, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 36269, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.000006, src_bytes: 54, dst_bytes: 54, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 82, dst_pkts: 1, dst_ip_bytes: 82, dns_query: testphp.vulnweb.com/listproducts.php, dns_qclass: 1, dns_qtype: 1, dns_rcode: 3, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: T, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.33, src_port: 35117, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 1, dst_ip_bytes: 52, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: fe80::601f:9cde:4832:2f3f, src_port: 62148, dst_ip: ff02::1:3, dst_port: 5355, proto: udp, service: dns, duration: 0.410317, src_bytes: 66, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 162, dst_pkts: 0, dst_ip_bytes: 0, dns_query: desktop-18ss3ba, dns_qclass: 1, dns_qtype: 255, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.32, src_port: 61171, dst_ip: 192.168.1.133, dst_port: 5009, proto: tcp, service: -, duration: 0.003264, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.32, src_port: 45260, dst_ip: 176.28.50.165, dst_port: 80, proto: tcp, service: http, duration: 1.725339, src_bytes: 3859, dst_bytes: 322, conn_state: S1, missed_bytes: 0, src_pkts: 7, src_ip_bytes: 4239, dst_pkts: 5, dst_ip_bytes: 590, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.30, src_port: 37190, dst_ip: 18.184.104.180, dst_port: 80, proto: tcp, service: http, duration: 1.292053, src_bytes: 305, dst_bytes: 12183, conn_state: SF, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 625, dst_pkts: 12, dst_ip_bytes: 12815, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.32, src_port: 40484, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 6.5203, src_bytes: 1732, dst_bytes: 1013, conn_state: S3, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 2052, dst_pkts: 4, dst_ip_bytes: 1229, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.30, src_port: 51853, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.014794, src_bytes: 52, dst_bytes: 52, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 80, dst_pkts: 1, dst_ip_bytes: 80, dns_query: 192.168.1.195/dvwa/login.php-r.hub, dns_qclass: 1, dns_qtype: 1, dns_rcode: 3, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: T, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.30, src_port: 50695, dst_ip: 192.168.1.49, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.31, src_port: 52655, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.000668, src_bytes: 74, dst_bytes: 90, conn_state: SF, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 130, dst_pkts: 2, dst_ip_bytes: 146, dns_query: testphp.vulnweb.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: T, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.30, src_port: 42451, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.000026, src_bytes: 52, dst_bytes: 52, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 80, dst_pkts: 1, dst_ip_bytes: 80, dns_query: 192.168.1.195/dvwa/login.php-r.hub, dns_qclass: 1, dns_qtype: 1, dns_rcode: 3, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: T, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.30, src_port: 26, dst_ip: 192.168.1.193, dst_port: 26, proto: tcp, service: -, duration: 0.000126, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.193, src_port: 49915, dst_ip: 192.168.1.33, dst_port: 80, proto: tcp, service: -, duration: 0.000081, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: fe80::76:ad3e:1329:a7fd, src_port: 5353, dst_ip: ff02::fb, dst_port: 5353, proto: udp, service: dns, duration: 3.917463, src_bytes: 270, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 3, src_ip_bytes: 414, dst_pkts: 0, dst_ip_bytes: 0, dns_query: _sleep-proxy._udp.local, dns_qclass: 32769, dns_qtype: 12, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.31, src_port: 37622, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: -, duration: 0.000005, src_bytes: 0, dst_bytes: 0, conn_state: S1, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 112, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.190, src_port: 52106, dst_ip: 193.0.14.129, dst_port: 53, proto: udp, service: dns, duration: 0.023549, src_bytes: 39, dst_bytes: 1167, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 67, dst_pkts: 1, dst_ip_bytes: 1195, dns_query: akadns.net, dns_qclass: 1, dns_qtype: 43, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.32, src_port: 35482, dst_ip: 192.168.1.133, dst_port: 4004, proto: tcp, service: -, duration: 0.092399, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.32, src_port: 39068, dst_ip: 176.28.50.165, dst_port: 80, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.30, src_port: 40, dst_ip: 192.168.1.193, dst_port: 40, proto: tcp, service: -, duration: 0.000166, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.180, src_port: 123, dst_ip: 192.189.54.33, dst_port: 123, proto: udp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 76, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 59927, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000039, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 28, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.193, src_port: 49222, dst_ip: 192.168.1.37, dst_port: 4444, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 200, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.30, src_port: 38420, dst_ip: 18.184.104.180, dst_port: 80, proto: tcp, service: http, duration: 1.671924, src_bytes: 260, dst_bytes: 12183, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 528, dst_pkts: 13, dst_ip_bytes: 12867, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.193, src_port: 49479, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000018, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.31, src_port: 39462, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.235466, src_bytes: 218, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 486, dst_pkts: 6, dst_ip_bytes: 3760, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.30, src_port: 33174, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.017852, src_bytes: 161, dst_bytes: 2009, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 381, dst_pkts: 5, dst_ip_bytes: 2221, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.193, src_port: 50092, dst_ip: 192.168.1.33, dst_port: 80, proto: tcp, service: -, duration: 0.000238, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.30, src_port: 27, dst_ip: 192.168.1.152, dst_port: 27, proto: tcp, service: -, duration: 0.000146, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.194, src_port: 80, dst_ip: 192.168.1.194, dst_port: 1207, proto: tcp, service: -, duration: 0.303522, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 34296, dst_ip: 192.168.1.152, dst_port: 10502, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 54410, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.004782, src_bytes: 168, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 436, dst_pkts: 6, dst_ip_bytes: 2239, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.193, src_port: 50055, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000129, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.32, src_port: 54769, dst_ip: 192.168.1.133, dst_port: 5002, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.30, src_port: 57404, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.019936, src_bytes: 155, dst_bytes: 978, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 375, dst_pkts: 4, dst_ip_bytes: 1150, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.152, src_port: 1880, dst_ip: 192.168.1.152, dst_port: 51782, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.32, src_port: 53032, dst_ip: 192.168.1.195, dst_port: 1002, proto: tcp, service: -, duration: 0.005402, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 88, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.152, src_port: 1880, dst_ip: 192.168.1.152, dst_port: 51782, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.31, src_port: 37434, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.002659, src_bytes: 74, dst_bytes: 90, conn_state: SF, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 130, dst_pkts: 2, dst_ip_bytes: 146, dns_query: testphp.vulnweb.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: T, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.31, src_port: 39008, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.163446, src_bytes: 240, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 508, dst_pkts: 6, dst_ip_bytes: 2239, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.152, src_port: 1880, dst_ip: 192.168.1.152, dst_port: 51782, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.190, src_port: 23652, dst_ip: 199.19.54.1, dst_port: 53, proto: udp, service: dns, duration: 2.953296, src_bytes: 42, dst_bytes: 195, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 70, dst_pkts: 1, dst_ip_bytes: 223, dns_query: ciscobinary.openh264.org, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.32, src_port: 42458, dst_ip: 176.28.50.165, dst_port: 80, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.30, src_port: 56164, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.002521, src_bytes: 222, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 490, dst_pkts: 7, dst_ip_bytes: 3812, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.79, src_port: 46912, dst_ip: 192.168.1.255, dst_port: 15600, proto: udp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 63, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 50050, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.090069, src_bytes: 152, dst_bytes: 518, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 372, dst_pkts: 5, dst_ip_bytes: 730, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.33, src_port: 43433, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.184, src_port: 8080, dst_ip: 192.168.1.184, dst_port: 1919, proto: tcp, service: -, duration: 0.208821, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 34296, dst_ip: 192.168.1.152, dst_port: 10502, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.193, src_port: 49712, dst_ip: 192.168.1.33, dst_port: 80, proto: tcp, service: -, duration: 0.000198, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.32, src_port: 54772, dst_ip: 192.168.1.133, dst_port: 1201, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.33, src_port: 40273, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.152, src_port: 49811, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000073, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 28, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.31, src_port: 38840, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.225244, src_bytes: 266, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 534, dst_pkts: 5, dst_ip_bytes: 2187, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.193, src_port: 49241, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000109, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.152, src_port: 52224, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000027, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 28, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.39, src_port: 87, dst_ip: 192.168.1.193, dst_port: 87, proto: tcp, service: -, duration: 0.488129, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 100, src_ip_bytes: 4000, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.193, src_port: 49652, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000141, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.30, src_port: 46678, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SHR, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 1, dst_ip_bytes: 80, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 3, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: T, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.30, src_port: 74, dst_ip: 192.168.1.190, dst_port: 74, proto: tcp, service: -, duration: 0.000003, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.32, src_port: 57694, dst_ip: 52.28.231.150, dst_port: 80, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.30, src_port: 54396, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.164747, src_bytes: 229, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 497, dst_pkts: 7, dst_ip_bytes: 3812, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 172.17.0.5, src_port: 35481, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.00067, src_bytes: 0, dst_bytes: 178, conn_state: SHR, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 2, dst_ip_bytes: 234, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 30, dst_ip: 192.168.1.193, dst_port: 30, proto: tcp, service: -, duration: 0.000018, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.193, src_port: 49344, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000152, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.152, src_port: 48569, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000043, src_bytes: 90, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 146, dst_pkts: 0, dst_ip_bytes: 0, dns_query: safebrowsing.googleapis.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.37, src_port: 36293, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 76, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.30, src_port: 46690, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.019795, src_bytes: 167, dst_bytes: 2980, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 435, dst_pkts: 7, dst_ip_bytes: 3352, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.32, src_port: 61176, dst_ip: 192.168.1.133, dst_port: 30718, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.30, src_port: 56116, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.032471, src_bytes: 257, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 577, dst_pkts: 7, dst_ip_bytes: 3812, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.33, src_port: 45887, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 2405:6e00:10ce:2c00:20c:29ff:fed2:b002, src_port: 5353, dst_ip: ff02::fb, dst_port: 5353, proto: udp, service: dns, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 93, dst_pkts: 0, dst_ip_bytes: 0, dns_query: _ipp._tcp.local, dns_qclass: 1, dns_qtype: 12, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.31, src_port: 54803, dst_ip: 192.168.1.49, dst_port: 32772, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.30, src_port: 38338, dst_ip: 192.168.1.184, dst_port: 443, proto: tcp, service: -, duration: 61.280657, src_bytes: 0, dst_bytes: 0, conn_state: S3, missed_bytes: 0, src_pkts: 3, src_ip_bytes: 164, dst_pkts: 2, dst_ip_bytes: 112, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.133, src_port: 5353, dst_ip: 224.0.0.251, dst_port: 5353, proto: udp, service: dns, duration: 1.028997, src_bytes: 122, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 178, dst_pkts: 0, dst_ip_bytes: 0, dns_query: _0354a290._sub._googlecast._tcp.local, dns_qclass: 1, dns_qtype: 12, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 52370, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000024, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 40052, dst_ip: 192.168.1.184, dst_port: 443, proto: tcp, service: -, duration: 62.539329, src_bytes: 0, dst_bytes: 0, conn_state: S3, missed_bytes: 0, src_pkts: 3, src_ip_bytes: 164, dst_pkts: 2, dst_ip_bytes: 112, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 172.17.0.8, src_port: 40025, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.069951, src_bytes: 0, dst_bytes: 212, conn_state: SHR, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 2, dst_ip_bytes: 268, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 1880, dst_ip: 192.168.1.152, dst_port: 51782, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.34, src_port: 50385, dst_ip: 192.168.1.1, dst_port: 53, proto: udp, service: dns, duration: 0.128066, src_bytes: 84, dst_bytes: 424, conn_state: SF, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 140, dst_pkts: 2, dst_ip_bytes: 480, dns_query: detectportal.firefox.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: T, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] mitm


[User] src_ip: 192.168.1.32, src_port: 38474, dst_ip: 176.28.50.165, dst_port: 80, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.31, src_port: 51836, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.017076, src_bytes: 155, dst_bytes: 978, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 375, dst_pkts: 4, dst_ip_bytes: 1150, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.30, src_port: 35558, dst_ip: 192.168.1.184, dst_port: 443, proto: tcp, service: -, duration: 60.828164, src_bytes: 0, dst_bytes: 0, conn_state: S3, missed_bytes: 0, src_pkts: 3, src_ip_bytes: 164, dst_pkts: 2, dst_ip_bytes: 112, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.30, src_port: 59486, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: -, duration: 0.000463, src_bytes: 0, dst_bytes: 0, conn_state: S1, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 112, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.193, src_port: 49849, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000181, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.31, src_port: 40008, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.157506, src_bytes: 275, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 543, dst_pkts: 6, dst_ip_bytes: 3760, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.190, src_port: 1693, dst_ip: 192.168.1.190, dst_port: 1693, proto: tcp, service: -, duration: 0.195301, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.17, src_port: 137, dst_ip: 192.168.1.255, dst_port: 137, proto: udp, service: dns, duration: 1.512592, src_bytes: 150, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 3, src_ip_bytes: 234, dst_pkts: 0, dst_ip_bytes: 0, dns_query: WPAD, dns_qclass: 1, dns_qtype: 32, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 54541, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000017, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 49353, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000069, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.32, src_port: 56230, dst_ip: 18.194.169.124, dst_port: 80, proto: tcp, service: -, duration: 2.035236, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 120, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.79, src_port: 55344, dst_ip: 192.168.1.255, dst_port: 15600, proto: udp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 63, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 1301, dst_ip: 192.168.1.152, dst_port: 1301, proto: tcp, service: -, duration: 0.212563, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.30, src_port: 49023, dst_ip: 192.168.1.103, dst_port: 27352, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.31, src_port: 47612, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.003506, src_bytes: 155, dst_bytes: 651, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 423, dst_pkts: 5, dst_ip_bytes: 919, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.194, src_port: 80, dst_ip: 192.168.1.194, dst_port: 1467, proto: tcp, service: -, duration: 0.259822, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.195, src_port: 1993, dst_ip: 192.168.1.195, dst_port: 1993, proto: tcp, service: -, duration: 0.203139, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.33, src_port: 33273, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 1, dst_ip_bytes: 91, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.193, src_port: 49467, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000131, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.194, src_port: 80, dst_ip: 192.168.1.194, dst_port: 1478, proto: tcp, service: -, duration: 0.181834, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 120, src_ip_bytes: 4800, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.152, src_port: 46078, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.00003, src_bytes: 130, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 186, dst_pkts: 0, dst_ip_bytes: 0, dns_query: a2z3kk2ebqzso7.iot.ap-southeast-2.amazonaws.com, dns_qclass: 1, dns_qtype: 1, dns_rcode: 0, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.33, src_port: 34217, dst_ip: 192.168.1.193, dst_port: 135, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.30, src_port: 78, dst_ip: 192.168.1.193, dst_port: 78, proto: tcp, service: -, duration: 0.00015, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.31, src_port: 45448, dst_ip: 192.168.1.152, dst_port: 21, proto: tcp, service: -, duration: 0.000229, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 60, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.30, src_port: 39342, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.202775, src_bytes: 238, dst_bytes: 1951, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 458, dst_pkts: 5, dst_ip_bytes: 2163, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.180, src_port: 43113, dst_ip: 192.168.1.190, dst_port: 53, proto: udp, service: dns, duration: 0.000516, src_bytes: 31, dst_bytes: 106, conn_state: SF, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 59, dst_pkts: 1, dst_ip_bytes: 134, dns_query: elasticsearch, dns_qclass: 1, dns_qtype: 1, dns_rcode: 3, dns_AA: F, dns_RD: T, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.33, src_port: 45717, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 1205, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.30, src_port: 41630, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.002318, src_bytes: 155, dst_bytes: 651, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 423, dst_pkts: 5, dst_ip_bytes: 919, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.30, src_port: 50567, dst_ip: 192.168.1.190, dst_port: 10025, proto: tcp, service: -, duration: 0.043159, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.193, src_port: 49439, dst_ip: 192.168.1.37, dst_port: 8080, proto: tcp, service: -, duration: 0.000243, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor


[User] src_ip: 192.168.1.30, src_port: 54530, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: -, duration: 0.000472, src_bytes: 0, dst_bytes: 0, conn_state: S1, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 112, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.32, src_port: 40154, dst_ip: 18.194.169.124, dst_port: 80, proto: tcp, service: http, duration: 0.722259, src_bytes: 3286, dst_bytes: 1616, conn_state: S1, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 3606, dst_pkts: 5, dst_ip_bytes: 1884, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.33, src_port: 46189, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 60, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.30, src_port: 42, dst_ip: 192.168.1.152, dst_port: 42, proto: tcp, service: -, duration: 0.000219, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 40, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] dos


[User] src_ip: 192.168.1.33, src_port: 38617, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.37, src_port: 40145, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 60, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.31, src_port: 60498, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.093913, src_bytes: 280, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 600, dst_pkts: 6, dst_ip_bytes: 2239, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.32, src_port: 38938, dst_ip: 52.28.231.150, dst_port: 80, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: SH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 52, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] xss


[User] src_ip: 192.168.1.193, src_port: 49158, dst_ip: 192.168.1.37, dst_port: 4444, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 984, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.31, src_port: 55484, dst_ip: 192.168.1.152, dst_port: 80, proto: tcp, service: http, duration: 0.002762, src_bytes: 147, dst_bytes: 3440, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 415, dst_pkts: 7, dst_ip_bytes: 3812, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.31, src_port: 52438, dst_ip: 192.168.1.195, dst_port: 80, proto: tcp, service: http, duration: 0.023813, src_bytes: 161, dst_bytes: 2009, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 381, dst_pkts: 5, dst_ip_bytes: 2221, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: 192.168.1.30, src_port: 47674, dst_ip: 176.28.50.165, dst_port: 80, proto: tcp, service: http, duration: 1.055657, src_bytes: 264, dst_bytes: 2056, conn_state: SF, missed_bytes: 0, src_pkts: 6, src_ip_bytes: 584, dst_pkts: 5, dst_ip_bytes: 2324, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.31, src_port: 37790, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.152169, src_bytes: 359, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 627, dst_pkts: 6, dst_ip_bytes: 2239, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.30, src_port: 56548, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: -, duration: 0.000412, src_bytes: 0, dst_bytes: 0, conn_state: S1, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 112, dst_pkts: 1, dst_ip_bytes: 60, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ddos


[User] src_ip: 192.168.1.152, src_port: 1880, dst_ip: 192.168.1.152, dst_port: 51782, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: OTH, missed_bytes: 0, src_pkts: 0, src_ip_bytes: 0, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.37, src_port: 41167, dst_ip: 192.168.1.193, dst_port: 445, proto: tcp, service: -, duration: 0, src_bytes: 0, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 60, dst_pkts: 0, dst_ip_bytes: 0, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] ransomware


[User] src_ip: 192.168.1.31, src_port: 59974, dst_ip: 192.168.1.193, dst_port: 21, proto: tcp, service: -, duration: 0.000136, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 60, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] password


[User] src_ip: fe80::601f:9cde:4832:2f3f, src_port: 61727, dst_ip: ff02::1:3, dst_port: 5355, proto: udp, service: dns, duration: 0.410523, src_bytes: 66, dst_bytes: 0, conn_state: S0, missed_bytes: 0, src_pkts: 2, src_ip_bytes: 162, dst_pkts: 0, dst_ip_bytes: 0, dns_query: desktop-18ss3ba, dns_qclass: 1, dns_qtype: 255, dns_rcode: 0, dns_AA: F, dns_RD: F, dns_RA: F, dns_rejected: F, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] normal


[User] src_ip: 192.168.1.31, src_port: 60562, dst_ip: 192.168.1.190, dst_port: 80, proto: tcp, service: http, duration: 0.149633, src_bytes: 267, dst_bytes: 1919, conn_state: SF, missed_bytes: 0, src_pkts: 5, src_ip_bytes: 535, dst_pkts: 5, dst_ip_bytes: 2179, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] injection


[User] src_ip: 192.168.1.30, src_port: 42908, dst_ip: 192.168.1.152, dst_port: 4848, proto: tcp, service: -, duration: 0.006082, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 44, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] scanning


[User] src_ip: 192.168.1.193, src_port: 49409, dst_ip: 192.168.1.33, dst_port: 80, proto: tcp, service: -, duration: 0.000168, src_bytes: 0, dst_bytes: 0, conn_state: REJ, missed_bytes: 0, src_pkts: 1, src_ip_bytes: 48, dst_pkts: 1, dst_ip_bytes: 40, dns_query: -, dns_qclass: 0, dns_qtype: 0, dns_rcode: 0, dns_AA: -, dns_RD: -, dns_RA: -, dns_rejected: -, ssl_version: -, ssl_cipher: -, ssl_resumed: -, ssl_established: -, ssl_subject: -, ssl_issuer: -, http_trans_depth: -, http_method: -, http_uri: -, http_version: -, http_request_body_len: 0, http_response_body_len: 0, http_status_code: 0, http_user_agent: -, http_orig_mime_types: -, http_resp_mime_types: -, weird_name: -, weird_addl: -, weird_notice: -

[Assistant] backdoor