From defed7b6f38faa2d393ad532532768c1ab51f851 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 12 Nov 2012 11:51:42 -0600 Subject: [PATCH] Adjustments to modbus test cases. - Added a test for binpac exception handling -- the generated code should use "binpac::Exception" and not "Exception" for exception handling logic to avoid accidental overshadowing by the analyzer-specific type "binpac::ModbusTCP::Exception", which could lead to interesting asserts being triggered in binpac. - Update baseline for the event coverage test -- seems that more events get generated with working exception handling in the generated binpac parser code. - Coverage baseline was giving wrong number of events covered. --- .../coverage | 2 +- .../output | 266 +++++++++++++++++- .../modbus.log | 11 + .../weird.log | 11 + testing/btest/Traces/modbus/fuzz-72.trace | Bin 0 -> 2907 bytes .../btest/Traces/{ => modbus}/modbus.trace | Bin .../scripts/base/protocols/modbus/events.bro | 4 +- .../protocols/modbus/exception_handling.test | 10 + .../scripts/base/protocols/modbus/policy.bro | 2 +- 9 files changed, 301 insertions(+), 5 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/modbus.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/weird.log create mode 100644 testing/btest/Traces/modbus/fuzz-72.trace rename testing/btest/Traces/{ => modbus}/modbus.trace (100%) create mode 100644 testing/btest/scripts/base/protocols/modbus/exception_handling.test diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.events/coverage b/testing/btest/Baseline/scripts.base.protocols.modbus.events/coverage index 050cc6064f..8748ddfc60 100644 --- a/testing/btest/Baseline/scripts.base.protocols.modbus.events/coverage +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.events/coverage @@ -1 +1 @@ -2 of 28 events triggered by trace +18 of 28 events triggered by trace diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.events/output b/testing/btest/Baseline/scripts.base.protocols.modbus.events/output index 17efb4e6b3..613ee7a249 100644 --- a/testing/btest/Baseline/scripts.base.protocols.modbus.events/output +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.events/output @@ -1,4 +1,4 @@ -79557 +79689 1 modbus_exception, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1572, state=4, num_pkts=154, num_bytes_ip=7740, flow_label=0], resp=[size=1195, state=4, num_pkts=167, num_bytes_ip=7870, flow_label=0], start_time=1153491888.530306, duration=79.974922, service={ 1 modbus_exception, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1584, state=4, num_pkts=155, num_bytes_ip=7792, flow_label=0], resp=[size=1204, state=4, num_pkts=168, num_bytes_ip=7919, flow_label=0], start_time=1153491888.530306, duration=80.576052, service={ 1 modbus_exception, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1596, state=4, num_pkts=157, num_bytes_ip=7884, flow_label=0], resp=[size=1213, state=4, num_pkts=170, num_bytes_ip=8008, flow_label=0], start_time=1153491888.530306, duration=81.276794, service={ @@ -39710,77 +39710,135 @@ 1 modbus_message, [id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], orig=[size=99984, state=4, num_pkts=16665, num_bytes_ip=966576, flow_label=0], resp=[size=1731538, state=4, num_pkts=8439, num_bytes_ip=2170169, flow_label=0], start_time=1342774499.588269, duration=882.185985, service={ 1 modbus_message, [id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], orig=[size=99996, state=4, num_pkts=16666, num_bytes_ip=966628, flow_label=0], resp=[size=1731538, state=4, num_pkts=8440, num_bytes_ip=2170430, flow_label=0], start_time=1342774499.588269, duration=882.187315, service={ 1 modbus_message, [id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], orig=[size=99996, state=4, num_pkts=16667, num_bytes_ip=966692, flow_label=0], resp=[size=1731747, state=4, num_pkts=8440, num_bytes_ip=2170430, flow_label=0], start_time=1342774499.588269, duration=882.201619, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1008, state=4, num_pkts=100, num_bytes_ip=5004, flow_label=0], resp=[size=759, state=4, num_pkts=109, num_bytes_ip=5123, flow_label=0], start_time=1153491888.530306, duration=52.279819, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1008, state=4, num_pkts=101, num_bytes_ip=5056, flow_label=0], resp=[size=768, state=4, num_pkts=109, num_bytes_ip=5123, flow_label=0], start_time=1153491888.530306, duration=52.781294, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1020, state=4, num_pkts=101, num_bytes_ip=5056, flow_label=0], resp=[size=768, state=4, num_pkts=110, num_bytes_ip=5172, flow_label=0], start_time=1153491888.530306, duration=52.81167, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1020, state=4, num_pkts=102, num_bytes_ip=5108, flow_label=0], resp=[size=777, state=4, num_pkts=110, num_bytes_ip=5172, flow_label=0], start_time=1153491888.530306, duration=53.321634, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1032, state=4, num_pkts=102, num_bytes_ip=5108, flow_label=0], resp=[size=777, state=4, num_pkts=111, num_bytes_ip=5221, flow_label=0], start_time=1153491888.530306, duration=53.34514, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1032, state=4, num_pkts=103, num_bytes_ip=5160, flow_label=0], resp=[size=786, state=4, num_pkts=112, num_bytes_ip=5261, flow_label=0], start_time=1153491888.530306, duration=53.8726, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1044, state=4, num_pkts=103, num_bytes_ip=5160, flow_label=0], resp=[size=786, state=4, num_pkts=113, num_bytes_ip=5310, flow_label=0], start_time=1153491888.530306, duration=53.875296, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1044, state=4, num_pkts=104, num_bytes_ip=5212, flow_label=0], resp=[size=795, state=4, num_pkts=113, num_bytes_ip=5310, flow_label=0], start_time=1153491888.530306, duration=54.417959, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1056, state=4, num_pkts=105, num_bytes_ip=5252, flow_label=0], resp=[size=795, state=4, num_pkts=114, num_bytes_ip=5359, flow_label=0], start_time=1153491888.530306, duration=54.655838, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1056, state=4, num_pkts=106, num_bytes_ip=5304, flow_label=0], resp=[size=804, state=4, num_pkts=115, num_bytes_ip=5399, flow_label=0], start_time=1153491888.530306, duration=55.108919, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=106, state=4, num_pkts=12, num_bytes_ip=582, flow_label=0], resp=[size=75, state=4, num_pkts=13, num_bytes_ip=599, flow_label=0], start_time=1153491888.530306, duration=8.670212, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=106, state=4, num_pkts=13, num_bytes_ip=634, flow_label=0], resp=[size=87, state=4, num_pkts=13, num_bytes_ip=599, flow_label=0], start_time=1153491888.530306, duration=9.182193, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1068, state=4, num_pkts=106, num_bytes_ip=5304, flow_label=0], resp=[size=804, state=4, num_pkts=116, num_bytes_ip=5448, flow_label=0], start_time=1153491888.530306, duration=55.186866, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1068, state=4, num_pkts=107, num_bytes_ip=5356, flow_label=0], resp=[size=813, state=4, num_pkts=116, num_bytes_ip=5448, flow_label=0], start_time=1153491888.530306, duration=55.670018, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1080, state=4, num_pkts=107, num_bytes_ip=5356, flow_label=0], resp=[size=813, state=4, num_pkts=117, num_bytes_ip=5497, flow_label=0], start_time=1153491888.530306, duration=55.717941, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1080, state=4, num_pkts=108, num_bytes_ip=5408, flow_label=0], resp=[size=822, state=4, num_pkts=117, num_bytes_ip=5497, flow_label=0], start_time=1153491888.530306, duration=56.200713, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1092, state=4, num_pkts=108, num_bytes_ip=5408, flow_label=0], resp=[size=822, state=4, num_pkts=118, num_bytes_ip=5546, flow_label=0], start_time=1153491888.530306, duration=56.249035, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1092, state=4, num_pkts=109, num_bytes_ip=5460, flow_label=0], resp=[size=831, state=4, num_pkts=118, num_bytes_ip=5546, flow_label=0], start_time=1153491888.530306, duration=56.779523, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1104, state=4, num_pkts=109, num_bytes_ip=5460, flow_label=0], resp=[size=831, state=4, num_pkts=119, num_bytes_ip=5595, flow_label=0], start_time=1153491888.530306, duration=56.780119, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1104, state=4, num_pkts=110, num_bytes_ip=5512, flow_label=0], resp=[size=840, state=4, num_pkts=119, num_bytes_ip=5595, flow_label=0], start_time=1153491888.530306, duration=57.270725, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1116, state=4, num_pkts=110, num_bytes_ip=5512, flow_label=0], resp=[size=840, state=4, num_pkts=120, num_bytes_ip=5644, flow_label=0], start_time=1153491888.530306, duration=57.3109, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1116, state=4, num_pkts=111, num_bytes_ip=5564, flow_label=0], resp=[size=849, state=4, num_pkts=120, num_bytes_ip=5644, flow_label=0], start_time=1153491888.530306, duration=57.796009, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1128, state=4, num_pkts=111, num_bytes_ip=5564, flow_label=0], resp=[size=849, state=4, num_pkts=121, num_bytes_ip=5693, flow_label=0], start_time=1153491888.530306, duration=57.842505, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1128, state=4, num_pkts=112, num_bytes_ip=5616, flow_label=0], resp=[size=858, state=4, num_pkts=121, num_bytes_ip=5693, flow_label=0], start_time=1153491888.530306, duration=58.351057, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1140, state=4, num_pkts=112, num_bytes_ip=5616, flow_label=0], resp=[size=858, state=4, num_pkts=122, num_bytes_ip=5742, flow_label=0], start_time=1153491888.530306, duration=58.372857, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1140, state=4, num_pkts=113, num_bytes_ip=5668, flow_label=0], resp=[size=867, state=4, num_pkts=122, num_bytes_ip=5742, flow_label=0], start_time=1153491888.530306, duration=58.849263, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1152, state=4, num_pkts=113, num_bytes_ip=5668, flow_label=0], resp=[size=867, state=4, num_pkts=123, num_bytes_ip=5791, flow_label=0], start_time=1153491888.530306, duration=58.908472, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1152, state=4, num_pkts=114, num_bytes_ip=5720, flow_label=0], resp=[size=876, state=4, num_pkts=123, num_bytes_ip=5791, flow_label=0], start_time=1153491888.530306, duration=59.386876, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1164, state=4, num_pkts=114, num_bytes_ip=5720, flow_label=0], resp=[size=876, state=4, num_pkts=124, num_bytes_ip=5840, flow_label=0], start_time=1153491888.530306, duration=59.436745, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1164, state=4, num_pkts=115, num_bytes_ip=5772, flow_label=0], resp=[size=885, state=4, num_pkts=124, num_bytes_ip=5840, flow_label=0], start_time=1153491888.530306, duration=59.992232, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1176, state=4, num_pkts=116, num_bytes_ip=5812, flow_label=0], resp=[size=885, state=4, num_pkts=125, num_bytes_ip=5889, flow_label=0], start_time=1153491888.530306, duration=60.218168, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1176, state=4, num_pkts=117, num_bytes_ip=5864, flow_label=0], resp=[size=894, state=4, num_pkts=126, num_bytes_ip=5929, flow_label=0], start_time=1153491888.530306, duration=60.712144, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=118, state=4, num_pkts=13, num_bytes_ip=634, flow_label=0], resp=[size=87, state=4, num_pkts=14, num_bytes_ip=651, flow_label=0], start_time=1153491888.530306, duration=9.202132, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=118, state=4, num_pkts=14, num_bytes_ip=686, flow_label=0], resp=[size=96, state=4, num_pkts=15, num_bytes_ip=691, flow_label=0], start_time=1153491888.530306, duration=9.681172, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1188, state=4, num_pkts=117, num_bytes_ip=5864, flow_label=0], resp=[size=894, state=4, num_pkts=127, num_bytes_ip=5978, flow_label=0], start_time=1153491888.530306, duration=60.749118, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1188, state=4, num_pkts=118, num_bytes_ip=5916, flow_label=0], resp=[size=903, state=4, num_pkts=127, num_bytes_ip=5978, flow_label=0], start_time=1153491888.530306, duration=61.25587, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=12, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=44, flow_label=0], start_time=1153491888.530306, duration=3.682539, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=12, state=4, num_pkts=3, num_bytes_ip=140, flow_label=0], resp=[size=9, state=4, num_pkts=3, num_bytes_ip=124, flow_label=0], start_time=1153491888.530306, duration=4.253344, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1200, state=4, num_pkts=118, num_bytes_ip=5916, flow_label=0], resp=[size=903, state=4, num_pkts=128, num_bytes_ip=6027, flow_label=0], start_time=1153491888.530306, duration=61.28013, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1200, state=4, num_pkts=119, num_bytes_ip=5968, flow_label=0], resp=[size=912, state=4, num_pkts=128, num_bytes_ip=6027, flow_label=0], start_time=1153491888.530306, duration=61.788553, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1212, state=4, num_pkts=119, num_bytes_ip=5968, flow_label=0], resp=[size=912, state=4, num_pkts=129, num_bytes_ip=6076, flow_label=0], start_time=1153491888.530306, duration=61.810915, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1212, state=4, num_pkts=120, num_bytes_ip=6020, flow_label=0], resp=[size=921, state=4, num_pkts=130, num_bytes_ip=6116, flow_label=0], start_time=1153491888.530306, duration=62.309643, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1224, state=4, num_pkts=120, num_bytes_ip=6020, flow_label=0], resp=[size=921, state=4, num_pkts=131, num_bytes_ip=6165, flow_label=0], start_time=1153491888.530306, duration=62.345607, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1224, state=4, num_pkts=121, num_bytes_ip=6072, flow_label=0], resp=[size=930, state=4, num_pkts=131, num_bytes_ip=6165, flow_label=0], start_time=1153491888.530306, duration=62.825059, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1236, state=4, num_pkts=121, num_bytes_ip=6072, flow_label=0], resp=[size=930, state=4, num_pkts=132, num_bytes_ip=6214, flow_label=0], start_time=1153491888.530306, duration=62.876596, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1236, state=4, num_pkts=122, num_bytes_ip=6124, flow_label=0], resp=[size=939, state=4, num_pkts=132, num_bytes_ip=6214, flow_label=0], start_time=1153491888.530306, duration=63.397384, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1248, state=4, num_pkts=122, num_bytes_ip=6124, flow_label=0], resp=[size=939, state=4, num_pkts=133, num_bytes_ip=6263, flow_label=0], start_time=1153491888.530306, duration=63.405622, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1248, state=4, num_pkts=123, num_bytes_ip=6176, flow_label=0], resp=[size=948, state=4, num_pkts=134, num_bytes_ip=6303, flow_label=0], start_time=1153491888.530306, duration=63.909297, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1260, state=4, num_pkts=123, num_bytes_ip=6176, flow_label=0], resp=[size=948, state=4, num_pkts=135, num_bytes_ip=6352, flow_label=0], start_time=1153491888.530306, duration=63.936325, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1260, state=4, num_pkts=124, num_bytes_ip=6228, flow_label=0], resp=[size=957, state=4, num_pkts=135, num_bytes_ip=6352, flow_label=0], start_time=1153491888.530306, duration=64.437228, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1272, state=4, num_pkts=124, num_bytes_ip=6228, flow_label=0], resp=[size=957, state=4, num_pkts=136, num_bytes_ip=6401, flow_label=0], start_time=1153491888.530306, duration=64.468375, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1272, state=4, num_pkts=125, num_bytes_ip=6280, flow_label=0], resp=[size=966, state=4, num_pkts=136, num_bytes_ip=6401, flow_label=0], start_time=1153491888.530306, duration=64.951121, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1284, state=4, num_pkts=125, num_bytes_ip=6280, flow_label=0], resp=[size=966, state=4, num_pkts=137, num_bytes_ip=6450, flow_label=0], start_time=1153491888.530306, duration=64.999397, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1284, state=4, num_pkts=126, num_bytes_ip=6332, flow_label=0], resp=[size=975, state=4, num_pkts=138, num_bytes_ip=6490, flow_label=0], start_time=1153491888.530306, duration=65.488016, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1296, state=4, num_pkts=126, num_bytes_ip=6332, flow_label=0], resp=[size=975, state=4, num_pkts=139, num_bytes_ip=6539, flow_label=0], start_time=1153491888.530306, duration=65.530855, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1296, state=4, num_pkts=127, num_bytes_ip=6384, flow_label=0], resp=[size=984, state=4, num_pkts=139, num_bytes_ip=6539, flow_label=0], start_time=1153491888.530306, duration=66.203087, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=130, state=4, num_pkts=14, num_bytes_ip=686, flow_label=0], resp=[size=96, state=4, num_pkts=16, num_bytes_ip=740, flow_label=0], start_time=1153491888.530306, duration=9.733931, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=130, state=4, num_pkts=15, num_bytes_ip=738, flow_label=0], resp=[size=105, state=4, num_pkts=16, num_bytes_ip=740, flow_label=0], start_time=1153491888.530306, duration=10.214291, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1308, state=4, num_pkts=127, num_bytes_ip=6384, flow_label=0], resp=[size=984, state=4, num_pkts=140, num_bytes_ip=6588, flow_label=0], start_time=1153491888.530306, duration=66.311602, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1308, state=4, num_pkts=128, num_bytes_ip=6436, flow_label=0], resp=[size=993, state=4, num_pkts=140, num_bytes_ip=6588, flow_label=0], start_time=1153491888.530306, duration=66.825024, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1320, state=4, num_pkts=128, num_bytes_ip=6436, flow_label=0], resp=[size=993, state=4, num_pkts=141, num_bytes_ip=6637, flow_label=0], start_time=1153491888.530306, duration=66.842548, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1320, state=4, num_pkts=129, num_bytes_ip=6488, flow_label=0], resp=[size=1002, state=4, num_pkts=141, num_bytes_ip=6637, flow_label=0], start_time=1153491888.530306, duration=67.379785, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1332, state=4, num_pkts=130, num_bytes_ip=6528, flow_label=0], resp=[size=1002, state=4, num_pkts=142, num_bytes_ip=6686, flow_label=0], start_time=1153491888.530306, duration=67.62423, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1332, state=4, num_pkts=131, num_bytes_ip=6580, flow_label=0], resp=[size=1011, state=4, num_pkts=143, num_bytes_ip=6726, flow_label=0], start_time=1153491888.530306, duration=68.111926, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1344, state=4, num_pkts=131, num_bytes_ip=6580, flow_label=0], resp=[size=1011, state=4, num_pkts=144, num_bytes_ip=6775, flow_label=0], start_time=1153491888.530306, duration=68.155519, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1344, state=4, num_pkts=132, num_bytes_ip=6632, flow_label=0], resp=[size=1020, state=4, num_pkts=144, num_bytes_ip=6775, flow_label=0], start_time=1153491888.530306, duration=68.735926, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1356, state=4, num_pkts=133, num_bytes_ip=6672, flow_label=0], resp=[size=1020, state=4, num_pkts=145, num_bytes_ip=6824, flow_label=0], start_time=1153491888.530306, duration=68.936561, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1356, state=4, num_pkts=134, num_bytes_ip=6724, flow_label=0], resp=[size=1029, state=4, num_pkts=146, num_bytes_ip=6864, flow_label=0], start_time=1153491888.530306, duration=69.502004, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1368, state=4, num_pkts=135, num_bytes_ip=6764, flow_label=0], resp=[size=1029, state=4, num_pkts=147, num_bytes_ip=6913, flow_label=0], start_time=1153491888.530306, duration=69.7174, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1368, state=4, num_pkts=136, num_bytes_ip=6816, flow_label=0], resp=[size=1038, state=4, num_pkts=148, num_bytes_ip=6953, flow_label=0], start_time=1153491888.530306, duration=70.196469, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1380, state=4, num_pkts=136, num_bytes_ip=6816, flow_label=0], resp=[size=1038, state=4, num_pkts=149, num_bytes_ip=7002, flow_label=0], start_time=1153491888.530306, duration=70.249327, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1380, state=4, num_pkts=137, num_bytes_ip=6868, flow_label=0], resp=[size=1047, state=4, num_pkts=149, num_bytes_ip=7002, flow_label=0], start_time=1153491888.530306, duration=70.910274, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1392, state=4, num_pkts=137, num_bytes_ip=6868, flow_label=0], resp=[size=1047, state=4, num_pkts=150, num_bytes_ip=7051, flow_label=0], start_time=1153491888.530306, duration=71.030324, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1392, state=4, num_pkts=138, num_bytes_ip=6920, flow_label=0], resp=[size=1056, state=4, num_pkts=151, num_bytes_ip=7091, flow_label=0], start_time=1153491888.530306, duration=71.509915, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1404, state=4, num_pkts=138, num_bytes_ip=6920, flow_label=0], resp=[size=1056, state=4, num_pkts=152, num_bytes_ip=7140, flow_label=0], start_time=1153491888.530306, duration=71.562379, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1404, state=4, num_pkts=139, num_bytes_ip=6972, flow_label=0], resp=[size=1065, state=4, num_pkts=152, num_bytes_ip=7140, flow_label=0], start_time=1153491888.530306, duration=72.080309, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1416, state=4, num_pkts=139, num_bytes_ip=6972, flow_label=0], resp=[size=1065, state=4, num_pkts=153, num_bytes_ip=7189, flow_label=0], start_time=1153491888.530306, duration=72.092372, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1416, state=4, num_pkts=140, num_bytes_ip=7024, flow_label=0], resp=[size=1074, state=4, num_pkts=153, num_bytes_ip=7189, flow_label=0], start_time=1153491888.530306, duration=72.619654, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=142, state=4, num_pkts=15, num_bytes_ip=738, flow_label=0], resp=[size=105, state=4, num_pkts=17, num_bytes_ip=789, flow_label=0], start_time=1153491888.530306, duration=10.263741, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=142, state=4, num_pkts=16, num_bytes_ip=790, flow_label=0], resp=[size=114, state=4, num_pkts=17, num_bytes_ip=789, flow_label=0], start_time=1153491888.530306, duration=10.760576, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1428, state=4, num_pkts=140, num_bytes_ip=7024, flow_label=0], resp=[size=1074, state=4, num_pkts=154, num_bytes_ip=7238, flow_label=0], start_time=1153491888.530306, duration=72.624638, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1428, state=4, num_pkts=141, num_bytes_ip=7076, flow_label=0], resp=[size=1083, state=4, num_pkts=154, num_bytes_ip=7238, flow_label=0], start_time=1153491888.530306, duration=73.088307, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1440, state=4, num_pkts=141, num_bytes_ip=7076, flow_label=0], resp=[size=1083, state=4, num_pkts=155, num_bytes_ip=7287, flow_label=0], start_time=1153491888.530306, duration=73.155924, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1440, state=4, num_pkts=142, num_bytes_ip=7128, flow_label=0], resp=[size=1092, state=4, num_pkts=155, num_bytes_ip=7287, flow_label=0], start_time=1153491888.530306, duration=73.650911, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1452, state=4, num_pkts=142, num_bytes_ip=7128, flow_label=0], resp=[size=1092, state=4, num_pkts=156, num_bytes_ip=7336, flow_label=0], start_time=1153491888.530306, duration=73.686795, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1452, state=4, num_pkts=143, num_bytes_ip=7180, flow_label=0], resp=[size=1101, state=4, num_pkts=156, num_bytes_ip=7336, flow_label=0], start_time=1153491888.530306, duration=74.15869, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1464, state=4, num_pkts=143, num_bytes_ip=7180, flow_label=0], resp=[size=1101, state=4, num_pkts=157, num_bytes_ip=7385, flow_label=0], start_time=1153491888.530306, duration=74.21831, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1464, state=4, num_pkts=144, num_bytes_ip=7232, flow_label=0], resp=[size=1110, state=4, num_pkts=157, num_bytes_ip=7385, flow_label=0], start_time=1153491888.530306, duration=74.696407, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1476, state=4, num_pkts=144, num_bytes_ip=7232, flow_label=0], resp=[size=1110, state=4, num_pkts=158, num_bytes_ip=7434, flow_label=0], start_time=1153491888.530306, duration=74.756798, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1476, state=4, num_pkts=145, num_bytes_ip=7284, flow_label=0], resp=[size=1119, state=4, num_pkts=158, num_bytes_ip=7434, flow_label=0], start_time=1153491888.530306, duration=75.250923, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1488, state=4, num_pkts=145, num_bytes_ip=7284, flow_label=0], resp=[size=1119, state=4, num_pkts=159, num_bytes_ip=7483, flow_label=0], start_time=1153491888.530306, duration=75.280502, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1488, state=4, num_pkts=146, num_bytes_ip=7336, flow_label=0], resp=[size=1128, state=4, num_pkts=159, num_bytes_ip=7483, flow_label=0], start_time=1153491888.530306, duration=75.794156, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1500, state=4, num_pkts=146, num_bytes_ip=7336, flow_label=0], resp=[size=1128, state=4, num_pkts=160, num_bytes_ip=7532, flow_label=0], start_time=1153491888.530306, duration=75.810921, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1500, state=4, num_pkts=147, num_bytes_ip=7388, flow_label=0], resp=[size=1137, state=4, num_pkts=160, num_bytes_ip=7532, flow_label=0], start_time=1153491888.530306, duration=76.339922, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1512, state=4, num_pkts=147, num_bytes_ip=7388, flow_label=0], resp=[size=1137, state=4, num_pkts=161, num_bytes_ip=7581, flow_label=0], start_time=1153491888.530306, duration=76.344022, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1512, state=4, num_pkts=148, num_bytes_ip=7440, flow_label=0], resp=[size=1148, state=4, num_pkts=161, num_bytes_ip=7581, flow_label=0], start_time=1153491888.530306, duration=76.815765, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1524, state=4, num_pkts=148, num_bytes_ip=7440, flow_label=0], resp=[size=1148, state=4, num_pkts=162, num_bytes_ip=7632, flow_label=0], start_time=1153491888.530306, duration=76.876565, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1524, state=4, num_pkts=149, num_bytes_ip=7492, flow_label=0], resp=[size=1157, state=4, num_pkts=162, num_bytes_ip=7632, flow_label=0], start_time=1153491888.530306, duration=77.367017, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1536, state=4, num_pkts=149, num_bytes_ip=7492, flow_label=0], resp=[size=1157, state=4, num_pkts=163, num_bytes_ip=7681, flow_label=0], start_time=1153491888.530306, duration=77.405333, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1536, state=4, num_pkts=150, num_bytes_ip=7544, flow_label=0], resp=[size=1166, state=4, num_pkts=163, num_bytes_ip=7681, flow_label=0], start_time=1153491888.530306, duration=77.895586, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=154, state=4, num_pkts=16, num_bytes_ip=790, flow_label=0], resp=[size=114, state=4, num_pkts=18, num_bytes_ip=838, flow_label=0], start_time=1153491888.530306, duration=10.796151, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=154, state=4, num_pkts=17, num_bytes_ip=842, flow_label=0], resp=[size=123, state=4, num_pkts=18, num_bytes_ip=838, flow_label=0], start_time=1153491888.530306, duration=11.304244, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1548, state=4, num_pkts=151, num_bytes_ip=7584, flow_label=0], resp=[size=1166, state=4, num_pkts=164, num_bytes_ip=7730, flow_label=0], start_time=1153491888.530306, duration=78.442494, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1548, state=4, num_pkts=152, num_bytes_ip=7636, flow_label=0], resp=[size=1176, state=4, num_pkts=165, num_bytes_ip=7770, flow_label=0], start_time=1153491888.530306, duration=78.931853, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1560, state=4, num_pkts=152, num_bytes_ip=7636, flow_label=0], resp=[size=1176, state=4, num_pkts=166, num_bytes_ip=7820, flow_label=0], start_time=1153491888.530306, duration=78.969742, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1560, state=4, num_pkts=153, num_bytes_ip=7688, flow_label=0], resp=[size=1186, state=4, num_pkts=166, num_bytes_ip=7820, flow_label=0], start_time=1153491888.530306, duration=79.470957, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1572, state=4, num_pkts=153, num_bytes_ip=7688, flow_label=0], resp=[size=1186, state=4, num_pkts=167, num_bytes_ip=7870, flow_label=0], start_time=1153491888.530306, duration=79.499542, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1572, state=4, num_pkts=154, num_bytes_ip=7740, flow_label=0], resp=[size=1195, state=4, num_pkts=167, num_bytes_ip=7870, flow_label=0], start_time=1153491888.530306, duration=79.974922, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1584, state=4, num_pkts=154, num_bytes_ip=7740, flow_label=0], resp=[size=1195, state=4, num_pkts=168, num_bytes_ip=7919, flow_label=0], start_time=1153491888.530306, duration=80.030043, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1584, state=4, num_pkts=155, num_bytes_ip=7792, flow_label=0], resp=[size=1204, state=4, num_pkts=168, num_bytes_ip=7919, flow_label=0], start_time=1153491888.530306, duration=80.576052, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1596, state=4, num_pkts=156, num_bytes_ip=7832, flow_label=0], resp=[size=1204, state=4, num_pkts=169, num_bytes_ip=7968, flow_label=0], start_time=1153491888.530306, duration=80.811484, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1596, state=4, num_pkts=157, num_bytes_ip=7884, flow_label=0], resp=[size=1213, state=4, num_pkts=170, num_bytes_ip=8008, flow_label=0], start_time=1153491888.530306, duration=81.276794, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1608, state=4, num_pkts=157, num_bytes_ip=7884, flow_label=0], resp=[size=1213, state=4, num_pkts=171, num_bytes_ip=8057, flow_label=0], start_time=1153491888.530306, duration=81.345195, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1608, state=4, num_pkts=158, num_bytes_ip=7936, flow_label=0], resp=[size=1222, state=4, num_pkts=171, num_bytes_ip=8057, flow_label=0], start_time=1153491888.530306, duration=81.832292, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1620, state=4, num_pkts=158, num_bytes_ip=7936, flow_label=0], resp=[size=1222, state=4, num_pkts=172, num_bytes_ip=8106, flow_label=0], start_time=1153491888.530306, duration=81.876132, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1620, state=4, num_pkts=159, num_bytes_ip=7988, flow_label=0], resp=[size=1231, state=4, num_pkts=172, num_bytes_ip=8106, flow_label=0], start_time=1153491888.530306, duration=82.409905, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1632, state=4, num_pkts=160, num_bytes_ip=8028, flow_label=0], resp=[size=1231, state=4, num_pkts=173, num_bytes_ip=8155, flow_label=0], start_time=1153491888.530306, duration=82.65533, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1632, state=4, num_pkts=161, num_bytes_ip=8080, flow_label=0], resp=[size=1240, state=4, num_pkts=173, num_bytes_ip=8155, flow_label=0], start_time=1153491888.530306, duration=83.20462, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1644, state=4, num_pkts=162, num_bytes_ip=8120, flow_label=0], resp=[size=1240, state=4, num_pkts=175, num_bytes_ip=8244, flow_label=0], start_time=1153491888.530306, duration=83.436787, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1644, state=4, num_pkts=163, num_bytes_ip=8172, flow_label=0], resp=[size=1250, state=4, num_pkts=176, num_bytes_ip=8284, flow_label=0], start_time=1153491888.530306, duration=83.918648, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1656, state=4, num_pkts=163, num_bytes_ip=8172, flow_label=0], resp=[size=1250, state=4, num_pkts=177, num_bytes_ip=8334, flow_label=0], start_time=1153491888.530306, duration=83.967916, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1656, state=4, num_pkts=164, num_bytes_ip=8224, flow_label=0], resp=[size=1260, state=4, num_pkts=177, num_bytes_ip=8334, flow_label=0], start_time=1153491888.530306, duration=84.479362, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=166, state=4, num_pkts=17, num_bytes_ip=842, flow_label=0], resp=[size=123, state=4, num_pkts=19, num_bytes_ip=887, flow_label=0], start_time=1153491888.530306, duration=11.327596, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=166, state=4, num_pkts=18, num_bytes_ip=894, flow_label=0], resp=[size=132, state=4, num_pkts=19, num_bytes_ip=887, flow_label=0], start_time=1153491888.530306, duration=11.890384, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1668, state=4, num_pkts=164, num_bytes_ip=8224, flow_label=0], resp=[size=1260, state=4, num_pkts=178, num_bytes_ip=8384, flow_label=0], start_time=1153491888.530306, duration=84.49875, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1668, state=4, num_pkts=165, num_bytes_ip=8276, flow_label=0], resp=[size=1269, state=4, num_pkts=178, num_bytes_ip=8384, flow_label=0], start_time=1153491888.530306, duration=84.969612, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1680, state=4, num_pkts=165, num_bytes_ip=8276, flow_label=0], resp=[size=1269, state=4, num_pkts=179, num_bytes_ip=8433, flow_label=0], start_time=1153491888.530306, duration=85.030872, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1680, state=4, num_pkts=166, num_bytes_ip=8328, flow_label=0], resp=[size=1278, state=4, num_pkts=180, num_bytes_ip=8473, flow_label=0], start_time=1153491888.530306, duration=85.548114, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1692, state=4, num_pkts=166, num_bytes_ip=8328, flow_label=0], resp=[size=1278, state=4, num_pkts=181, num_bytes_ip=8522, flow_label=0], start_time=1153491888.530306, duration=85.560847, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=178, state=4, num_pkts=19, num_bytes_ip=934, flow_label=0], resp=[size=132, state=4, num_pkts=20, num_bytes_ip=936, flow_label=0], start_time=1153491888.530306, duration=12.108666, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=178, state=4, num_pkts=20, num_bytes_ip=986, flow_label=0], resp=[size=141, state=4, num_pkts=21, num_bytes_ip=976, flow_label=0], start_time=1153491888.530306, duration=12.569742, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=191, state=4, num_pkts=20, num_bytes_ip=986, flow_label=0], resp=[size=141, state=4, num_pkts=22, num_bytes_ip=1025, flow_label=0], start_time=1153491888.530306, duration=12.642865, service={ @@ -39801,80 +39859,153 @@ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=264, state=4, num_pkts=28, num_bytes_ip=1392, flow_label=0], resp=[size=204, state=4, num_pkts=30, num_bytes_ip=1399, flow_label=0], start_time=1153491888.530306, duration=17.075718, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=276, state=4, num_pkts=28, num_bytes_ip=1392, flow_label=0], resp=[size=204, state=4, num_pkts=31, num_bytes_ip=1448, flow_label=0], start_time=1153491888.530306, duration=17.108426, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=276, state=4, num_pkts=29, num_bytes_ip=1444, flow_label=0], resp=[size=213, state=4, num_pkts=31, num_bytes_ip=1448, flow_label=0], start_time=1153491888.530306, duration=17.596616, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=288, state=4, num_pkts=29, num_bytes_ip=1444, flow_label=0], resp=[size=213, state=4, num_pkts=32, num_bytes_ip=1497, flow_label=0], start_time=1153491888.530306, duration=17.640409, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=288, state=4, num_pkts=30, num_bytes_ip=1496, flow_label=0], resp=[size=222, state=4, num_pkts=32, num_bytes_ip=1497, flow_label=0], start_time=1153491888.530306, duration=18.135017, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=300, state=4, num_pkts=30, num_bytes_ip=1496, flow_label=0], resp=[size=222, state=4, num_pkts=33, num_bytes_ip=1546, flow_label=0], start_time=1153491888.530306, duration=18.170407, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=300, state=4, num_pkts=31, num_bytes_ip=1548, flow_label=0], resp=[size=231, state=4, num_pkts=33, num_bytes_ip=1546, flow_label=0], start_time=1153491888.530306, duration=18.672683, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=312, state=4, num_pkts=32, num_bytes_ip=1588, flow_label=0], resp=[size=231, state=4, num_pkts=35, num_bytes_ip=1635, flow_label=0], start_time=1153491888.530306, duration=18.721681, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=312, state=4, num_pkts=33, num_bytes_ip=1640, flow_label=0], resp=[size=240, state=4, num_pkts=36, num_bytes_ip=1675, flow_label=0], start_time=1153491888.530306, duration=19.190786, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=324, state=4, num_pkts=33, num_bytes_ip=1640, flow_label=0], resp=[size=240, state=4, num_pkts=37, num_bytes_ip=1724, flow_label=0], start_time=1153491888.530306, duration=19.249214, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=324, state=4, num_pkts=34, num_bytes_ip=1692, flow_label=0], resp=[size=249, state=4, num_pkts=37, num_bytes_ip=1724, flow_label=0], start_time=1153491888.530306, duration=19.757738, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=336, state=4, num_pkts=34, num_bytes_ip=1692, flow_label=0], resp=[size=249, state=4, num_pkts=38, num_bytes_ip=1773, flow_label=0], start_time=1153491888.530306, duration=19.782538, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=336, state=4, num_pkts=35, num_bytes_ip=1744, flow_label=0], resp=[size=258, state=4, num_pkts=39, num_bytes_ip=1813, flow_label=0], start_time=1153491888.530306, duration=20.263906, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=348, state=4, num_pkts=35, num_bytes_ip=1744, flow_label=0], resp=[size=258, state=4, num_pkts=40, num_bytes_ip=1862, flow_label=0], start_time=1153491888.530306, duration=20.31077, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=348, state=4, num_pkts=36, num_bytes_ip=1796, flow_label=0], resp=[size=267, state=4, num_pkts=41, num_bytes_ip=1902, flow_label=0], start_time=1153491888.530306, duration=20.883819, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=36, state=4, num_pkts=5, num_bytes_ip=232, flow_label=0], resp=[size=18, state=4, num_pkts=6, num_bytes_ip=262, flow_label=0], start_time=1153491888.530306, duration=4.989347, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=36, state=4, num_pkts=6, num_bytes_ip=284, flow_label=0], resp=[size=27, state=4, num_pkts=6, num_bytes_ip=262, flow_label=0], start_time=1153491888.530306, duration=5.460382, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=360, state=4, num_pkts=37, num_bytes_ip=1836, flow_label=0], resp=[size=267, state=4, num_pkts=42, num_bytes_ip=1951, flow_label=0], start_time=1153491888.530306, duration=21.093121, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=360, state=4, num_pkts=38, num_bytes_ip=1888, flow_label=0], resp=[size=276, state=4, num_pkts=43, num_bytes_ip=1991, flow_label=0], start_time=1153491888.530306, duration=21.563184, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=372, state=4, num_pkts=38, num_bytes_ip=1888, flow_label=0], resp=[size=276, state=4, num_pkts=44, num_bytes_ip=2040, flow_label=0], start_time=1153491888.530306, duration=21.624587, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=372, state=4, num_pkts=39, num_bytes_ip=1940, flow_label=0], resp=[size=285, state=4, num_pkts=44, num_bytes_ip=2040, flow_label=0], start_time=1153491888.530306, duration=22.174738, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=384, state=4, num_pkts=40, num_bytes_ip=1980, flow_label=0], resp=[size=285, state=4, num_pkts=45, num_bytes_ip=2089, flow_label=0], start_time=1153491888.530306, duration=22.406064, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=384, state=4, num_pkts=41, num_bytes_ip=2032, flow_label=0], resp=[size=294, state=4, num_pkts=46, num_bytes_ip=2129, flow_label=0], start_time=1153491888.530306, duration=22.886413, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=396, state=4, num_pkts=41, num_bytes_ip=2032, flow_label=0], resp=[size=294, state=4, num_pkts=47, num_bytes_ip=2178, flow_label=0], start_time=1153491888.530306, duration=22.936992, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=396, state=4, num_pkts=42, num_bytes_ip=2084, flow_label=0], resp=[size=303, state=4, num_pkts=47, num_bytes_ip=2178, flow_label=0], start_time=1153491888.530306, duration=23.446488, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=408, state=4, num_pkts=42, num_bytes_ip=2084, flow_label=0], resp=[size=303, state=4, num_pkts=48, num_bytes_ip=2227, flow_label=0], start_time=1153491888.530306, duration=23.466958, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=408, state=4, num_pkts=43, num_bytes_ip=2136, flow_label=0], resp=[size=312, state=4, num_pkts=48, num_bytes_ip=2227, flow_label=0], start_time=1153491888.530306, duration=23.964306, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=420, state=4, num_pkts=43, num_bytes_ip=2136, flow_label=0], resp=[size=312, state=4, num_pkts=49, num_bytes_ip=2276, flow_label=0], start_time=1153491888.530306, duration=23.999137, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=420, state=4, num_pkts=44, num_bytes_ip=2188, flow_label=0], resp=[size=321, state=4, num_pkts=49, num_bytes_ip=2276, flow_label=0], start_time=1153491888.530306, duration=24.48342, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=432, state=4, num_pkts=44, num_bytes_ip=2188, flow_label=0], resp=[size=321, state=4, num_pkts=50, num_bytes_ip=2325, flow_label=0], start_time=1153491888.530306, duration=24.530404, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=432, state=4, num_pkts=45, num_bytes_ip=2240, flow_label=0], resp=[size=330, state=4, num_pkts=50, num_bytes_ip=2325, flow_label=0], start_time=1153491888.530306, duration=25.032935, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=444, state=4, num_pkts=45, num_bytes_ip=2240, flow_label=0], resp=[size=330, state=4, num_pkts=51, num_bytes_ip=2374, flow_label=0], start_time=1153491888.530306, duration=25.061594, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=444, state=4, num_pkts=46, num_bytes_ip=2292, flow_label=0], resp=[size=339, state=4, num_pkts=51, num_bytes_ip=2374, flow_label=0], start_time=1153491888.530306, duration=25.572459, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=456, state=4, num_pkts=46, num_bytes_ip=2292, flow_label=0], resp=[size=339, state=4, num_pkts=52, num_bytes_ip=2423, flow_label=0], start_time=1153491888.530306, duration=25.593017, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=456, state=4, num_pkts=47, num_bytes_ip=2344, flow_label=0], resp=[size=348, state=4, num_pkts=52, num_bytes_ip=2423, flow_label=0], start_time=1153491888.530306, duration=26.079285, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=468, state=4, num_pkts=48, num_bytes_ip=2384, flow_label=0], resp=[size=348, state=4, num_pkts=54, num_bytes_ip=2512, flow_label=0], start_time=1153491888.530306, duration=26.124409, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=468, state=4, num_pkts=49, num_bytes_ip=2436, flow_label=0], resp=[size=357, state=4, num_pkts=55, num_bytes_ip=2552, flow_label=0], start_time=1153491888.530306, duration=26.618017, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=48, state=4, num_pkts=6, num_bytes_ip=284, flow_label=0], resp=[size=27, state=4, num_pkts=7, num_bytes_ip=311, flow_label=0], start_time=1153491888.530306, duration=5.514817, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=48, state=4, num_pkts=7, num_bytes_ip=336, flow_label=0], resp=[size=36, state=4, num_pkts=7, num_bytes_ip=311, flow_label=0], start_time=1153491888.530306, duration=6.046432, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=480, state=4, num_pkts=49, num_bytes_ip=2436, flow_label=0], resp=[size=357, state=4, num_pkts=56, num_bytes_ip=2601, flow_label=0], start_time=1153491888.530306, duration=26.655214, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=480, state=4, num_pkts=50, num_bytes_ip=2488, flow_label=0], resp=[size=366, state=4, num_pkts=56, num_bytes_ip=2601, flow_label=0], start_time=1153491888.530306, duration=27.136011, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=492, state=4, num_pkts=50, num_bytes_ip=2488, flow_label=0], resp=[size=366, state=4, num_pkts=57, num_bytes_ip=2650, flow_label=0], start_time=1153491888.530306, duration=27.187196, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=492, state=4, num_pkts=51, num_bytes_ip=2540, flow_label=0], resp=[size=378, state=4, num_pkts=58, num_bytes_ip=2690, flow_label=0], start_time=1153491888.530306, duration=27.715795, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=504, state=4, num_pkts=51, num_bytes_ip=2540, flow_label=0], resp=[size=378, state=4, num_pkts=59, num_bytes_ip=2742, flow_label=0], start_time=1153491888.530306, duration=27.717341, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=504, state=4, num_pkts=52, num_bytes_ip=2592, flow_label=0], resp=[size=387, state=4, num_pkts=59, num_bytes_ip=2742, flow_label=0], start_time=1153491888.530306, duration=28.3095, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=516, state=4, num_pkts=53, num_bytes_ip=2632, flow_label=0], resp=[size=387, state=4, num_pkts=60, num_bytes_ip=2791, flow_label=0], start_time=1153491888.530306, duration=28.497916, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=516, state=4, num_pkts=54, num_bytes_ip=2684, flow_label=0], resp=[size=399, state=4, num_pkts=61, num_bytes_ip=2831, flow_label=0], start_time=1153491888.530306, duration=28.979974, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=528, state=4, num_pkts=54, num_bytes_ip=2684, flow_label=0], resp=[size=399, state=4, num_pkts=62, num_bytes_ip=2883, flow_label=0], start_time=1153491888.530306, duration=29.030757, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=528, state=4, num_pkts=55, num_bytes_ip=2736, flow_label=0], resp=[size=408, state=4, num_pkts=62, num_bytes_ip=2883, flow_label=0], start_time=1153491888.530306, duration=29.567217, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=540, state=4, num_pkts=56, num_bytes_ip=2776, flow_label=0], resp=[size=408, state=4, num_pkts=63, num_bytes_ip=2932, flow_label=0], start_time=1153491888.530306, duration=29.811569, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=540, state=4, num_pkts=57, num_bytes_ip=2828, flow_label=0], resp=[size=417, state=4, num_pkts=64, num_bytes_ip=2972, flow_label=0], start_time=1153491888.530306, duration=30.355713, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=552, state=4, num_pkts=58, num_bytes_ip=2868, flow_label=0], resp=[size=417, state=4, num_pkts=65, num_bytes_ip=3021, flow_label=0], start_time=1153491888.530306, duration=30.59277, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=552, state=4, num_pkts=59, num_bytes_ip=2920, flow_label=0], resp=[size=426, state=4, num_pkts=66, num_bytes_ip=3061, flow_label=0], start_time=1153491888.530306, duration=31.107213, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=564, state=4, num_pkts=59, num_bytes_ip=2920, flow_label=0], resp=[size=426, state=4, num_pkts=67, num_bytes_ip=3110, flow_label=0], start_time=1153491888.530306, duration=31.123048, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=564, state=4, num_pkts=60, num_bytes_ip=2972, flow_label=0], resp=[size=435, state=4, num_pkts=67, num_bytes_ip=3110, flow_label=0], start_time=1153491888.530306, duration=31.602613, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=576, state=4, num_pkts=60, num_bytes_ip=2972, flow_label=0], resp=[size=435, state=4, num_pkts=68, num_bytes_ip=3159, flow_label=0], start_time=1153491888.530306, duration=31.655542, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=576, state=4, num_pkts=61, num_bytes_ip=3024, flow_label=0], resp=[size=444, state=4, num_pkts=68, num_bytes_ip=3159, flow_label=0], start_time=1153491888.530306, duration=32.130733, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=588, state=4, num_pkts=61, num_bytes_ip=3024, flow_label=0], resp=[size=444, state=4, num_pkts=69, num_bytes_ip=3208, flow_label=0], start_time=1153491888.530306, duration=32.186402, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=588, state=4, num_pkts=62, num_bytes_ip=3076, flow_label=0], resp=[size=453, state=4, num_pkts=69, num_bytes_ip=3208, flow_label=0], start_time=1153491888.530306, duration=32.669997, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=60, state=4, num_pkts=7, num_bytes_ip=336, flow_label=0], resp=[size=36, state=4, num_pkts=8, num_bytes_ip=360, flow_label=0], start_time=1153491888.530306, duration=6.047297, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=60, state=4, num_pkts=8, num_bytes_ip=388, flow_label=0], resp=[size=45, state=4, num_pkts=8, num_bytes_ip=360, flow_label=0], start_time=1153491888.530306, duration=6.725711, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=600, state=4, num_pkts=62, num_bytes_ip=3076, flow_label=0], resp=[size=453, state=4, num_pkts=70, num_bytes_ip=3257, flow_label=0], start_time=1153491888.530306, duration=32.717363, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=600, state=4, num_pkts=63, num_bytes_ip=3128, flow_label=0], resp=[size=462, state=4, num_pkts=70, num_bytes_ip=3257, flow_label=0], start_time=1153491888.530306, duration=33.250545, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=612, state=4, num_pkts=64, num_bytes_ip=3168, flow_label=0], resp=[size=462, state=4, num_pkts=71, num_bytes_ip=3306, flow_label=0], start_time=1153491888.530306, duration=33.498322, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=612, state=4, num_pkts=65, num_bytes_ip=3220, flow_label=0], resp=[size=471, state=4, num_pkts=72, num_bytes_ip=3346, flow_label=0], start_time=1153491888.530306, duration=33.986119, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=624, state=4, num_pkts=65, num_bytes_ip=3220, flow_label=0], resp=[size=471, state=4, num_pkts=73, num_bytes_ip=3395, flow_label=0], start_time=1153491888.530306, duration=34.030509, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=624, state=4, num_pkts=66, num_bytes_ip=3272, flow_label=0], resp=[size=480, state=4, num_pkts=73, num_bytes_ip=3395, flow_label=0], start_time=1153491888.530306, duration=34.545587, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=636, state=4, num_pkts=66, num_bytes_ip=3272, flow_label=0], resp=[size=480, state=4, num_pkts=74, num_bytes_ip=3444, flow_label=0], start_time=1153491888.530306, duration=34.561436, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=636, state=4, num_pkts=67, num_bytes_ip=3324, flow_label=0], resp=[size=489, state=4, num_pkts=74, num_bytes_ip=3444, flow_label=0], start_time=1153491888.530306, duration=35.038051, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=648, state=4, num_pkts=67, num_bytes_ip=3324, flow_label=0], resp=[size=489, state=4, num_pkts=75, num_bytes_ip=3493, flow_label=0], start_time=1153491888.530306, duration=35.093154, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=648, state=4, num_pkts=68, num_bytes_ip=3376, flow_label=0], resp=[size=498, state=4, num_pkts=75, num_bytes_ip=3493, flow_label=0], start_time=1153491888.530306, duration=35.596662, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=660, state=4, num_pkts=68, num_bytes_ip=3376, flow_label=0], resp=[size=498, state=4, num_pkts=76, num_bytes_ip=3542, flow_label=0], start_time=1153491888.530306, duration=35.62475, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=660, state=4, num_pkts=69, num_bytes_ip=3428, flow_label=0], resp=[size=507, state=4, num_pkts=76, num_bytes_ip=3542, flow_label=0], start_time=1153491888.530306, duration=36.207526, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=672, state=4, num_pkts=69, num_bytes_ip=3428, flow_label=0], resp=[size=507, state=4, num_pkts=77, num_bytes_ip=3591, flow_label=0], start_time=1153491888.530306, duration=36.404294, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=672, state=4, num_pkts=70, num_bytes_ip=3480, flow_label=0], resp=[size=516, state=4, num_pkts=77, num_bytes_ip=3591, flow_label=0], start_time=1153491888.530306, duration=36.896668, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=684, state=4, num_pkts=70, num_bytes_ip=3480, flow_label=0], resp=[size=516, state=4, num_pkts=78, num_bytes_ip=3640, flow_label=0], start_time=1153491888.530306, duration=36.937042, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=684, state=4, num_pkts=71, num_bytes_ip=3532, flow_label=0], resp=[size=525, state=4, num_pkts=78, num_bytes_ip=3640, flow_label=0], start_time=1153491888.530306, duration=37.439394, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=696, state=4, num_pkts=71, num_bytes_ip=3532, flow_label=0], resp=[size=525, state=4, num_pkts=79, num_bytes_ip=3689, flow_label=0], start_time=1153491888.530306, duration=37.467953, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=696, state=4, num_pkts=72, num_bytes_ip=3584, flow_label=0], resp=[size=534, state=4, num_pkts=79, num_bytes_ip=3689, flow_label=0], start_time=1153491888.530306, duration=37.970796, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=708, state=4, num_pkts=72, num_bytes_ip=3584, flow_label=0], resp=[size=534, state=4, num_pkts=80, num_bytes_ip=3738, flow_label=0], start_time=1153491888.530306, duration=37.998512, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=708, state=4, num_pkts=73, num_bytes_ip=3636, flow_label=0], resp=[size=543, state=4, num_pkts=80, num_bytes_ip=3738, flow_label=0], start_time=1153491888.530306, duration=38.48887, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=72, state=4, num_pkts=8, num_bytes_ip=388, flow_label=0], resp=[size=45, state=4, num_pkts=9, num_bytes_ip=409, flow_label=0], start_time=1153491888.530306, duration=6.827529, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=72, state=4, num_pkts=9, num_bytes_ip=440, flow_label=0], resp=[size=57, state=4, num_pkts=9, num_bytes_ip=409, flow_label=0], start_time=1153491888.530306, duration=7.301997, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=720, state=4, num_pkts=73, num_bytes_ip=3636, flow_label=0], resp=[size=543, state=4, num_pkts=81, num_bytes_ip=3787, flow_label=0], start_time=1153491888.530306, duration=38.530242, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=720, state=4, num_pkts=74, num_bytes_ip=3688, flow_label=0], resp=[size=552, state=4, num_pkts=81, num_bytes_ip=3787, flow_label=0], start_time=1153491888.530306, duration=39.023012, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=732, state=4, num_pkts=74, num_bytes_ip=3688, flow_label=0], resp=[size=552, state=4, num_pkts=82, num_bytes_ip=3836, flow_label=0], start_time=1153491888.530306, duration=39.060605, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=732, state=4, num_pkts=75, num_bytes_ip=3740, flow_label=0], resp=[size=561, state=4, num_pkts=82, num_bytes_ip=3836, flow_label=0], start_time=1153491888.530306, duration=39.560036, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=744, state=4, num_pkts=75, num_bytes_ip=3740, flow_label=0], resp=[size=561, state=4, num_pkts=83, num_bytes_ip=3885, flow_label=0], start_time=1153491888.530306, duration=39.591559, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=744, state=4, num_pkts=76, num_bytes_ip=3792, flow_label=0], resp=[size=570, state=4, num_pkts=84, num_bytes_ip=3925, flow_label=0], start_time=1153491888.530306, duration=40.095979, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=756, state=4, num_pkts=76, num_bytes_ip=3792, flow_label=0], resp=[size=570, state=4, num_pkts=85, num_bytes_ip=3974, flow_label=0], start_time=1153491888.530306, duration=40.124172, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=756, state=4, num_pkts=77, num_bytes_ip=3844, flow_label=0], resp=[size=579, state=4, num_pkts=85, num_bytes_ip=3974, flow_label=0], start_time=1153491888.530306, duration=40.614094, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=768, state=4, num_pkts=77, num_bytes_ip=3844, flow_label=0], resp=[size=579, state=4, num_pkts=86, num_bytes_ip=4023, flow_label=0], start_time=1153491888.530306, duration=40.655762, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=768, state=4, num_pkts=78, num_bytes_ip=3896, flow_label=0], resp=[size=588, state=4, num_pkts=86, num_bytes_ip=4023, flow_label=0], start_time=1153491888.530306, duration=41.133252, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=780, state=4, num_pkts=78, num_bytes_ip=3896, flow_label=0], resp=[size=588, state=4, num_pkts=87, num_bytes_ip=4072, flow_label=0], start_time=1153491888.530306, duration=41.185604, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=780, state=4, num_pkts=79, num_bytes_ip=3948, flow_label=0], resp=[size=597, state=4, num_pkts=87, num_bytes_ip=4072, flow_label=0], start_time=1153491888.530306, duration=41.850238, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=792, state=4, num_pkts=79, num_bytes_ip=3948, flow_label=0], resp=[size=597, state=4, num_pkts=88, num_bytes_ip=4121, flow_label=0], start_time=1153491888.530306, duration=41.968313, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=792, state=4, num_pkts=80, num_bytes_ip=4000, flow_label=0], resp=[size=606, state=4, num_pkts=88, num_bytes_ip=4121, flow_label=0], start_time=1153491888.530306, duration=42.424703, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=804, state=4, num_pkts=80, num_bytes_ip=4000, flow_label=0], resp=[size=606, state=4, num_pkts=89, num_bytes_ip=4170, flow_label=0], start_time=1153491888.530306, duration=42.499803, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=804, state=4, num_pkts=81, num_bytes_ip=4052, flow_label=0], resp=[size=615, state=4, num_pkts=89, num_bytes_ip=4170, flow_label=0], start_time=1153491888.530306, duration=42.977926, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=816, state=4, num_pkts=81, num_bytes_ip=4052, flow_label=0], resp=[size=615, state=4, num_pkts=90, num_bytes_ip=4219, flow_label=0], start_time=1153491888.530306, duration=43.030218, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=816, state=4, num_pkts=82, num_bytes_ip=4104, flow_label=0], resp=[size=624, state=4, num_pkts=90, num_bytes_ip=4219, flow_label=0], start_time=1153491888.530306, duration=43.533732, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=828, state=4, num_pkts=82, num_bytes_ip=4104, flow_label=0], resp=[size=624, state=4, num_pkts=91, num_bytes_ip=4268, flow_label=0], start_time=1153491888.530306, duration=43.561464, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=828, state=4, num_pkts=83, num_bytes_ip=4156, flow_label=0], resp=[size=633, state=4, num_pkts=91, num_bytes_ip=4268, flow_label=0], start_time=1153491888.530306, duration=44.08694, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=840, state=4, num_pkts=83, num_bytes_ip=4156, flow_label=0], resp=[size=633, state=4, num_pkts=92, num_bytes_ip=4317, flow_label=0], start_time=1153491888.530306, duration=44.092451, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=840, state=4, num_pkts=84, num_bytes_ip=4208, flow_label=0], resp=[size=642, state=4, num_pkts=92, num_bytes_ip=4317, flow_label=0], start_time=1153491888.530306, duration=44.687246, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=852, state=4, num_pkts=85, num_bytes_ip=4248, flow_label=0], resp=[size=642, state=4, num_pkts=93, num_bytes_ip=4366, flow_label=0], start_time=1153491888.530306, duration=44.876654, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=852, state=4, num_pkts=86, num_bytes_ip=4300, flow_label=0], resp=[size=651, state=4, num_pkts=94, num_bytes_ip=4406, flow_label=0], start_time=1153491888.530306, duration=45.367867, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=86, state=4, num_pkts=10, num_bytes_ip=494, flow_label=0], resp=[size=66, state=4, num_pkts=10, num_bytes_ip=461, flow_label=0], start_time=1153491888.530306, duration=7.896377, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=86, state=4, num_pkts=9, num_bytes_ip=440, flow_label=0], resp=[size=57, state=4, num_pkts=10, num_bytes_ip=461, flow_label=0], start_time=1153491888.530306, duration=7.358692, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=864, state=4, num_pkts=86, num_bytes_ip=4300, flow_label=0], resp=[size=651, state=4, num_pkts=95, num_bytes_ip=4455, flow_label=0], start_time=1153491888.530306, duration=45.407285, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=864, state=4, num_pkts=87, num_bytes_ip=4352, flow_label=0], resp=[size=660, state=4, num_pkts=95, num_bytes_ip=4455, flow_label=0], start_time=1153491888.530306, duration=45.962889, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=876, state=4, num_pkts=88, num_bytes_ip=4392, flow_label=0], resp=[size=660, state=4, num_pkts=96, num_bytes_ip=4504, flow_label=0], start_time=1153491888.530306, duration=46.186442, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=876, state=4, num_pkts=89, num_bytes_ip=4444, flow_label=0], resp=[size=669, state=4, num_pkts=97, num_bytes_ip=4544, flow_label=0], start_time=1153491888.530306, duration=46.682263, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=888, state=4, num_pkts=89, num_bytes_ip=4444, flow_label=0], resp=[size=669, state=4, num_pkts=98, num_bytes_ip=4593, flow_label=0], start_time=1153491888.530306, duration=46.717514, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=888, state=4, num_pkts=90, num_bytes_ip=4496, flow_label=0], resp=[size=678, state=4, num_pkts=98, num_bytes_ip=4593, flow_label=0], start_time=1153491888.530306, duration=47.220644, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=900, state=4, num_pkts=90, num_bytes_ip=4496, flow_label=0], resp=[size=678, state=4, num_pkts=99, num_bytes_ip=4642, flow_label=0], start_time=1153491888.530306, duration=47.248349, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=900, state=4, num_pkts=91, num_bytes_ip=4548, flow_label=0], resp=[size=687, state=4, num_pkts=99, num_bytes_ip=4642, flow_label=0], start_time=1153491888.530306, duration=47.759541, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=912, state=4, num_pkts=91, num_bytes_ip=4548, flow_label=0], resp=[size=687, state=4, num_pkts=100, num_bytes_ip=4691, flow_label=0], start_time=1153491888.530306, duration=47.786321, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=912, state=4, num_pkts=92, num_bytes_ip=4600, flow_label=0], resp=[size=696, state=4, num_pkts=100, num_bytes_ip=4691, flow_label=0], start_time=1153491888.530306, duration=48.290308, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=924, state=4, num_pkts=92, num_bytes_ip=4600, flow_label=0], resp=[size=696, state=4, num_pkts=101, num_bytes_ip=4740, flow_label=0], start_time=1153491888.530306, duration=48.311175, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=924, state=4, num_pkts=93, num_bytes_ip=4652, flow_label=0], resp=[size=705, state=4, num_pkts=101, num_bytes_ip=4740, flow_label=0], start_time=1153491888.530306, duration=48.796528, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=936, state=4, num_pkts=93, num_bytes_ip=4652, flow_label=0], resp=[size=705, state=4, num_pkts=102, num_bytes_ip=4789, flow_label=0], start_time=1153491888.530306, duration=48.843594, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=936, state=4, num_pkts=94, num_bytes_ip=4704, flow_label=0], resp=[size=714, state=4, num_pkts=102, num_bytes_ip=4789, flow_label=0], start_time=1153491888.530306, duration=49.345363, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=94, state=4, num_pkts=11, num_bytes_ip=534, flow_label=0], resp=[size=66, state=4, num_pkts=11, num_bytes_ip=510, flow_label=0], start_time=1153491888.530306, duration=8.139941, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=94, state=4, num_pkts=12, num_bytes_ip=582, flow_label=0], resp=[size=75, state=4, num_pkts=12, num_bytes_ip=550, flow_label=0], start_time=1153491888.530306, duration=8.635233, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=948, state=4, num_pkts=94, num_bytes_ip=4704, flow_label=0], resp=[size=714, state=4, num_pkts=103, num_bytes_ip=4838, flow_label=0], start_time=1153491888.530306, duration=49.372772, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=948, state=4, num_pkts=95, num_bytes_ip=4756, flow_label=0], resp=[size=723, state=4, num_pkts=103, num_bytes_ip=4838, flow_label=0], start_time=1153491888.530306, duration=49.863195, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=960, state=4, num_pkts=95, num_bytes_ip=4756, flow_label=0], resp=[size=723, state=4, num_pkts=104, num_bytes_ip=4887, flow_label=0], start_time=1153491888.530306, duration=49.905117, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=960, state=4, num_pkts=96, num_bytes_ip=4808, flow_label=0], resp=[size=732, state=4, num_pkts=104, num_bytes_ip=4887, flow_label=0], start_time=1153491888.530306, duration=50.453189, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=972, state=4, num_pkts=97, num_bytes_ip=4848, flow_label=0], resp=[size=732, state=4, num_pkts=105, num_bytes_ip=4936, flow_label=0], start_time=1153491888.530306, duration=50.685308, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=972, state=4, num_pkts=98, num_bytes_ip=4900, flow_label=0], resp=[size=741, state=4, num_pkts=106, num_bytes_ip=4976, flow_label=0], start_time=1153491888.530306, duration=51.190391, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=984, state=4, num_pkts=98, num_bytes_ip=4900, flow_label=0], resp=[size=741, state=4, num_pkts=107, num_bytes_ip=5025, flow_label=0], start_time=1153491888.530306, duration=51.217726, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=984, state=4, num_pkts=99, num_bytes_ip=4952, flow_label=0], resp=[size=750, state=4, num_pkts=107, num_bytes_ip=5025, flow_label=0], start_time=1153491888.530306, duration=51.712373, service={ 1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=996, state=4, num_pkts=100, num_bytes_ip=5004, flow_label=0], resp=[size=759, state=4, num_pkts=108, num_bytes_ip=5074, flow_label=0], start_time=1153491888.530306, duration=52.247903, service={ +1 modbus_message, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=996, state=4, num_pkts=99, num_bytes_ip=4952, flow_label=0], resp=[size=750, state=4, num_pkts=108, num_bytes_ip=5074, flow_label=0], start_time=1153491888.530306, duration=51.750122, service={ 1 modbus_read_coils_request, [id=[orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], orig=[size=12, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1093522326.102435, duration=12.883183, service={ 1 modbus_read_coils_request, [id=[orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=180, flow_label=0], resp=[size=10, state=4, num_pkts=2, num_bytes_ip=98, flow_label=0], start_time=1093522326.102435, duration=42.639953, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1548, state=4, num_pkts=151, num_bytes_ip=7584, flow_label=0], resp=[size=1166, state=4, num_pkts=164, num_bytes_ip=7730, flow_label=0], start_time=1153491888.530306, duration=78.442494, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1560, state=4, num_pkts=152, num_bytes_ip=7636, flow_label=0], resp=[size=1176, state=4, num_pkts=166, num_bytes_ip=7820, flow_label=0], start_time=1153491888.530306, duration=78.969742, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1572, state=4, num_pkts=153, num_bytes_ip=7688, flow_label=0], resp=[size=1186, state=4, num_pkts=167, num_bytes_ip=7870, flow_label=0], start_time=1153491888.530306, duration=79.499542, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1584, state=4, num_pkts=154, num_bytes_ip=7740, flow_label=0], resp=[size=1195, state=4, num_pkts=168, num_bytes_ip=7919, flow_label=0], start_time=1153491888.530306, duration=80.030043, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1596, state=4, num_pkts=156, num_bytes_ip=7832, flow_label=0], resp=[size=1204, state=4, num_pkts=169, num_bytes_ip=7968, flow_label=0], start_time=1153491888.530306, duration=80.811484, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1608, state=4, num_pkts=157, num_bytes_ip=7884, flow_label=0], resp=[size=1213, state=4, num_pkts=171, num_bytes_ip=8057, flow_label=0], start_time=1153491888.530306, duration=81.345195, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1620, state=4, num_pkts=158, num_bytes_ip=7936, flow_label=0], resp=[size=1222, state=4, num_pkts=172, num_bytes_ip=8106, flow_label=0], start_time=1153491888.530306, duration=81.876132, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1632, state=4, num_pkts=160, num_bytes_ip=8028, flow_label=0], resp=[size=1231, state=4, num_pkts=173, num_bytes_ip=8155, flow_label=0], start_time=1153491888.530306, duration=82.65533, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1644, state=4, num_pkts=162, num_bytes_ip=8120, flow_label=0], resp=[size=1240, state=4, num_pkts=175, num_bytes_ip=8244, flow_label=0], start_time=1153491888.530306, duration=83.436787, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1656, state=4, num_pkts=163, num_bytes_ip=8172, flow_label=0], resp=[size=1250, state=4, num_pkts=177, num_bytes_ip=8334, flow_label=0], start_time=1153491888.530306, duration=83.967916, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1668, state=4, num_pkts=164, num_bytes_ip=8224, flow_label=0], resp=[size=1260, state=4, num_pkts=178, num_bytes_ip=8384, flow_label=0], start_time=1153491888.530306, duration=84.49875, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1680, state=4, num_pkts=165, num_bytes_ip=8276, flow_label=0], resp=[size=1269, state=4, num_pkts=179, num_bytes_ip=8433, flow_label=0], start_time=1153491888.530306, duration=85.030872, service={ +1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1692, state=4, num_pkts=166, num_bytes_ip=8328, flow_label=0], resp=[size=1278, state=4, num_pkts=181, num_bytes_ip=8522, flow_label=0], start_time=1153491888.530306, duration=85.560847, service={ 1 modbus_read_coils_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=180, flow_label=0], resp=[size=9, state=4, num_pkts=4, num_bytes_ip=173, flow_label=0], start_time=1153491888.530306, duration=4.453876, service={ 1 modbus_read_coils_response, [id=[orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], orig=[size=12, state=4, num_pkts=3, num_bytes_ip=140, flow_label=0], resp=[size=10, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0], start_time=1093522326.102435, duration=12.885181, service={ 1 modbus_read_coils_response, [id=[orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], orig=[size=24, state=4, num_pkts=5, num_bytes_ip=232, flow_label=0], resp=[size=20, state=4, num_pkts=2, num_bytes_ip=98, flow_label=0], start_time=1093522326.102435, duration=42.641902, service={ @@ -39883,6 +40014,7 @@ 1 modbus_read_coils_response, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1644, state=4, num_pkts=163, num_bytes_ip=8172, flow_label=0], resp=[size=1250, state=4, num_pkts=176, num_bytes_ip=8284, flow_label=0], start_time=1153491888.530306, duration=83.918648, service={ 1 modbus_read_coils_response, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=1656, state=4, num_pkts=164, num_bytes_ip=8224, flow_label=0], resp=[size=1260, state=4, num_pkts=177, num_bytes_ip=8334, flow_label=0], start_time=1153491888.530306, duration=84.479362, service={ 1 modbus_read_discrete_inputs_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=36, state=4, num_pkts=5, num_bytes_ip=232, flow_label=0], resp=[size=18, state=4, num_pkts=6, num_bytes_ip=262, flow_label=0], start_time=1153491888.530306, duration=4.989347, service={ +1 modbus_read_fifo_queue_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=300, state=4, num_pkts=30, num_bytes_ip=1496, flow_label=0], resp=[size=222, state=4, num_pkts=33, num_bytes_ip=1546, flow_label=0], start_time=1153491888.530306, duration=18.170407, service={ 1 modbus_read_file_record_request, [id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], orig=[size=252, state=4, num_pkts=26, num_bytes_ip=1288, flow_label=0], resp=[size=186, state=4, num_pkts=28, num_bytes_ip=1310, flow_label=0], start_time=1153491888.530306, duration=15.805153, service={ 1 modbus_read_holding_registers_request, [id=[orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], orig=[size=36, state=4, num_pkts=6, num_bytes_ip=272, flow_label=0], resp=[size=20, state=4, num_pkts=3, num_bytes_ip=148, flow_label=0], start_time=1093522326.102435, duration=79.029749, service={ 1 modbus_read_holding_registers_request, [id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], orig=[size=100020, state=4, num_pkts=16670, num_bytes_ip=966860, flow_label=0], resp=[size=1731956, state=4, num_pkts=8442, num_bytes_ip=2170952, flow_label=0], start_time=1342774499.588269, duration=883.218191, service={ @@ -79631,137 +79763,269 @@ 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491905.638732, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=MASK_WRITE_REGISTER, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=22], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.126922, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=MASK_WRITE_REGISTER_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=150], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.126922, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=MASK_WRITE_REGISTER_EXCEPTION, exception=ILLEGAL_DATA_VALUE], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=150], 3 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.170715, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_WRITE_MULTIPLE_REGISTERS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=23], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.665323, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_WRITE_MULTIPLE_REGISTERS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=151], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.665323, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_WRITE_MULTIPLE_REGISTERS_EXCEPTION, exception=ILLEGAL_DATA_VALUE], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=151], 3 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.700713, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_FIFO_QUEUE, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=24], 0 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491906.700713, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_FIFO_QUEUE, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=24], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491907.202989, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_FIFO_QUEUE_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=152], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491907.202989, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_FIFO_QUEUE_EXCEPTION, exception=ILLEGAL_DATA_VALUE], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=152], 3 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491907.251987, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-25, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=25], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491907.721092, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-153, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=153], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491907.77952, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-26, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=26], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491908.288044, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-154, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=154], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491908.312844, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-27, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=27], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491908.794212, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-155, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=155], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491908.841076, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-28, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=28], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491909.414125, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-156, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=156], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491909.623427, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-29, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=29], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491910.09349, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-157, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=157], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491910.154893, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-30, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=30], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491910.705044, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-158, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=158], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491910.93637, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-31, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=31], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491911.416719, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-159, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=159], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491911.467298, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-32, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=32], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491911.976794, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-160, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=160], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491911.997264, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-33, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=33], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491912.494612, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-161, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=161], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491912.529443, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-34, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=34], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491913.013726, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-162, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=162], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491913.06071, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-35, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=35], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491913.563241, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-163, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=163], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491913.5919, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-36, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=36], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491914.102765, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-164, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=164], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491914.123323, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-37, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=37], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491914.609591, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-165, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=165], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491914.654715, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-38, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=38], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491915.148323, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-166, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=166], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491915.18552, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-39, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=39], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491915.666317, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-167, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=167], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491915.717502, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=PROGRAM_CONCEPT, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=40], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491916.246101, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=PROGRAM_CONCEPT, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=40], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491916.247647, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-41, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=41], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491916.839806, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-169, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=169], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491917.028222, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-42, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=42], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491917.51028, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-42, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=42], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491917.561063, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=ENCAP_INTERFACE_TRANSPORT, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=43], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491918.097523, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-171, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=171], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491918.341875, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-44, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=44], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491918.886019, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-172, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=172], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491919.123076, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-45, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=45], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491919.637519, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-173, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=173], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491919.653354, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-46, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=46], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491920.132919, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-174, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=174], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491920.185848, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-47, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=47], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491920.661039, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-175, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=175], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491920.716708, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-48, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=48], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491921.200303, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-176, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=176], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491921.247669, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-49, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=49], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491921.780851, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-177, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=177], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491922.028628, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-50, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=50], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491922.516425, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-178, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=178], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491922.560815, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-51, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=51], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491923.075893, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-179, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=179], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491923.091742, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-52, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=52], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491923.568357, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-180, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=180], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491923.62346, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-53, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=53], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491924.126968, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-181, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=181], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491924.155056, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-54, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=54], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491924.737832, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-182, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=182], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491924.9346, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-55, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=55], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491925.426974, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-183, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=183], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491925.467348, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-56, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=56], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491925.9697, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-184, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=184], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491925.998259, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-57, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=57], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491926.501102, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-185, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=185], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491926.528818, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-58, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=58], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491927.019176, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-186, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=186], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491927.060548, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-59, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=59], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491927.553318, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-187, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=187], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491927.590911, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-60, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=60], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491928.090342, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-188, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=188], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491928.121865, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-61, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=61], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491928.626285, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-189, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=189], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491928.654478, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-62, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=62], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491929.1444, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-190, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=190], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491929.186068, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-63, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=63], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491929.663558, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-191, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=191], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491929.71591, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-64, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=64], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491930.380544, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-192, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=192], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491930.498619, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-65, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=65], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491930.955009, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-193, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=193], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491931.030109, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-66, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=66], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491931.508232, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-194, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=194], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491931.560524, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-67, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=67], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491932.064038, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-195, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=195], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491932.09177, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-68, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=68], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491932.617246, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-196, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=196], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491932.622757, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-69, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=69], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491933.217552, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-197, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=197], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491933.40696, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-70, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=70], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491933.898173, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-198, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=198], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491933.937591, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-71, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=71], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491934.493195, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-199, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=199], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491934.716748, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-72, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=72], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491935.212569, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-200, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=200], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491935.24782, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-73, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=73], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491935.75095, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-201, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=201], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491935.778655, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-74, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=74], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491936.289847, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-202, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=202], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491936.316627, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-75, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=75], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491936.820614, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-203, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=203], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491936.841481, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-76, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=76], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491937.326834, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-204, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=204], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491937.3739, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-77, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=77], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491937.875669, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-205, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=205], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491937.903078, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-78, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=78], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491938.393501, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-206, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=206], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491938.435423, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-79, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=79], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491938.983495, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-207, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=207], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491939.215614, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-80, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=80], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491939.720697, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-208, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=208], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491939.748032, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-81, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=81], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491940.242679, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-209, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=209], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491940.280428, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-82, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=82], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491940.778209, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-210, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=210], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491940.810125, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-83, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=83], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491941.3116, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-211, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=211], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491941.341976, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-84, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=84], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491941.85194, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-212, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=212], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491941.875446, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-85, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=85], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491942.402906, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-213, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=213], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491942.405602, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-86, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=86], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491942.948265, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-214, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=214], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491943.186144, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-87, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=87], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491943.639225, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-215, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=215], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491943.717172, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-88, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=88], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491944.200324, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-216, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=216], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491944.248247, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-89, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=89], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491944.731019, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-217, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=217], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491944.779341, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-90, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=90], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491945.309829, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-218, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=218], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491945.310425, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-91, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=91], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491945.801031, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-219, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=219], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491945.841206, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-92, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=92], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491946.326315, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-220, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=220], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491946.372811, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-93, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=93], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491946.881363, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-221, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=221], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491946.903163, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-94, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=94], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491947.379569, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-222, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=222], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491947.438778, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-95, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=95], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491947.917182, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-223, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=223], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491947.967051, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-96, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=96], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491948.522538, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-224, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=224], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491948.748474, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-97, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=97], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491949.24245, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-225, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=225], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491949.279424, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-98, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=98], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491949.786176, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-226, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=226], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491949.810436, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-99, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=99], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491950.318859, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-227, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=227], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491950.341221, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-100, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=100], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491950.839949, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-228, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=228], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491950.875913, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-101, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=101], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491951.355365, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-229, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=229], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491951.406902, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-102, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=102], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491951.92769, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-230, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=230], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491951.935928, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-103, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=103], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491952.439603, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-231, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=231], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491952.466631, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-104, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=104], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491952.967534, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-232, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=232], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491952.998681, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-105, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=105], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491953.481427, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-233, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=233], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491953.529703, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-106, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=106], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491954.018322, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-234, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=234], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491954.061161, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-107, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=107], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491954.733393, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-235, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=235], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491954.841908, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-108, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=108], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491955.35533, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-236, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=236], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491955.372854, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-109, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=109], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491955.910091, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-237, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=237], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491956.154536, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-110, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=110], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491956.642232, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-238, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=238], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491956.685825, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-111, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=111], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491957.266232, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-239, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=239], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491957.466867, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-112, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=112], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491958.03231, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-240, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=240], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491958.247706, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-113, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=113], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491958.726775, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-241, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=241], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491958.779633, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-114, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=114], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491959.44058, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-242, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=242], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491959.56063, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-115, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=115], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491960.040221, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-243, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=243], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491960.092685, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-116, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=116], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491960.610615, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-244, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=244], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491960.622678, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-117, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=117], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491961.14996, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-245, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=245], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491961.154944, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-118, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=118], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491961.618613, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-246, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=246], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491961.68623, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-119, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=119], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491962.181217, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-247, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=247], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491962.217101, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-120, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=120], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491962.688996, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-248, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=248], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491962.748616, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-121, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=121], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491963.226713, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-249, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=249], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491963.287104, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-122, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=122], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491963.781229, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-250, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=250], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491963.810808, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-123, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=123], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491964.324462, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-251, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=251], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491964.341227, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-124, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=124], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491964.870228, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-252, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=252], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491964.874328, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=FIRMWARE_REPLACEMENT, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=125], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491965.346071, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=FIRMWARE_REPLACEMENT, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=125], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491965.406871, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=PROGRAM_584_984_2, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=126], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491965.897323, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-254, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=254], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491965.935639, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=REPORT_LOCAL_ADDRESS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=127], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491966.425892, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=unknown-255, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=255], F +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491966.9728, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 0, 8 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491966.9728, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491967.462159, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491967.462159, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], [] +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491967.500048, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 0, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491967.500048, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.001263, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.001263, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], [] +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.029848, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 65535, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.029848, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.505228, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.505228, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.560349, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 32767, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491968.560349, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.106358, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.106358, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.34179, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 16383, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.34179, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.8071, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.8071, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.875501, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 8191, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491969.875501, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.362598, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.362598, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.406438, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 4095, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.406438, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.940211, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491970.940211, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.185636, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 2047, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.185636, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.734926, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.734926, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.967093, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 1023, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491971.967093, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491972.448954, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491972.448954, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], [] +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491972.498222, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 1535, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491972.498222, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.009668, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.009668, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], [] +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.029056, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 1791, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.029056, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.499918, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.499918, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.561178, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 1663, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491973.561178, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491974.07842, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], F 1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491974.07842, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS_EXCEPTION, exception=ILLEGAL_DATA_ADDRESS], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=129], 2 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491974.091153, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], 1599, 1 +1 }, addl=, hot=0, history=ShADad, uid=5OKnoww6xl4, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1153491974.091153, uid=5OKnoww6xl4, id=[orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], func=READ_COILS, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=0, pid=0, uid=1, function_code=1], T 1 }, addl=, hot=0, history=ShADd, uid=3PKsZ2Uye21, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1342774499.602711, uid=3PKsZ2Uye21, id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], func=WRITE_SINGLE_REGISTER, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=1, pid=0, uid=255, function_code=6], 100, 0 1 }, addl=, hot=0, history=ShADd, uid=3PKsZ2Uye21, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1342774499.602711, uid=3PKsZ2Uye21, id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], func=WRITE_SINGLE_REGISTER, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=1, pid=0, uid=255, function_code=6], F 1 }, addl=, hot=0, history=ShADd, uid=3PKsZ2Uye21, tunnel=, dpd=, conn=, extract_orig=F, extract_resp=F, dns=, dns_state=, ftp=, ssl=, http=, http_state=, irc=, modbus=[ts=1342774499.603636, uid=3PKsZ2Uye21, id=[orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], func=WRITE_SINGLE_REGISTER, exception=], smtp=, smtp_state=, socks=, ssh=, syslog=], [tid=2, pid=0, uid=255, function_code=6], 101, 0 diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/modbus.log b/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/modbus.log new file mode 100644 index 0000000000..315907f8c4 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/modbus.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path modbus +#open 2012-11-12-17-40-34 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p func exception +#types time string addr port addr port string string +1153491909.414125 UWkUyAuUGXf 192.168.66.235 2582 166.161.16.230 502 unknown-156 - +1153491913.013726 UWkUyAuUGXf 192.168.66.235 2582 166.161.16.230 502 unknown-162 - +#close 2012-11-12-17-40-34 diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/weird.log b/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/weird.log new file mode 100644 index 0000000000..455b7602f6 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.exception_handling/weird.log @@ -0,0 +1,11 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open 2012-11-12-17-40-34 +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer +#types time string addr port addr port string string bool string +1153491909.414066 - - - - - truncated_IP - F bro +1153491912.529443 UWkUyAuUGXf 192.168.66.235 2582 166.161.16.230 502 binpac exception: out_of_bound: WriteSingleRegisterRequest: 4 > 0 - F bro +#close 2012-11-12-17-40-34 diff --git a/testing/btest/Traces/modbus/fuzz-72.trace b/testing/btest/Traces/modbus/fuzz-72.trace new file mode 100644 index 0000000000000000000000000000000000000000..ef9a15940f1ea3a54348f6db1359cb9fb4ea2354 GIT binary patch literal 2907 zcmaKue@xVM7{@;!U|-J5bzns|HMg*1CkAweVP$eaKtG22Vzij8Hj%cULZUV3$6Ce)h%=*fIw38T#7c7WTmv_b9|L+n&v6Ie4{*=+-S=~Ud|&r| zp7--S-*5NvZ|WjMlnBP;q!1E6PW;{es4HI+YjLJaEL>5VbWXH447QD#M79tQS&D^N zshvo#uZ!t#Z^*nZhs<#v_fY$Q@6Sg4dW?8`kRGET)>mMq<4hN`>>*Z!a9CbsR`yKR zD?yeuM%1RzV~9vuBMFzabAiajZ@L1Y0FC)S%fsl$sv*jd7Zj-c)y>)h)LsKPl94@6a z*JjL26NG=Dtw%?iJ1@|mBO>J|l5qReEQU05#tdmDv8W0~R1c6hkmfP(I{})Al6TYT zXAqa)ZZZ(tjKpLnmMg@55Qji?d0VH5nvADYCy2GH1Fp{DtPRe-%+4-WQYJeFDdji6 zBu)gS{HY{d!i|8d^EjKr0=Fvy2O)400-JJC;Q}IRayi|IxYQK3SMFotYYK6~c(_26YyT!$6W*O3iCZrj!$2>Xq zc&|XOQJe5DVs#zf|a;lm&h(3HSWwnWMG^BVnjuHdk=1>=W$yp9CPTBbW-Y!SObpss3vm>{0H*wJ|ET)-6{5Ks|pojrl+n@g7|gXS>hlx z$?r5G?(&(Z2YCs71VLj(Xf@=s#%E>{%Y1$7J?>#Mhz)oC7XX6jq*D)wE#By9B0j5H zryJWQQpYzi(J_+8WLt7$g=lQCEl` T+QhIEDZ85P2&J5}9>@OyQ8dY6 literal 0 HcmV?d00001 diff --git a/testing/btest/Traces/modbus.trace b/testing/btest/Traces/modbus/modbus.trace similarity index 100% rename from testing/btest/Traces/modbus.trace rename to testing/btest/Traces/modbus/modbus.trace diff --git a/testing/btest/scripts/base/protocols/modbus/events.bro b/testing/btest/scripts/base/protocols/modbus/events.bro index 29c41b40b8..f648a0adde 100644 --- a/testing/btest/scripts/base/protocols/modbus/events.bro +++ b/testing/btest/scripts/base/protocols/modbus/events.bro @@ -1,7 +1,7 @@ # -# @TEST-EXEC: bro -r $TRACES/modbus.trace %INPUT | sort | uniq -c | sed 's/^ *//g' >output +# @TEST-EXEC: bro -r $TRACES/modbus/modbus.trace %INPUT | sort | uniq -c | sed 's/^ *//g' >output # @TEST-EXEC: btest-diff output -# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered +# @TEST-EXEC: cat output | awk '{print $2}' | grep "^modbus_" | sort | uniq | wc -l >covered # @TEST-EXEC: cat ${DIST}/src/event.bif | grep "^event modbus_" | wc -l >total # @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage # @TEST-EXEC: btest-diff coverage diff --git a/testing/btest/scripts/base/protocols/modbus/exception_handling.test b/testing/btest/scripts/base/protocols/modbus/exception_handling.test new file mode 100644 index 0000000000..9d15c754f9 --- /dev/null +++ b/testing/btest/scripts/base/protocols/modbus/exception_handling.test @@ -0,0 +1,10 @@ +# @TEST-EXEC: bro -r $TRACES/modbus/fuzz-72.trace +# @TEST-EXEC: btest-diff modbus.log +# @TEST-EXEC: btest-diff weird.log + +# The pcap has a flow with some fuzzed modbus traffic in it that should cause +# the binpac-generated analyzer code to throw a binpac::ExceptionOutOfBound. +# This should be correctly caught as a type of binpac::Exception and the +# binpac::ModbusTCP::Exception type that's defined as part of the analyzer +# shouldn't interfere with that handling and definitely shouldn't crash bro. +# A weird is currently emitted for parsing exceptions. diff --git a/testing/btest/scripts/base/protocols/modbus/policy.bro b/testing/btest/scripts/base/protocols/modbus/policy.bro index 327d1723c1..b28ebd3b4b 100644 --- a/testing/btest/scripts/base/protocols/modbus/policy.bro +++ b/testing/btest/scripts/base/protocols/modbus/policy.bro @@ -1,5 +1,5 @@ # -# @TEST-EXEC: bro -r $TRACES/modbus.trace %INPUT +# @TEST-EXEC: bro -r $TRACES/modbus/modbus.trace %INPUT # @TEST-EXEC: btest-diff modbus.log # @TEST-EXEC: btest-diff modbus_register_change.log # @TEST-EXEC: btest-diff known_modbus.log