feature-extraction-by-batch.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Feature Extraction per batch of T sec"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import csv\n",
    "\n",
    "from analyzer_clean import Flow, _FLOW_FIELDS"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Analyze each 10s batch\n",
    "- every 10 s a batch of flows is read\n",
    "- convert each batch into pandas df for feature extraction\n",
    "\n",
    "### Definitions:\n",
    "- entry is each line in csv (packet from netflow)\n",
    "- conns is unique (src_ip, dst_ip)\n",
    "- flow is unique flow tuple (src_ip, src_port, dst_ip, dst_port, ip_protocol)\n",
    "- src_port is randomly assigned\n",
    "- change in distribution of dst_port may indicate port scanning\n",
    "- change in distribution of src_ip or dst_ip may indicate DoS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "DATA = []\n",
    "FLOW_LIST = []\n",
    "T = 10\n",
    "\n",
    "with open(\"data.csv\", \"r\") as csvfile:\n",
    "    # pass input data stream as open(\"data.csv\", \"r\") to csv.reader for testing\n",
    "    # read and process line by line don't read into list\n",
    "    fin = csv.reader(csvfile)\n",
    "    for e in fin:\n",
    "        flow = Flow.from_csv(e)\n",
    "        FLOW_LIST.append(flow)\n",
    "        if int(flow.ts.strftime('%s')) % T == 0:\n",
    "            DATA.append(FLOW_LIST)\n",
    "            FLOW_LIST = []"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Dataframe of features extracted\n",
    "- volumetric features per batch\n",
    "    - number of entries (packets)\n",
    "    - number of bytes (up/dw)\n",
    "    - number of ports and ips\n",
    "    - num packets per state (['closed', 'established', 'reset', 'new', 'closing', 'connecting'])\n",
    "    \n",
    "- distribution features:\n",
    "    - count, mean, median, quartiles 25 and 75, 90 percentile\n",
    "    - group by (src_ip, dst_ip, dst_port, conn, flow)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [],
   "source": [
    "from collections import defaultdict\n",
    "\n",
    "def describe_distribution(num_param1_dist_by_param2):\n",
    "    description = {}\n",
    "    description[\"max\"] = num_param1_dist_by_param2.max()\n",
    "    description[\"mean\"] = num_param1_dist_by_param2.mean()\n",
    "    description[\"perc25\"] = num_param1_dist_by_param2.quantile(.25)\n",
    "    description[\"perc50\"] = num_param1_dist_by_param2.median()\n",
    "    description[\"perc75\"] = num_param1_dist_by_param2.quantile(.75)\n",
    "    description[\"perc90\"] = num_param1_dist_by_param2.quantile(.9)\n",
    "    return description"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [],
   "source": [
    "def get_volumetric_features(df, stats):\n",
    "    stats['num_entries'] = len(df)\n",
    "    \n",
    "    # num => len(); count => unique.len()\n",
    "    stats['count_dst_port'] = len( df['dst_port'].unique() )\n",
    "    stats['count_src_port'] = len( df['src_port'].unique() )\n",
    "    stats['count_dst_ip'] = len( df['dst_ip'].unique() )\n",
    "    stats['count_src_ip'] = len( df['src_ip'].unique() )\n",
    "    \n",
    "    # number of packets (entries) in each state\n",
    "    df_state_count = df.groupby('state')['dst_tx'].count()\n",
    "    for state in ['closed', 'established', 'reset', 'new', 'closing', 'connecting']:\n",
    "        if state in df_state_count:\n",
    "            stats['num_state_'+state] = df_state_count[state]\n",
    "    \n",
    "    return stats"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO move func to extract features here\n",
    "def get_distribution_features(df, stats, key):\n",
    "    if key=='conn':\n",
    "        pass\n",
    "    elif key=='flow':\n",
    "        pass\n",
    "    elif key=='dst_ip':\n",
    "        pass\n",
    "    elif key=='src_ip':\n",
    "        pass\n",
    "    elif key=='dst_port':\n",
    "        pass\n",
    "    else:\n",
    "        print(\"key??\", key)\n",
    "        \n",
    "    return stats"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [],
   "source": [
    "# this computation is performed in batches every 10s\n",
    "all_stats = defaultdict(list)\n",
    "flow_batch = 0  ##counter for flow batch in DATA\n",
    "\n",
    "for flow_list in DATA:\n",
    "    df = pd.DataFrame(flow_list)\n",
    "    stats = {}\n",
    "    stats['time_delta'] = flow_batch * T\n",
    "    flow_batch += 1\n",
    "    # VOLUMETRIC FEATURES ##stats = get_volumetric_features(df, stats)\n",
    "    # (1) num entries\n",
    "    stats['num_entries'] = len(df)\n",
    "    # num => len(); count => unique.len()\n",
    "    stats['count_dst_port'] = len( df['dst_port'].unique() )\n",
    "    stats['count_src_port'] = len( df['src_port'].unique() )\n",
    "    stats['count_dst_ip'] = len( df['dst_ip'].unique() )\n",
    "    stats['count_src_ip'] = len( df['src_ip'].unique() )\n",
    "    # number of packets (entries) in each state\n",
    "    df_state_count = df.groupby('state')['dst_tx'].count()\n",
    "    for state in ['closed', 'established', 'reset', 'new', 'closing', 'connecting']:\n",
    "        if state in df_state_count:\n",
    "            stats['num_state_'+state] = df_state_count[state]\n",
    "        else:\n",
    "            stats['num_state_'+state] = 0\n",
    "    \n",
    "    # DISTRIBUTION FEATURES\n",
    "    # (2) by conn => unique (dst_ip, src_ip)\n",
    "    ##stats = get_distribution_features(df, stats, 'conn')\n",
    "    gp1 = df.groupby(['dst_ip', 'src_ip'])\n",
    "    stats['count_conns'] = len(gp1)\n",
    "    # dst port per conn\n",
    "    _dist = gp1['dst_port'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['dst_port_per_conn_'+k] = v\n",
    "        \n",
    "    # (3) by flow => (dst_ip, dst_port, src_ip, src_port, protocol)\n",
    "    ##stats = get_distribution_features(df, stats, 'flow')\n",
    "    gp2 = df.groupby(['dst_ip', 'dst_port', 'src_ip', 'src_port', 'ip_protocol'])\n",
    "    stats['count_flows'] = len(gp2)\n",
    "    # mean flows per conn\n",
    "    stats['num_flows_per_conn_mean'] = stats['count_flows']/stats['count_conns']    \n",
    "    ## entries per flow\n",
    "    #num_conns_per_flow_dist = gp2['bytes_up'].count()\n",
    "    #num_flow_per_conn_dist = gp[['src_port', 'dst_port', 'ip_protocol']].count()\n",
    "    # ...\n",
    "    \n",
    "    # (4) by dst_ip\n",
    "    gp3 = df.groupby(['dst_ip'])\n",
    "    # dst_port by dst_ip\n",
    "    _dist = gp3['dst_port'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['dst_port_per_dst_ip_'+k] = v\n",
    "    # src_ip by dst_ip\n",
    "    _dist = gp3['src_ip'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['src_ip_per_dst_ip_'+k] = v\n",
    "        \n",
    "    # (5) by src_ip\n",
    "    gp4 = df.groupby(['src_ip'])\n",
    "    # dst_port by src_ip\n",
    "    _dist = gp4['dst_port'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['dst_port_per_src_ip_'+k] = v\n",
    "    # dst_ip by src_ip\n",
    "    _dist = gp4['dst_ip'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['dst_ip_per_src_ip_'+k] = v\n",
    "    \n",
    "    # (6) by dst_port\n",
    "    gp5 = df.groupby(['dst_port'])\n",
    "    # dst_ip by dst_port\n",
    "    _dist = gp5['dst_ip'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['dst_ip_per_dst_port_'+k] = v\n",
    "    # src_ip by dst_port\n",
    "    _dist = gp5['src_ip'].count()\n",
    "    for k,v in describe_distribution(_dist).items():\n",
    "        stats['src_ip_per_dst_port_'+k] = v\n",
    "        \n",
    "    # put in all_stats\n",
    "    for k,v in stats.items():\n",
    "        all_stats[k].append(v)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 96,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "time_delta 12904\n",
      "num_entries 12904\n",
      "count_dst_port 12904\n",
      "count_src_port 12904\n",
      "count_dst_ip 12904\n",
      "count_src_ip 12904\n",
      "num_state_closed 12904\n",
      "num_state_established 12904\n",
      "num_state_reset 12904\n",
      "num_state_new 12904\n",
      "num_state_closing 12904\n",
      "num_state_connecting 12904\n",
      "count_conns 12904\n",
      "dst_port_per_conn_max 12904\n",
      "dst_port_per_conn_mean 12904\n",
      "dst_port_per_conn_perc25 12904\n",
      "dst_port_per_conn_perc50 12904\n",
      "dst_port_per_conn_perc75 12904\n",
      "dst_port_per_conn_perc90 12904\n",
      "count_flows 12904\n",
      "num_flows_per_conn_mean 12904\n",
      "dst_port_per_dst_ip_max 12904\n",
      "dst_port_per_dst_ip_mean 12904\n",
      "dst_port_per_dst_ip_perc25 12904\n",
      "dst_port_per_dst_ip_perc50 12904\n",
      "dst_port_per_dst_ip_perc75 12904\n",
      "dst_port_per_dst_ip_perc90 12904\n",
      "src_ip_per_dst_ip_max 12904\n",
      "src_ip_per_dst_ip_mean 12904\n",
      "src_ip_per_dst_ip_perc25 12904\n",
      "src_ip_per_dst_ip_perc50 12904\n",
      "src_ip_per_dst_ip_perc75 12904\n",
      "src_ip_per_dst_ip_perc90 12904\n",
      "dst_port_per_src_ip_max 12904\n",
      "dst_port_per_src_ip_mean 12904\n",
      "dst_port_per_src_ip_perc25 12904\n",
      "dst_port_per_src_ip_perc50 12904\n",
      "dst_port_per_src_ip_perc75 12904\n",
      "dst_port_per_src_ip_perc90 12904\n",
      "dst_ip_per_src_ip_max 12904\n",
      "dst_ip_per_src_ip_mean 12904\n",
      "dst_ip_per_src_ip_perc25 12904\n",
      "dst_ip_per_src_ip_perc50 12904\n",
      "dst_ip_per_src_ip_perc75 12904\n",
      "dst_ip_per_src_ip_perc90 12904\n",
      "dst_ip_per_dst_port_max 12904\n",
      "dst_ip_per_dst_port_mean 12904\n",
      "dst_ip_per_dst_port_perc25 12904\n",
      "dst_ip_per_dst_port_perc50 12904\n",
      "dst_ip_per_dst_port_perc75 12904\n",
      "dst_ip_per_dst_port_perc90 12904\n",
      "src_ip_per_dst_port_max 12904\n",
      "src_ip_per_dst_port_mean 12904\n",
      "src_ip_per_dst_port_perc25 12904\n",
      "src_ip_per_dst_port_perc50 12904\n",
      "src_ip_per_dst_port_perc75 12904\n",
      "src_ip_per_dst_port_perc90 12904\n",
      "1290.4 12904 57\n"
     ]
    }
   ],
   "source": [
    "# check dataframe length\n",
    "for k,v in all_stats.items():\n",
    "    print( k, len(v) )\n",
    "\n",
    "print(flow_batch/T, len(DATA), len(all_stats))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### TODO\n",
    "- bytes_up, bytes_dw\n",
    "- duration\n",
    "- group by protocol: distributions per batch\n",
    "    - num_dstip, num_dstports,num_srcip, num_srcport\n",
    "- find flows: open and responded in t=10s\n",
    "    - dist open flows\n",
    "    - dist of duration per flow\n",
    "\n",
    "\n",
    "### Plot stat vs flow_batch (time)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [],
   "source": [
    "df_stats = pd.DataFrame( all_stats ).set_index('time_delta')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [],
   "source": [
    "#df_stats.to_pickle(\"df_features_per_batch.pkl\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>num_entries</th>\n",
       "      <th>count_dst_port</th>\n",
       "      <th>count_src_port</th>\n",
       "      <th>count_dst_ip</th>\n",
       "      <th>count_src_ip</th>\n",
       "      <th>num_state_closed</th>\n",
       "      <th>num_state_established</th>\n",
       "      <th>num_state_reset</th>\n",
       "      <th>num_state_new</th>\n",
       "      <th>num_state_closing</th>\n",
       "      <th>...</th>\n",
       "      <th>dst_ip_per_dst_port_perc25</th>\n",
       "      <th>dst_ip_per_dst_port_perc50</th>\n",
       "      <th>dst_ip_per_dst_port_perc75</th>\n",
       "      <th>dst_ip_per_dst_port_perc90</th>\n",
       "      <th>src_ip_per_dst_port_max</th>\n",
       "      <th>src_ip_per_dst_port_mean</th>\n",
       "      <th>src_ip_per_dst_port_perc25</th>\n",
       "      <th>src_ip_per_dst_port_perc50</th>\n",
       "      <th>src_ip_per_dst_port_perc75</th>\n",
       "      <th>src_ip_per_dst_port_perc90</th>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>time_delta</th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "      <th></th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>484</td>\n",
       "      <td>41</td>\n",
       "      <td>458</td>\n",
       "      <td>112</td>\n",
       "      <td>71</td>\n",
       "      <td>19</td>\n",
       "      <td>429</td>\n",
       "      <td>13</td>\n",
       "      <td>22</td>\n",
       "      <td>1</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>10.0</td>\n",
       "      <td>34.0</td>\n",
       "      <td>116</td>\n",
       "      <td>11.804878</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>10.0</td>\n",
       "      <td>34.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30</th>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>40</th>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>...</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1</td>\n",
       "      <td>1.000000</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "      <td>1.0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 56 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "            num_entries  count_dst_port  count_src_port  count_dst_ip  \\\n",
       "time_delta                                                              \n",
       "0                   484              41             458           112   \n",
       "10                    1               1               1             1   \n",
       "20                    1               1               1             1   \n",
       "30                    1               1               1             1   \n",
       "40                    1               1               1             1   \n",
       "\n",
       "            count_src_ip  num_state_closed  num_state_established  \\\n",
       "time_delta                                                          \n",
       "0                     71                19                    429   \n",
       "10                     1                 0                      1   \n",
       "20                     1                 0                      1   \n",
       "30                     1                 0                      1   \n",
       "40                     1                 0                      1   \n",
       "\n",
       "            num_state_reset  num_state_new  num_state_closing  \\\n",
       "time_delta                                                      \n",
       "0                        13             22                  1   \n",
       "10                        0              0                  0   \n",
       "20                        0              0                  0   \n",
       "30                        0              0                  0   \n",
       "40                        0              0                  0   \n",
       "\n",
       "                       ...              dst_ip_per_dst_port_perc25  \\\n",
       "time_delta             ...                                           \n",
       "0                      ...                                     1.0   \n",
       "10                     ...                                     1.0   \n",
       "20                     ...                                     1.0   \n",
       "30                     ...                                     1.0   \n",
       "40                     ...                                     1.0   \n",
       "\n",
       "            dst_ip_per_dst_port_perc50  dst_ip_per_dst_port_perc75  \\\n",
       "time_delta                                                           \n",
       "0                                  1.0                        10.0   \n",
       "10                                 1.0                         1.0   \n",
       "20                                 1.0                         1.0   \n",
       "30                                 1.0                         1.0   \n",
       "40                                 1.0                         1.0   \n",
       "\n",
       "            dst_ip_per_dst_port_perc90  src_ip_per_dst_port_max  \\\n",
       "time_delta                                                        \n",
       "0                                 34.0                      116   \n",
       "10                                 1.0                        1   \n",
       "20                                 1.0                        1   \n",
       "30                                 1.0                        1   \n",
       "40                                 1.0                        1   \n",
       "\n",
       "            src_ip_per_dst_port_mean  src_ip_per_dst_port_perc25  \\\n",
       "time_delta                                                         \n",
       "0                          11.804878                         1.0   \n",
       "10                          1.000000                         1.0   \n",
       "20                          1.000000                         1.0   \n",
       "30                          1.000000                         1.0   \n",
       "40                          1.000000                         1.0   \n",
       "\n",
       "            src_ip_per_dst_port_perc50  src_ip_per_dst_port_perc75  \\\n",
       "time_delta                                                           \n",
       "0                                  1.0                        10.0   \n",
       "10                                 1.0                         1.0   \n",
       "20                                 1.0                         1.0   \n",
       "30                                 1.0                         1.0   \n",
       "40                                 1.0                         1.0   \n",
       "\n",
       "            src_ip_per_dst_port_perc90  \n",
       "time_delta                              \n",
       "0                                 34.0  \n",
       "10                                 1.0  \n",
       "20                                 1.0  \n",
       "30                                 1.0  \n",
       "40                                 1.0  \n",
       "\n",
       "[5 rows x 56 columns]"
      ]
     },
     "execution_count": 50,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_stats.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Plots"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 88,
   "metadata": {},
   "outputs": [],
   "source": [
    "%matplotlib inline\n",
    "import matplotlib.pyplot as plt\n",
    "import os\n",
    "\n",
    "cols = df_stats.columns\n",
    "#cols1 = [c for c in cols if 'per' not in c]\n",
    "\n",
    "if not os.path.exists(\"results/features/\"): os.makedirs(\"results/features/\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 94,
   "metadata": {},
   "outputs": [],
   "source": [
    "i = 0\n",
    "for c in cols:\n",
    "    desc = df_stats[c].describe()\n",
    "    ax = df_stats[c].plot(figsize=(14,6), title=str(desc.to_dict()), style='.', grid=True)\n",
    "    ax.set_ylabel(str(i) + \". \" + c)\n",
    "    plt.savefig(\"results/features/\"+c)\n",
    "    #plt.show()\n",
    "    plt.close()\n",
    "    i += 1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Clustering on 57 extracted features"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 98,
   "metadata": {},
   "outputs": [],
   "source": [
    "# TODO kmeans, dbscan, lstm\n",
    "# TODO features extraction using PCA"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# How to go from anomaly detected in batch to identifying event?\n",
    "- Use entropy [Lakhina 05](http://conferences.sigcomm.org/sigcomm/2005/paper-LakCro.pdf)\n",
    "\n",
    "\n",
    "\n",
    "## TODO"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Flow analysis\n",
    "- Are there more than 1 packets for the same flow? Distribution?\n",
    "- Number of flows that are closed (request and response)\n",
    "- States per flow distribution\n",
    "- distribution of volumes"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        49718     tcp            2\n",
      "10.12.87.1       8125      10.2.20.4        36659     udp            2\n",
      "                                            47465     udp            2\n",
      "                                            58772     udp            2\n",
      "52.85.77.134     443       192.168.100.96   34140     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        60854     tcp            2\n",
      "                                            60855     tcp            2\n",
      "                                            60857     tcp            2\n",
      "                                            60858     tcp            2\n",
      "91.189.89.22     443       192.168.100.237  33815     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   39145     udp            2\n",
      "199.91.71.85     443       192.168.100.29   40388     tcp            2\n",
      "199.91.71.89     443       10.2.38.2        41229     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.0.31    80        10.2.20.4       59967     tcp            2\n",
      "10.12.87.1    443       192.168.111.66  39280     tcp            2\n",
      "                                        39282     tcp            2\n",
      "199.91.71.85  443       10.2.38.2       43065     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.17.1        443       192.168.111.226  48738     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        33001     tcp            2\n",
      "                                            33002     tcp            2\n",
      "                                            33003     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   59249     udp            2\n",
      "199.91.71.85     123       192.168.100.106  123       udp            2\n",
      "199.91.71.86     123       192.168.100.106  123       udp            2\n",
      "                 1194      192.168.100.106  50396     udp            2\n",
      "199.91.71.89     443       10.2.38.2        44881     tcp            2\n",
      "216.58.197.168   443       192.168.100.123  35985     tcp            2\n",
      "224.0.0.251      5353      192.168.100.23   5353      udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "192.168.100.250  53        192.168.100.11   55726     udp            2\n",
      "199.91.71.85     1194      192.168.100.24   52745     udp            2\n",
      "199.91.71.86     1194      192.168.100.106  43093     udp            2\n",
      "239.255.255.250  1900      192.168.100.96   36503     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        49723     tcp            2\n",
      "                           10.2.20.1        60256     tcp            2\n",
      "                           10.2.20.7        48984     tcp            2\n",
      "10.12.21.2       6801      10.2.20.8        40354     tcp            2\n",
      "46.244.5.69      443       10.2.38.2        43580     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   34898     udp            2\n",
      "199.91.71.86     1194      192.168.100.106  33173     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.87.1    2013      192.168.100.241  36019     tcp            2\n",
      "                        192.168.100.242  50243     tcp            2\n",
      "74.201.65.30  443       10.2.1.39        59120     tcp            2\n",
      "199.91.71.85  1194      192.168.100.24   38501     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21     80        10.2.1.39        52236     tcp            2\n",
      "10.12.189.1    443       192.168.111.178  36530     tcp            2\n",
      "199.91.71.89   443       10.2.38.2        50787     tcp            2\n",
      "216.58.216.10  443       192.168.100.131  54259     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip          src_port  ip_protocol\n",
      "10.2.1.39     22        192.168.111.86  54377     tcp            2\n",
      "                                        54378     tcp            2\n",
      "10.12.0.31    80        10.2.20.1       60251     tcp            2\n",
      "74.201.65.30  443       10.2.1.39       59768     tcp            2\n",
      "                                        59769     tcp            2\n",
      "199.91.71.86  443       192.168.100.7   48977     tcp            2\n",
      "199.91.71.89  443       192.168.100.77  39368     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39        22        192.168.111.86   54444     tcp            2\n",
      "                                            54445     tcp            2\n",
      "                 29418     192.168.111.86   54443     tcp            2\n",
      "10.12.0.31       80        10.2.20.1        60250     tcp            2\n",
      "52.85.77.175     443       192.168.100.123  35438     tcp            2\n",
      "54.239.25.208    80        192.168.100.123  41386     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        59987     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   56293     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.179  53        192.168.100.96  44332     tcp            4\n",
      "                                           44335     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.87.1     8125      10.2.20.6        40754     udp            2\n",
      "                                          55449     udp            2\n",
      "                                          60458     udp            2\n",
      "54.175.19.240  443       192.168.66.246   64379     tcp            2\n",
      "74.201.65.31   443       10.2.1.39        34745     tcp            2\n",
      "172.217.5.198  443       192.168.100.123  47548     tcp            2\n",
      "199.91.71.85   443       10.2.38.2        53181     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.179  80        192.168.100.96  719       tcp            3\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.40  7         192.168.100.96  63925     tcp            4\n",
      "                53        192.168.100.96  63923     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "91.189.91.23  80        192.168.100.116  40255     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.40  80        192.168.100.96  440       tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  1         192.168.100.96  45989     tcp            2\n",
      "                3         192.168.100.96  45990     tcp            2\n",
      "                7         192.168.100.96  45989     tcp            2\n",
      "                9         192.168.100.96  45990     tcp            2\n",
      "                13        192.168.100.96  45989     tcp            2\n",
      "                17        192.168.100.96  45990     tcp            2\n",
      "                19        192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                20        192.168.100.96  45989     tcp            2\n",
      "                21        192.168.100.96  45989     tcp            2\n",
      "                24        192.168.100.96  45991     tcp            2\n",
      "                25        192.168.100.96  45989     tcp            2\n",
      "                26        192.168.100.96  45989     tcp            2\n",
      "                33        192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                37        192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                53        192.168.100.96  41648     tcp            2\n",
      "                                          45989     tcp            2\n",
      "                79        192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                80        192.168.100.96  45368     tcp            2\n",
      "                                          45370     tcp            2\n",
      "                                          45372     tcp            2\n",
      "                                          45374     tcp            2\n",
      "                81        192.168.100.96  45989     tcp            2\n",
      "                82        192.168.100.96  45990     tcp            2\n",
      "                88        192.168.100.96  45990     tcp            2\n",
      "                100       192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                                                                  ..\n",
      "                7000      192.168.100.96  45990     tcp            2\n",
      "                7070      192.168.100.96  45990     tcp            2\n",
      "                7937      192.168.100.96  45990     tcp            2\n",
      "                7938      192.168.100.96  45990     tcp            2\n",
      "                8000      192.168.100.96  45990     tcp            2\n",
      "                8002      192.168.100.96  45990     tcp            2\n",
      "                8008      192.168.100.96  45989     tcp            2\n",
      "                8009      192.168.100.96  45990     tcp            2\n",
      "                8010      192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                8031      192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                8080      192.168.100.96  45989     tcp            2\n",
      "                8081      192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                8443      192.168.100.96  45989     tcp            2\n",
      "                8888      192.168.100.96  45989     tcp            2\n",
      "                9000      192.168.100.96  45990     tcp            2\n",
      "                9001      192.168.100.96  45990     tcp            2\n",
      "                9090      192.168.100.96  45990     tcp            2\n",
      "                9100      192.168.100.96  45990     tcp            2\n",
      "                9102      192.168.100.96  45989     tcp            2\n",
      "                9999      192.168.100.96  45989     tcp            2\n",
      "                10000     192.168.100.96  45991     tcp            2\n",
      "                10001     192.168.100.96  45990     tcp            2\n",
      "                10010     192.168.100.96  45991     tcp            2\n",
      "                15000     192.168.100.96  45989     tcp            2\n",
      "                                          45990     tcp            2\n",
      "                32768     192.168.100.96  45989     tcp            2\n",
      "                32771     192.168.100.96  45990     tcp            2\n",
      "Name: src_tx, Length: 253, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45376     tcp            2\n",
      "                                          45378     tcp            2\n",
      "                                          45380     tcp            2\n",
      "                                          45382     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.21.2      6800      10.2.20.8        54358     tcp            2\n",
      "10.12.87.1      2013      192.168.100.240  42046     tcp            2\n",
      "10.12.231.2     6801      10.2.20.8        37815     tcp            2\n",
      "                6803      10.2.20.8        45428     tcp            2\n",
      "10.12.231.3     6801      10.2.20.8        53453     tcp            2\n",
      "192.168.100.96  80        192.168.100.96   45384     tcp            2\n",
      "                                           45386     tcp            2\n",
      "                                           45388     tcp            2\n",
      "                                           45390     tcp            2\n",
      "                                           45392     tcp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45394     tcp            2\n",
      "                                          45396     tcp            2\n",
      "                                          45398     tcp            2\n",
      "                                          45400     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45402     tcp            2\n",
      "                                          45404     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45406     tcp            2\n",
      "                                          45408     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45410     tcp            2\n",
      "                                          45412     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  53        192.168.100.96  50601     tcp            2\n",
      "                                          50602     tcp            2\n",
      "                                          50603     tcp            2\n",
      "                                          50604     tcp            2\n",
      "                                          50605     tcp            2\n",
      "                80        192.168.100.96  45414     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  689       tcp            2\n",
      "                                          45416     tcp            2\n",
      "                                          45418     tcp            2\n",
      "                                          45420     tcp            2\n",
      "                                          45422     tcp            2\n",
      "                                          45424     tcp            2\n",
      "                                          45426     tcp            2\n",
      "                                          45428     tcp            2\n",
      "                                          45430     tcp            2\n",
      "                                          45432     tcp            2\n",
      "                                          45434     tcp            2\n",
      "                                          45436     tcp            2\n",
      "                                          45438     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  45440     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.87.1       2013      192.168.100.244  47295     tcp            2\n",
      "23.22.65.241     443       192.168.100.131  54160     tcp            2\n",
      "107.178.243.85   443       192.168.100.145  51629     tcp            2\n",
      "172.217.4.133    443       192.168.100.40   53381     udp            2\n",
      "172.217.4.138    443       192.168.100.40   51031     udp            2\n",
      "                                            53470     tcp            2\n",
      "                                            53472     tcp            2\n",
      "                                            53476     tcp            2\n",
      "173.194.203.188  5228      192.168.100.40   57568     tcp            2\n",
      "192.168.100.96   80        192.168.100.96   45444     tcp            2\n",
      "216.58.193.109   443       192.168.100.40   34086     udp            2\n",
      "                                            52398     tcp            2\n",
      "                                            52404     tcp            2\n",
      "216.58.216.1     443       192.168.100.40   36794     udp            2\n",
      "216.58.216.3     443       192.168.100.40   58385     udp            2\n",
      "216.58.216.4     443       192.168.100.40   50497     udp            2\n",
      "216.58.216.14    443       192.168.100.40   47179     udp            2\n",
      "216.58.217.195   443       192.168.100.40   48829     udp            2\n",
      "                                            50168     tcp            2\n",
      "216.58.217.202   443       192.168.100.40   53168     tcp            2\n",
      "                                            53170     tcp            2\n",
      "216.58.217.206   443       192.168.100.40   33684     tcp            2\n",
      "                                            33686     tcp            2\n",
      "                                            33688     tcp            2\n",
      "                                            33694     tcp            2\n",
      "                                            33700     tcp            2\n",
      "                                            33702     tcp            2\n",
      "                                            33710     tcp            2\n",
      "                                            33712     tcp            2\n",
      "                                            33714     tcp            2\n",
      "                                            33728     tcp            2\n",
      "                                            48057     udp            2\n",
      "                                            48842     udp            2\n",
      "                                            52658     udp            2\n",
      "216.58.219.8     443       192.168.100.40   44342     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.96  80        192.168.100.96  689       tcp            3\n",
      "                                          45446     tcp            2\n",
      "                                          45448     tcp            2\n",
      "                                          45450     tcp            2\n",
      "                                          45452     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.250  53        192.168.100.11  24593     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.176  53        192.168.100.96  61980     tcp            4\n",
      "                                           61983     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.176  80        192.168.100.96  517       tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "65.52.108.76    443       192.168.100.131  54790     tcp            2\n",
      "                                           54793     tcp            2\n",
      "                                           54795     tcp            2\n",
      "104.210.209.29  443       192.168.100.131  54792     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.74  7         192.168.100.96  36046     tcp            4\n",
      "                53        192.168.100.96  36044     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39        443       192.168.111.46   44456     tcp            2\n",
      "                                            44458     tcp            2\n",
      "                 29418     192.168.111.86   54646     tcp            2\n",
      "10.12.87.1       2013      192.168.100.241  36026     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        35928     tcp            2\n",
      "98.138.49.44     443       192.168.100.131  54947     tcp            2\n",
      "                                            54948     tcp            2\n",
      "192.168.100.74   80        192.168.100.96   113       tcp            4\n",
      "199.91.71.89     443       10.2.38.2        51003     tcp            2\n",
      "239.255.255.250  1900      192.168.100.96   46424     udp            2\n",
      "                           192.168.100.145  42515     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.15  53        192.168.100.96  35235     tcp            4\n",
      "                                          35238     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.15  80        192.168.100.96  923       tcp            3\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.190  53        192.168.100.96  60522     tcp            4\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.190  80        192.168.100.96  136       tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.33.4        443       192.168.111.46   56244     tcp            2\n",
      "10.12.87.1       2013      192.168.100.243  53301     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        37425     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   14214     udp            2\n",
      "199.91.71.85     443       10.2.38.2        49753     tcp            2\n",
      "239.255.255.250  1900      192.168.100.10   58345     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.42  53        192.168.100.96  52240     tcp            4\n",
      "                                          52243     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.42  80        192.168.100.96  538       tcp            3\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.87.1       8125      10.2.1.20        35908     udp            2\n",
      "                                            39886     udp            2\n",
      "                                            47313     udp            2\n",
      "172.217.5.202    443       192.168.100.123  44757     tcp            2\n",
      "239.255.255.250  1900      192.168.100.10   44601     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.108  53        192.168.100.96  35040     tcp            4\n",
      "                                           35043     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.108  80        192.168.100.96  186       tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.38     443       192.168.111.74   47226     tcp            2\n",
      "                                         47228     tcp            2\n",
      "74.201.65.30  443       10.2.1.39        35364     tcp            2\n",
      "                                         35365     tcp            2\n",
      "                                         35367     tcp            2\n",
      "                                         35368     tcp            2\n",
      "                                         35369     tcp            2\n",
      "199.91.71.86  1194      192.168.100.106  60113     udp            2\n",
      "199.91.71.89  1194      192.168.100.24   52060     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.153  53        192.168.100.96  61987     tcp            4\n",
      "                                           61990     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.38        443       192.168.111.106  54422     tcp            2\n",
      "10.2.33.4        443       192.168.111.46   56278     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        35642     tcp            2\n",
      "107.178.243.85   443       192.168.100.131  55424     tcp            2\n",
      "192.168.100.153  80        192.168.100.96   823       tcp            3\n",
      "199.91.71.85     443       10.2.38.2        53500     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.87.1       443       10.2.1.39       40055     tcp            2\n",
      "192.168.100.198  53        192.168.100.96  40251     tcp            4\n",
      "                                           40254     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.3        60197     tcp            2\n",
      "                           10.2.20.5        50791     tcp            2\n",
      "                           10.2.20.7        45915     tcp            2\n",
      "10.12.87.1       443       10.2.1.39        40264     tcp            2\n",
      "                 8125      10.2.20.5        45419     udp            2\n",
      "                                            45799     udp            2\n",
      "                                            53548     udp            2\n",
      "52.206.112.96    443       192.168.100.131  55462     tcp            2\n",
      "54.244.95.160    443       192.168.100.131  55468     tcp            2\n",
      "                                            55486     tcp            2\n",
      "54.245.235.1     443       192.168.100.131  55399     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        39152     tcp            2\n",
      "                                            39153     tcp            2\n",
      "                                            39154     tcp            2\n",
      "136.147.40.227   443       192.168.100.188  35954     tcp            2\n",
      "136.147.41.227   443       192.168.100.188  44462     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   36947     udp            2\n",
      "192.168.100.255  137       192.168.100.136  137       udp            2\n",
      "216.58.217.195   443       192.168.100.136  54176     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.1        60248     tcp            2\n",
      "10.12.38.1       443       10.2.20.8        55637     tcp            2\n",
      "                                            55638     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8        55550     tcp            2\n",
      "10.12.68.7       6800      10.2.20.8        60638     tcp            2\n",
      "10.12.84.1       3306      10.2.20.8        32888     tcp            2\n",
      "10.12.87.1       443       192.168.100.40   50228     tcp            2\n",
      "                 2013      192.168.100.244  47330     tcp            2\n",
      "10.12.230.4      22        192.168.100.40   48132     tcp            2\n",
      "10.12.231.2      6801      10.2.20.8        37774     tcp            2\n",
      "46.244.5.69      443       10.2.1.38        35536     tcp            2\n",
      "52.54.163.58     443       192.168.100.131  55496     tcp            2\n",
      "192.168.100.188  42415     74.125.204.189   443       udp            2\n",
      "192.168.100.198  80        192.168.100.96   725       tcp            4\n",
      "199.91.71.85     443       10.2.38.2        53536     tcp            2\n",
      "                           192.168.100.78   42500     tcp            2\n",
      "199.91.71.86     443       10.2.38.2        57856     tcp            2\n",
      "199.91.71.89     443       192.168.100.93   44168     tcp            2\n",
      "216.58.216.14    443       192.168.100.131  56189     udp            2\n",
      "224.0.0.251      5353      192.168.100.237  5353      udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.40.1       3306      10.2.20.8       53311     tcp            2\n",
      "10.12.42.1       3306      10.2.20.8       36535     tcp            2\n",
      "                                           36536     tcp            2\n",
      "10.12.84.1       3306      10.2.20.8       36882     tcp            2\n",
      "                                           36894     tcp            2\n",
      "74.201.65.31     443       10.2.1.39       39477     tcp            2\n",
      "                                           39484     tcp            2\n",
      "                                           39485     tcp            2\n",
      "192.168.100.250  53        192.168.100.11  50580     udp            2\n",
      "                           192.168.100.30  36531     udp            2\n",
      "199.91.71.89     443       192.168.100.12  49522     tcp            2\n",
      "207.154.64.10    53        192.168.100.30  36531     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip      dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31  80        10.2.20.3  60202     tcp            2\n",
      "10.12.41.1  3306      10.2.20.8  38792     tcp            2\n",
      "10.12.87.1  443       10.2.1.39  40695     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21       5672      10.2.254.49      48238     tcp            2\n",
      "10.12.0.22       443       10.2.38.2        34629     tcp            2\n",
      "10.12.0.31       80        10.2.1.20        49723     tcp            2\n",
      "                                            50310     tcp            2\n",
      "                           10.2.20.5        50525     tcp            2\n",
      "                           10.2.20.7        48993     tcp            2\n",
      "                                            49440     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        36944     tcp            2\n",
      "104.192.136.114  443       10.2.1.39        41303     tcp            2\n",
      "192.168.100.88   53        192.168.100.96   56886     tcp            4\n",
      "                 80        192.168.100.96   714       tcp            2\n",
      "192.168.100.250  53        192.168.100.11   3769      udp            2\n",
      "216.58.216.5     443       192.168.100.138  39932     tcp            2\n",
      "216.58.217.197   443       192.168.100.131  60425     udp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.17.1     443       192.168.111.226  51324     tcp            2\n",
      "10.12.0.22    443       192.168.111.202  55884     tcp            2\n",
      "10.12.0.31    80        10.2.20.5        51066     tcp            2\n",
      "                                         51112     tcp            2\n",
      "10.12.87.1    443       192.168.111.178  35066     tcp            2\n",
      "                                         35086     tcp            2\n",
      "                                         35088     tcp            2\n",
      "                                         35090     tcp            2\n",
      "                                         35092     tcp            2\n",
      "                                         35094     tcp            2\n",
      "74.201.65.31  443       10.2.1.39        39810     tcp            2\n",
      "199.91.71.89  443       10.2.38.2        45531     tcp            2\n",
      "216.58.216.4  443       192.168.100.138  39214     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.0.21       5672      10.2.254.49     48238     tcp            2\n",
      "10.12.0.31       80        10.2.1.20       50275     tcp            2\n",
      "                           10.2.20.6       40038     tcp            2\n",
      "10.12.87.1       8125      10.2.20.6       37179     udp            2\n",
      "                                           52933     udp            2\n",
      "                                           55570     udp            2\n",
      "104.192.136.114  443       10.2.1.39       41445     tcp            2\n",
      "199.91.71.85     1194      192.168.100.24  50887     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.139  53        192.168.100.96  46628     tcp            4\n",
      "                                           46631     tcp            4\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.6  39824     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8  55547     tcp            2\n",
      "10.12.68.7       6801      10.2.20.8  38976     tcp            2\n",
      "74.201.65.31     443       10.2.1.39  40000     tcp            2\n",
      "104.192.136.114  443       10.2.20.8  58175     tcp            2\n",
      "199.91.71.89     443       10.2.38.2  49124     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.4  59970     tcp            2\n",
      "104.192.136.114  443       10.2.1.39  41628     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        49990     tcp            2\n",
      "10.12.87.1       2013      192.168.100.241  36034     tcp            2\n",
      "                           192.168.100.242  50258     tcp            2\n",
      "                 8125      10.2.1.20        33176     udp            2\n",
      "                                            35040     udp            2\n",
      "                                            54980     udp            2\n",
      "74.201.65.31     443       10.2.1.39        40138     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   22798     udp            2\n",
      "199.91.71.85     443       10.2.38.2        49971     tcp            2\n",
      "199.91.71.89     443       10.2.38.2        51780     tcp            2\n",
      "                 1194      192.168.100.24   41878     udp            2\n",
      "255.255.255.255  68        192.168.100.254  67        udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31    80        10.2.20.1        60682     tcp            2\n",
      "                        10.2.20.5        50515     tcp            2\n",
      "10.12.21.2    6801      10.2.20.8        40411     tcp            2\n",
      "10.12.68.7    6801      10.2.20.8        38932     tcp            2\n",
      "10.12.87.1    443       192.168.111.66   40394     tcp            2\n",
      "              2013      192.168.100.244  47344     tcp            2\n",
      "10.12.231.3   6800      10.2.20.8        52795     tcp            2\n",
      "74.201.65.30  443       10.2.1.39        37408     tcp            2\n",
      "199.91.71.89  443       192.168.100.70   57049     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.3        60198     tcp            2\n",
      "                           10.2.20.5        50514     tcp            2\n",
      "                                            50524     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8        54364     tcp            2\n",
      "10.12.21.3       6800      10.2.20.8        53010     tcp            2\n",
      "                 6803      10.2.20.8        33319     tcp            2\n",
      "10.12.68.6       6801      10.2.20.8        36452     tcp            2\n",
      "10.12.68.7       6801      10.2.20.8        38976     tcp            2\n",
      "10.12.87.1       443       192.168.111.178  35190     tcp            2\n",
      "                                            35192     tcp            2\n",
      "                                            35194     tcp            2\n",
      "                                            35196     tcp            2\n",
      "                                            35198     tcp            2\n",
      "                                            35200     tcp            2\n",
      "10.12.231.2      6803      10.2.20.8        45402     tcp            2\n",
      "10.22.10.1       3306      10.2.254.55      34125     tcp            2\n",
      "10.22.11.1       3306      10.2.254.55      51421     tcp            2\n",
      "52.33.9.222      443       192.168.100.173  38936     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        40388     tcp            2\n",
      "                                            40389     tcp            2\n",
      "                                            40390     tcp            2\n",
      "                                            40391     tcp            2\n",
      "169.44.162.192   80        192.168.100.131  55630     tcp            2\n",
      "192.168.66.250   137       192.168.66.254   1024      udp            2\n",
      "192.168.100.250  53        192.168.100.11   47399     udp            2\n",
      "199.91.71.89     443       10.2.38.2        51340     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.68.7      6800      10.2.20.8        60638     tcp            2\n",
      "10.12.189.1     443       192.168.111.178  37720     tcp            2\n",
      "10.12.231.3     6801      10.2.20.8        53283     tcp            2\n",
      "46.244.5.69     443       10.2.1.38        43917     tcp            2\n",
      "52.71.193.253   443       192.168.100.40   44776     tcp            2\n",
      "54.148.39.0     80        192.168.100.131  55625     tcp            2\n",
      "54.186.123.157  443       192.168.100.123  60648     tcp            2\n",
      "74.201.65.30    443       10.2.1.39        37656     tcp            2\n",
      "                                           37657     tcp            2\n",
      "                                           37658     tcp            2\n",
      "                                           37659     tcp            2\n",
      "                                           37660     tcp            2\n",
      "                                           37661     tcp            2\n",
      "                                           37662     tcp            2\n",
      "                                           37663     tcp            2\n",
      "                                           37664     tcp            2\n",
      "74.201.65.31    443       10.2.1.39        40437     tcp            2\n",
      "198.35.26.96    443       192.168.100.131  55856     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21       5672      10.2.254.49      48318     tcp            2\n",
      "10.12.0.31       80        10.2.1.20        50143     tcp            2\n",
      "                           10.2.20.4        59971     tcp            2\n",
      "74.125.28.189    443       192.168.100.116  36310     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   12209     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.1.20        50181     tcp            2\n",
      "                          10.2.20.5        50520     tcp            2\n",
      "10.12.87.1      443       192.168.111.178  35274     tcp            2\n",
      "                                           35276     tcp            2\n",
      "                                           35278     tcp            2\n",
      "                                           35280     tcp            2\n",
      "                                           35282     tcp            2\n",
      "                                           35284     tcp            2\n",
      "                8125      10.2.1.20        43696     udp            2\n",
      "                                           55647     udp            2\n",
      "                                           57106     udp            2\n",
      "54.230.138.165  443       192.168.100.131  55869     tcp            2\n",
      "74.125.68.94    443       192.168.100.40   42708     udp            2\n",
      "74.201.65.31    443       10.2.1.39        40563     tcp            2\n",
      "                                           40564     tcp            2\n",
      "                                           40565     tcp            2\n",
      "216.58.199.1    443       192.168.100.40   35092     udp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "192.168.100.16  80        192.168.100.96  234       tcp            3\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        50275     tcp            2\n",
      "                           10.2.20.3        60196     tcp            2\n",
      "                                            60199     tcp            2\n",
      "74.125.28.189    443       192.168.100.131  54225     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        37843     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   41358     udp            2\n",
      "216.58.216.5     443       192.168.100.116  40054     tcp            2\n",
      "239.255.255.250  1900      192.168.100.131  53806     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip      dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31  80        10.2.20.4  60474     tcp            2\n",
      "10.12.68.7  6801      10.2.33.4  36928     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39     22        192.168.111.86   55188     tcp            2\n",
      "                                         55189     tcp            2\n",
      "              445       192.168.100.115  57705     tcp            2\n",
      "              29418     192.168.111.86   55187     tcp            2\n",
      "10.12.0.31    80        10.2.1.20        49720     tcp            2\n",
      "                        10.2.20.4        59975     tcp            2\n",
      "                        10.2.20.6        39823     tcp            2\n",
      "10.12.68.6    6801      10.2.20.8        36400     tcp            2\n",
      "52.19.57.181  443       192.168.100.131  55919     tcp            2\n",
      "199.91.71.89  443       10.2.38.2        51399     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip     src_port  ip_protocol\n",
      "74.201.65.31  443       10.2.1.39  40797     tcp            2\n",
      "199.91.71.86  443       10.2.38.2  58045     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.38      443       192.168.111.106  49562     tcp            2\n",
      "10.12.21.2     6800      10.2.20.8        54341     tcp            2\n",
      "40.84.189.107  443       192.168.100.145  58679     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.1.254.121   443       192.168.100.188  60878     tcp            2\n",
      "54.244.120.65  443       192.168.100.131  54264     tcp            2\n",
      "                                          54266     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31     80        10.2.20.3        60195     tcp            2\n",
      "10.22.11.1     3306      10.2.254.55      51421     tcp            2\n",
      "52.85.77.60    443       192.168.100.16   59264     tcp            2\n",
      "74.125.28.189  443       192.168.100.136  54309     tcp            2\n",
      "74.201.65.31   443       10.2.1.39        40987     tcp            2\n",
      "                                          40990     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.4        59975     tcp            2\n",
      "10.12.189.1      443       192.168.111.178  37876     tcp            2\n",
      "                                            37878     tcp            2\n",
      "74.125.28.189    443       192.168.100.116  36310     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   22473     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.1.20       49718     tcp            2\n",
      "                          10.2.20.2       51404     tcp            2\n",
      "74.201.65.31    443       10.2.1.39       41080     tcp            2\n",
      "                                          41081     tcp            2\n",
      "192.168.100.93  161       10.2.1.39       35605     udp            2\n",
      "199.91.71.85    443       192.168.100.77  45830     tcp            2\n",
      "199.91.71.86    443       192.168.100.91  50786     tcp            2\n",
      "199.91.71.89    443       192.168.100.7   44392     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.1        59713     tcp            2\n",
      "                                            60248     tcp            2\n",
      "                           10.2.20.2        51059     tcp            2\n",
      "                           10.2.20.4        59975     tcp            2\n",
      "                           10.2.20.7        49423     tcp            2\n",
      "10.12.87.1       2013      192.168.100.240  42078     tcp            2\n",
      "23.23.99.56      443       192.168.100.123  56424     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   31998     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31    80        10.2.1.20        50235     tcp            2\n",
      "                        10.2.20.1        60257     tcp            2\n",
      "                        10.2.20.4        59969     tcp            2\n",
      "10.12.230.4   22        192.168.111.226  43118     tcp            2\n",
      "74.201.65.30  443       10.2.1.39        38422     tcp            2\n",
      "                                         38423     tcp            2\n",
      "                                         38424     tcp            2\n",
      "                                         38429     tcp            2\n",
      "199.91.71.85  1194      192.168.100.24   47130     udp            2\n",
      "199.91.71.86  443       192.168.100.7    48518     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.20.1        60258     tcp            2\n",
      "                          10.2.20.4        59975     tcp            2\n",
      "                                           60585     tcp            2\n",
      "                          10.2.20.5        50584     tcp            2\n",
      "                          10.2.20.6        40314     tcp            2\n",
      "10.12.87.1      2013      192.168.100.243  53311     tcp            2\n",
      "                8125      10.2.20.5        41475     udp            2\n",
      "                                           41861     udp            2\n",
      "                                           50162     udp            2\n",
      "10.12.133.1     3306      10.2.254.55      49673     tcp            2\n",
      "46.244.5.69     443       10.2.1.38        48606     tcp            2\n",
      "74.201.65.30    443       10.2.1.39        38485     tcp            2\n",
      "199.91.71.85    123       192.168.100.106  123       udp            2\n",
      "199.91.71.86    123       192.168.100.106  123       udp            2\n",
      "199.91.71.89    123       192.168.100.106  123       udp            2\n",
      "                1194      192.168.100.106  51771     udp            2\n",
      "216.58.217.206  443       192.168.100.116  56021     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.20.4        60530     tcp            2\n",
      "                          192.168.100.240  32870     tcp            2\n",
      "10.12.68.7      6801      10.2.20.8        38976     tcp            2\n",
      "17.249.28.22    5223      192.168.100.131  61970     tcp            2\n",
      "17.253.4.125    123       192.168.100.136  123       udp            2\n",
      "136.147.42.227  443       192.168.100.188  59758     tcp            2\n",
      "192.161.156.1   443       192.168.100.40   38284     tcp            2\n",
      "                                           38288     tcp            2\n",
      "199.91.71.89    443       10.2.38.2        51780     tcp            2\n",
      "216.58.217.206  443       192.168.100.131  64044     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "10.2.1.39        22        192.168.100.96  44278     tcp            2\n",
      "                 8140      10.12.1.1       33519     tcp            2\n",
      "                                           38704     tcp            2\n",
      "                                           44422     tcp            2\n",
      "                                           46082     tcp            2\n",
      "                                           50737     tcp            2\n",
      "                                           54991     tcp            2\n",
      "10.12.0.31       80        10.2.1.20       50290     tcp            2\n",
      "10.12.87.1       443       192.168.111.66  40548     tcp            2\n",
      "192.168.100.254  1194      98.207.16.69    64909     udp            2\n",
      "199.91.71.86     443       10.2.38.2       38757     tcp            2\n",
      "239.255.255.250  1900      192.168.100.10  47502     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.254.56    3306      192.168.111.158  50099     tcp            2\n",
      "10.12.0.21     5672      10.2.254.49      48318     tcp            2\n",
      "10.12.0.31     80        10.2.20.1        60246     tcp            2\n",
      "                         10.2.20.4        59967     tcp            2\n",
      "10.12.68.7     6801      10.2.20.8        38953     tcp            2\n",
      "                                          39012     tcp            2\n",
      "10.12.87.1     2013      192.168.100.240  42079     tcp            2\n",
      "10.12.231.2    6801      10.2.20.8        37715     tcp            2\n",
      "52.44.248.176  443       192.168.100.131  56092     tcp            2\n",
      "54.244.95.160  443       192.168.100.131  56107     tcp            2\n",
      "54.244.120.65  443       192.168.100.131  56118     tcp            2\n",
      "54.245.235.1   443       192.168.100.131  56105     tcp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.87.1      443       192.168.111.178  35518     tcp            2\n",
      "                                           35520     tcp            2\n",
      "                                           35522     tcp            2\n",
      "                                           35530     tcp            2\n",
      "                                           35532     tcp            2\n",
      "17.253.27.204   80        192.168.111.158  50128     tcp            2\n",
      "216.58.217.206  443       192.168.100.181  57235     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.21.2       6800      10.2.20.8        54316     tcp            2\n",
      "10.12.87.1       443       192.168.100.40   50316     tcp            2\n",
      "                                            50328     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        41488     tcp            2\n",
      "                                            41489     tcp            2\n",
      "173.194.202.188  5228      192.168.100.173  47096     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   31996     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39        8140      10.12.1.1        33224     tcp            2\n",
      "                                            41014     tcp            2\n",
      "                                            46118     tcp            2\n",
      "                                            50772     tcp            2\n",
      "                                            55027     tcp            2\n",
      "10.12.0.31       80        10.2.20.2        51077     tcp            2\n",
      "                           10.2.20.5        50516     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8        54341     tcp            2\n",
      "10.12.21.3       6800      10.2.20.8        52953     tcp            2\n",
      "10.12.87.1       2013      192.168.100.243  53312     tcp            2\n",
      "                 8125      10.2.20.2        36787     udp            2\n",
      "                                            42883     udp            2\n",
      "                                            56430     udp            2\n",
      "10.12.231.2      6801      10.2.20.8        37758     tcp            2\n",
      "10.12.231.3      6801      10.2.20.8        53393     tcp            2\n",
      "10.14.236.8      22        192.168.111.226  48604     tcp            2\n",
      "104.192.136.114  443       10.2.20.8        58845     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        49718     tcp            2\n",
      "                           10.2.20.7        49152     tcp            2\n",
      "10.12.21.2       6801      10.2.20.8        40410     tcp            2\n",
      "10.12.87.1       8125      10.2.20.7        33065     udp            2\n",
      "                                            51766     udp            2\n",
      "                                            54878     udp            2\n",
      "10.14.140.7      22        192.168.111.226  42702     tcp            2\n",
      "10.14.140.8      22        192.168.111.226  35798     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        38842     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   12671     udp            2\n",
      "199.91.71.85     443       192.168.100.7    58491     tcp            2\n",
      "                           192.168.100.30   48924     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.6        40434     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8        54358     tcp            2\n",
      "                 6801      10.2.20.8        40354     tcp            2\n",
      "10.12.87.1       8125      10.2.20.6        33321     udp            2\n",
      "                                            43028     udp            2\n",
      "                                            56301     udp            2\n",
      "10.12.231.2      6803      10.2.20.8        45307     tcp            2\n",
      "10.14.36.3       22        192.168.111.226  56582     tcp            2\n",
      "10.22.2.1        22        10.2.17.1        38750     tcp            2\n",
      "74.125.68.188    5228      192.168.100.120  41212     tcp            2\n",
      "199.91.71.85     1194      192.168.100.106  36266     udp            2\n",
      "239.255.255.250  1900      192.168.100.40   38537     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip      dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31  80        10.2.1.20  50305     tcp            2\n",
      "                      10.2.20.7  48991     tcp            2\n",
      "10.12.87.1  8125      10.2.1.20  33370     udp            2\n",
      "                                 45437     udp            2\n",
      "                                 57305     udp            2\n",
      "10.22.2.1   22        10.2.17.1  38754     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip     src_port  ip_protocol\n",
      "10.2.1.39       8140      10.12.1.1  41295     tcp            2\n",
      "74.201.65.31    443       10.2.1.39  41808     tcp            2\n",
      "                                     41809     tcp            2\n",
      "                                     41810     tcp            2\n",
      "216.58.217.206  443       10.2.1.38  51474     tcp            2\n",
      "                                     51475     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.1.254.121     443       192.168.100.188  32808     tcp            2\n",
      "10.2.1.39        8140      10.12.1.1        32868     tcp            2\n",
      "                                            34114     tcp            2\n",
      "                                            37443     tcp            2\n",
      "                                            39607     tcp            2\n",
      "                                            40642     tcp            2\n",
      "                                            44474     tcp            2\n",
      "                                            47352     tcp            2\n",
      "                                            47842     tcp            2\n",
      "                                            48531     tcp            2\n",
      "                                            49491     tcp            2\n",
      "                                            52906     tcp            2\n",
      "                                            53056     tcp            2\n",
      "                                            53466     tcp            2\n",
      "                                            56579     tcp            2\n",
      "                                            60845     tcp            2\n",
      "10.12.42.1       3306      10.2.20.8        60701     tcp            2\n",
      "17.249.28.34     443       192.168.66.246   64483     tcp            2\n",
      "172.217.5.194    443       192.168.66.246   64487     tcp            2\n",
      "199.91.71.85     1194      192.168.100.106  42502     udp            2\n",
      "216.58.216.5     443       192.168.66.246   64488     tcp            2\n",
      "                                            64489     tcp            2\n",
      "239.255.255.250  1900      192.168.100.131  61745     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.20.3        60577     tcp            2\n",
      "                          10.2.20.4        59974     tcp            2\n",
      "                                           59976     tcp            2\n",
      "                                           60474     tcp            2\n",
      "10.22.7.1       22        10.2.17.1        45300     tcp            2\n",
      "52.7.104.90     443       192.168.100.131  56234     tcp            2\n",
      "52.21.117.154   443       192.168.100.131  54228     tcp            2\n",
      "54.165.147.101  443       192.168.100.131  56235     tcp            2\n",
      "54.214.47.71    443       192.168.100.131  56232     tcp            2\n",
      "74.201.65.31    443       10.2.1.39        42023     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.17.1      443       192.168.111.226  51932     tcp            2\n",
      "                                          51936     tcp            2\n",
      "10.2.20.4      22        192.168.111.226  42764     tcp            2\n",
      "10.2.20.5      22        192.168.111.226  33350     tcp            2\n",
      "10.2.20.6      22        192.168.111.226  41358     tcp            2\n",
      "10.2.20.7      22        192.168.111.226  45412     tcp            2\n",
      "10.12.0.21     80        10.2.1.39        60140     tcp            2\n",
      "10.12.0.31     80        10.2.1.20        49724     tcp            2\n",
      "10.12.21.2     6801      10.2.20.8        40478     tcp            2\n",
      "10.12.21.3     6800      10.2.20.8        52958     tcp            2\n",
      "10.12.33.1     22        192.168.111.86   57532     tcp            2\n",
      "10.12.40.1     3306      10.2.20.8        49260     tcp            2\n",
      "10.12.87.1     443       192.168.111.66   40432     tcp            2\n",
      "                                          40466     tcp            2\n",
      "                                          40496     tcp            2\n",
      "                                          40498     tcp            2\n",
      "                                          40510     tcp            2\n",
      "                                          40554     tcp            2\n",
      "               2013      192.168.100.244  47375     tcp            2\n",
      "10.12.231.2    6801      10.2.20.8        37779     tcp            2\n",
      "46.244.5.70    443       10.2.38.2        58878     tcp            2\n",
      "91.189.88.161  80        192.168.100.241  41464     tcp            2\n",
      "91.189.88.162  80        192.168.100.240  36423     tcp            2\n",
      "                         192.168.100.242  60040     tcp            2\n",
      "91.189.91.23   80        192.168.100.240  57077     tcp            2\n",
      "91.189.91.26   80        192.168.100.241  43394     tcp            2\n",
      "                         192.168.100.242  33033     tcp            2\n",
      "                         192.168.100.243  41430     tcp            2\n",
      "199.91.71.85   443       192.168.100.242  53267     tcp            2\n",
      "199.91.71.86   443       10.2.38.2        38828     tcp            2\n",
      "199.91.71.89   443       192.168.100.240  49458     tcp            2\n",
      "                         192.168.100.243  34945     tcp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.1        60258     tcp            2\n",
      "                           10.2.20.6        39819     tcp            2\n",
      "                                            39823     tcp            2\n",
      "                           192.168.100.242  60273     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8        54364     tcp            2\n",
      "                 6801      10.2.20.8        40490     tcp            2\n",
      "10.12.21.3       6800      10.2.20.8        53059     tcp            2\n",
      "                 6803      10.2.20.8        33219     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8        55444     tcp            2\n",
      "                                            55550     tcp            2\n",
      "10.12.68.7       6800      10.2.20.8        60574     tcp            2\n",
      "10.12.231.2      6801      10.2.20.8        37671     tcp            2\n",
      "                                            37774     tcp            2\n",
      "                                            37802     tcp            2\n",
      "                 6803      10.2.20.8        45375     tcp            2\n",
      "10.22.7.1        22        10.2.17.1        45323     tcp            2\n",
      "74.125.28.189    443       192.168.100.136  54309     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   62821     udp            2\n",
      "199.91.71.86     443       10.2.20.4        36764     tcp            2\n",
      "199.91.71.89     1194      192.168.100.106  38426     udp            2\n",
      "216.58.216.3     443       192.168.100.131  49689     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31    80        10.2.20.3        60807     tcp            2\n",
      "10.12.68.7    6800      10.2.20.8        60638     tcp            2\n",
      "10.12.87.1    2013      192.168.100.240  42106     tcp            2\n",
      "74.201.65.31  443       10.2.1.39        42228     tcp            2\n",
      "199.91.71.89  443       10.2.38.2        45855     tcp            2\n",
      "216.58.216.5  443       192.168.100.120  58193     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39        445       192.168.100.115  57705     tcp            2\n",
      "10.12.0.31       80        10.2.1.20        50404     tcp            2\n",
      "                           10.2.20.2        51705     tcp            2\n",
      "                           10.2.20.4        60625     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8        54316     tcp            2\n",
      "                                            54358     tcp            2\n",
      "                 6801      10.2.20.8        40351     tcp            2\n",
      "10.12.21.3       6800      10.2.20.8        52953     tcp            2\n",
      "                                            53043     tcp            2\n",
      "10.12.68.6       6801      10.2.20.8        36414     tcp            2\n",
      "                                            36463     tcp            2\n",
      "10.12.68.7       6801      10.2.20.8        38932     tcp            2\n",
      "                                            39012     tcp            2\n",
      "10.12.231.2      6803      10.2.20.8        45307     tcp            2\n",
      "10.12.231.3      6800      10.2.20.8        52762     tcp            2\n",
      "                                            52876     tcp            2\n",
      "46.244.5.70      443       10.2.38.2        58880     tcp            2\n",
      "52.9.3.168       443       192.168.100.188  50706     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        42319     tcp            2\n",
      "104.192.136.114  443       192.168.100.188  58970     tcp            2\n",
      "                                            59032     tcp            2\n",
      "104.192.139.43   443       192.168.100.188  54738     tcp            2\n",
      "108.160.172.236  443       192.168.100.131  55201     tcp            2\n",
      "137.135.50.198   443       192.168.111.158  50718     tcp            2\n",
      "151.101.25.164   80        192.168.111.158  50729     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   39241     udp            2\n",
      "199.91.71.89     1194      192.168.100.24   36744     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21       5672      10.2.254.49      48238     tcp            2\n",
      "10.12.189.1      443       192.168.111.178  38224     tcp            2\n",
      "52.44.248.176    443       192.168.100.131  56297     tcp            2\n",
      "54.244.120.65    443       192.168.100.131  56323     tcp            2\n",
      "54.244.241.224   443       192.168.100.131  56311     tcp            2\n",
      "104.244.42.130   443       192.168.100.120  57476     tcp            2\n",
      "151.101.0.249    443       192.168.111.158  51010     tcp            2\n",
      "                                            51011     tcp            2\n",
      "                                            51012     tcp            2\n",
      "                                            51013     tcp            2\n",
      "199.91.71.85     443       10.2.38.2        50288     tcp            2\n",
      "239.255.255.250  1900      192.168.100.136  57994     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip     dst_port  src_ip     src_port  ip_protocol\n",
      "10.22.2.1  22        10.2.17.1  39241     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.1.254.121  623       192.168.100.188  38712     tcp            2\n",
      "10.12.0.31    80        10.2.20.4        60367     tcp            2\n",
      "10.12.21.2    6800      10.2.20.8        54341     tcp            2\n",
      "10.12.39.1    22        10.2.20.8        52369     tcp            2\n",
      "199.91.71.86  443       10.2.38.2        38906     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.6       40441     tcp            2\n",
      "10.12.21.2       6800      10.2.20.8       54383     tcp            2\n",
      "                 6801      10.2.20.8       40411     tcp            2\n",
      "10.12.21.3       6800      10.2.20.8       52953     tcp            2\n",
      "                 6803      10.2.20.8       33244     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8       55510     tcp            2\n",
      "                 6801      10.2.20.8       36400     tcp            2\n",
      "10.12.68.7       6800      10.2.20.8       60532     tcp            2\n",
      "                 6801      10.2.20.8       38932     tcp            2\n",
      "10.12.231.2      6801      10.2.20.8       37758     tcp            2\n",
      "                 6803      10.2.20.8       45339     tcp            2\n",
      "10.12.231.3      6800      10.2.20.8       52795     tcp            2\n",
      "199.91.71.89     1194      192.168.100.24  33485     udp            2\n",
      "239.255.255.250  1900      192.168.100.40  56012     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.20.8     443       192.168.111.226  56886     tcp            2\n",
      "10.12.0.31    80        10.2.20.6        40481     tcp            2\n",
      "74.201.65.30  443       10.2.1.39        39999     tcp            2\n",
      "172.217.5.72  443       192.168.100.131  57360     udp            2\n",
      "199.91.71.86  1194      192.168.100.24   49354     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31     80        10.2.1.20        49877     tcp            2\n",
      "                         10.2.20.7        49471     tcp            2\n",
      "10.12.189.1    443       192.168.111.178  38400     tcp            2\n",
      "52.202.74.156  443       192.168.100.131  56414     tcp            2\n",
      "54.214.47.71   443       192.168.100.131  56410     tcp            2\n",
      "54.244.95.160  443       192.168.100.131  56387     tcp            2\n",
      "74.201.65.30   443       10.2.1.39        40069     tcp            2\n",
      "                                          40070     tcp            2\n",
      "199.91.71.86   1194      192.168.100.106  52872     udp            2\n",
      "199.91.71.89   443       10.2.38.2        45951     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.22       443       10.2.38.2        34636     tcp            2\n",
      "10.12.33.1       22        192.168.111.86   57532     tcp            2\n",
      "10.12.68.6       6801      10.2.20.8        36483     tcp            2\n",
      "10.12.231.3      6800      10.2.20.8        52876     tcp            2\n",
      "                 6801      10.2.20.8        53453     tcp            2\n",
      "23.3.120.29      443       192.168.100.131  56436     tcp            2\n",
      "31.13.70.36      443       192.168.100.131  56448     tcp            2\n",
      "34.196.81.22     443       192.168.100.131  55961     tcp            2\n",
      "35.163.3.77      443       192.168.100.131  56114     tcp            2\n",
      "46.51.254.183    443       192.168.100.131  56447     tcp            2\n",
      "50.97.40.233     443       192.168.100.131  56427     tcp            2\n",
      "72.21.91.42      443       192.168.100.131  56433     tcp            2\n",
      "74.125.200.154   443       192.168.100.131  56446     tcp            2\n",
      "151.101.193.6    443       192.168.100.131  56423     tcp            2\n",
      "169.54.129.27    443       192.168.100.131  56438     tcp            2\n",
      "                                            56439     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   13694     udp            2\n",
      "199.91.71.85     443       10.2.38.2        50360     tcp            2\n",
      "199.91.71.86     443       10.2.38.2        52788     tcp            2\n",
      "239.255.255.250  1900      192.168.100.96   35920     udp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        50003     tcp            2\n",
      "                           10.2.20.1        60904     tcp            2\n",
      "                           10.2.20.3        60854     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        43056     tcp            2\n",
      "104.192.136.114  443       192.168.100.16   51075     tcp            2\n",
      "199.91.71.85     443       10.2.38.2        50370     tcp            2\n",
      "216.58.216.14    443       192.168.100.176  53054     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.20.6        40482     tcp            2\n",
      "104.196.229.58  443       192.168.111.158  51587     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21       5672      10.2.254.49      48318     tcp            2\n",
      "10.12.0.31       80        10.2.1.20        50407     tcp            2\n",
      "                           10.2.20.6        40483     tcp            2\n",
      "10.12.87.1       443       192.168.100.40   50848     tcp            2\n",
      "                 2013      192.168.100.244  47399     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   17150     udp            2\n",
      "199.91.71.86     443       192.168.100.30   52584     tcp            2\n",
      "199.91.71.89     1194      192.168.100.24   54693     udp            2\n",
      "216.58.217.197   443       192.168.100.120  32781     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31      80        10.2.20.7        49625     tcp            2\n",
      "                                           49669     tcp            2\n",
      "10.12.68.7      6800      10.2.20.8        60638     tcp            2\n",
      "                6801      10.2.20.8        39031     tcp            2\n",
      "10.12.87.1      2013      192.168.100.240  42110     tcp            2\n",
      "104.196.229.58  443       192.168.111.158  51805     tcp            2\n",
      "199.91.71.86    443       10.2.38.2        39004     tcp            2\n",
      "216.58.217.197  443       192.168.100.120  34710     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.17.1        22        192.168.111.226  45480     tcp            2\n",
      "10.12.0.31       80        10.2.20.4        60616     tcp            2\n",
      "10.12.21.2       6801      10.2.20.8        40354     tcp            2\n",
      "                                            40478     tcp            2\n",
      "10.12.21.3       6803      10.2.20.8        33344     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8        55472     tcp            2\n",
      "                 6801      10.2.20.8        36483     tcp            2\n",
      "10.12.68.7       6800      10.2.20.8        60508     tcp            2\n",
      "                 6801      10.2.20.8        39012     tcp            2\n",
      "10.12.231.2      6801      10.2.20.8        37815     tcp            2\n",
      "                 6803      10.2.20.8        45428     tcp            2\n",
      "10.12.231.3      6801      10.2.20.8        53427     tcp            2\n",
      "104.192.136.114  443       192.168.111.158  51078     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip          src_port  ip_protocol\n",
      "10.12.0.21    5672      10.2.254.49     48318     tcp            2\n",
      "10.12.0.31    80        10.2.1.20       50412     tcp            2\n",
      "                        10.2.20.7       48468     tcp            2\n",
      "10.12.21.3    6803      10.2.20.8       33244     tcp            2\n",
      "10.12.41.1    3306      10.2.20.8       38723     tcp            2\n",
      "199.91.71.85  443       10.2.38.2       50438     tcp            2\n",
      "199.91.71.89  1194      192.168.100.24  34185     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.4        60626     tcp            2\n",
      "10.12.87.1       443       192.168.100.40   50828     tcp            2\n",
      "                                            50832     tcp            2\n",
      "                                            50844     tcp            2\n",
      "                                            50848     tcp            2\n",
      "                                            50852     tcp            2\n",
      "                                            50866     tcp            2\n",
      "                           192.168.111.66   40656     tcp            2\n",
      "                                            40658     tcp            2\n",
      "                                            40720     tcp            2\n",
      "                                            40730     tcp            2\n",
      "74.201.65.31     443       10.2.1.39        43647     tcp            2\n",
      "104.196.229.58   443       192.168.111.158  52029     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   55876     udp            2\n",
      "199.91.71.86     443       10.2.38.2        57760     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.4        60619     tcp            2\n",
      "                           10.2.20.6        40482     tcp            2\n",
      "74.201.65.30     443       10.2.1.39        40955     tcp            2\n",
      "                                            40956     tcp            2\n",
      "                                            40958     tcp            2\n",
      "136.147.41.226   443       192.168.100.188  36874     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   7679      udp            2\n",
      "199.91.71.85     1194      192.168.100.106  46697     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.21      5672      10.2.254.49      48318     tcp            2\n",
      "10.12.0.31      80        10.2.1.20        50410     tcp            2\n",
      "                          10.2.20.4        60618     tcp            2\n",
      "                          10.2.20.5        51044     tcp            2\n",
      "                          10.2.20.6        40481     tcp            2\n",
      "10.12.41.1      3306      10.2.20.8        38832     tcp            2\n",
      "10.12.87.1      8125      10.2.20.5        48476     udp            2\n",
      "                                           51906     udp            2\n",
      "                                           58480     udp            2\n",
      "10.12.231.3     6801      10.2.20.8        53404     tcp            2\n",
      "64.233.188.188  5228      192.168.100.123  34106     tcp            2\n",
      "199.91.71.85    443       192.168.100.93   44632     tcp            2\n",
      "                          192.168.100.239  58136     tcp            2\n",
      "199.91.71.89    443       192.168.100.70   58165     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39        22        192.168.111.86   55526     tcp            2\n",
      "                                            55527     tcp            2\n",
      "10.2.20.8        443       192.168.111.226  57072     tcp            2\n",
      "104.192.136.114  443       10.2.1.39        45504     tcp            2\n",
      "199.91.71.86     443       10.2.38.2        57967     tcp            2\n",
      "                                            57971     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip         dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.1.39      22        192.168.111.86   55549     tcp            2\n",
      "                                          55551     tcp            2\n",
      "10.12.21.2     6800      10.2.20.8        54364     tcp            2\n",
      "10.12.21.3     6800      10.2.20.8        52976     tcp            2\n",
      "                                          53010     tcp            2\n",
      "10.12.40.1     3306      10.2.20.8        53317     tcp            2\n",
      "10.12.68.6     6801      10.2.20.8        36414     tcp            2\n",
      "10.12.68.7     6800      10.2.20.8        60556     tcp            2\n",
      "               6801      10.2.20.8        38947     tcp            2\n",
      "10.12.84.1     3306      10.2.20.8        36888     tcp            2\n",
      "10.12.231.2    6801      10.2.20.8        37802     tcp            2\n",
      "10.12.231.3    6800      10.2.20.8        52755     tcp            2\n",
      "                                          52842     tcp            2\n",
      "               6801      10.2.20.8        53404     tcp            2\n",
      "54.244.120.65  443       192.168.100.131  56563     tcp            2\n",
      "74.201.65.30   443       10.2.1.39        41305     tcp            2\n",
      "199.91.71.89   443       10.2.38.2        51780     tcp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.17.1        443       192.168.111.226  52318     tcp            2\n",
      "10.12.21.2       6801      10.2.20.8        40364     tcp            2\n",
      "10.12.68.6       6800      10.2.20.8        55578     tcp            2\n",
      "                 6801      10.2.20.8        36452     tcp            2\n",
      "10.12.68.7       6801      10.2.20.8        38976     tcp            2\n",
      "10.12.231.2      6803      10.2.20.8        45402     tcp            2\n",
      "10.12.231.3      6801      10.2.20.8        53393     tcp            2\n",
      "                                            53427     tcp            2\n",
      "104.192.136.114  443       192.168.111.158  52297     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   50249     udp            2\n",
      "199.91.71.89     1194      192.168.100.106  36367     udp            2\n",
      "207.154.68.50    30233     192.168.100.183  2235      udp            2\n",
      "216.58.216.14    443       192.168.100.40   44876     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip        dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31    80        10.2.1.20  50003     tcp            2\n",
      "                        10.2.20.2  51271     tcp            2\n",
      "                        10.2.20.4  60057     tcp            2\n",
      "                        10.2.20.5  51156     tcp            2\n",
      "10.12.87.1    8125      10.2.1.20  39702     udp            2\n",
      "                                   39734     udp            2\n",
      "                                   45326     udp            2\n",
      "                        10.2.20.2  33793     udp            2\n",
      "                                   33794     udp            2\n",
      "                                   47350     udp            2\n",
      "                        10.2.20.4  40967     udp            2\n",
      "                                   45921     udp            2\n",
      "                                   54436     udp            2\n",
      "74.201.65.31  443       10.2.1.39  44367     tcp            2\n",
      "                                   44368     tcp            2\n",
      "                                   44369     tcp            2\n",
      "                                   44370     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip          dst_port  src_ip           src_port  ip_protocol\n",
      "10.2.33.4       443       192.168.111.46   57786     tcp            2\n",
      "10.12.0.31      80        10.2.20.7        49611     tcp            2\n",
      "10.12.230.4     22        192.168.100.40   48132     tcp            2\n",
      "64.233.189.139  443       192.168.100.15   34470     tcp            2\n",
      "74.201.65.30    443       10.2.1.39        41789     tcp            2\n",
      "                                           41794     tcp            2\n",
      "199.91.71.89    443       10.2.38.2        46150     tcp            2\n",
      "216.58.216.5    443       192.168.100.40   56775     udp            2\n",
      "216.58.216.14   443       192.168.100.176  53054     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.20.2        51703     tcp            2\n",
      "                           10.2.20.3        60864     tcp            2\n",
      "                           10.2.20.5        51158     tcp            2\n",
      "54.192.87.45     443       192.168.100.116  45072     tcp            2\n",
      "192.168.100.250  53        192.168.100.11   4072      udp            2\n",
      "199.91.71.86     443       10.2.38.2        39149     tcp            2\n",
      "239.255.255.250  1900      10.1.20.11       2438      udp            2\n",
      "                           192.168.100.40   51832     udp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip      dst_port  src_ip     src_port  ip_protocol\n",
      "10.12.0.31  80        10.2.20.4  60307     tcp            2\n",
      "                                 60618     tcp            2\n",
      "Name: src_tx, dtype: int64\n",
      "dst_ip           dst_port  src_ip           src_port  ip_protocol\n",
      "10.12.0.31       80        10.2.1.20        49135     tcp            2\n",
      "                           10.2.20.3        60861     tcp            2\n",
      "                           10.2.20.5        49915     tcp            2\n",
      "                                            51156     tcp            2\n",
      "10.12.87.1       8125      10.2.20.5        39453     udp            2\n",
      "                                            56794     udp            2\n",
      "                                            59177     udp            2\n",
      "52.8.76.33       443       192.168.100.188  60264     tcp            2\n",
      "173.194.202.188  5228      192.168.100.96   37062     tcp            2\n",
      "199.91.71.89     443       192.168.100.98   48101     tcp            2\n",
      "239.255.255.250  1900      192.168.100.96   47547     udp            2\n",
      "Name: src_tx, dtype: int64\n"
     ]
    }
   ],
   "source": [
    "# Number of entries per flow > 1\n",
    "for flow_list in DATA:\n",
    "    df = pd.DataFrame(flow_list)\n",
    "    gp1 = df.groupby(['dst_ip','src_ip'])\n",
    "    gp2 = df.groupby(['dst_ip', 'dst_port', 'src_ip', 'src_port', 'ip_protocol'])\n",
    "    # conns per flow\n",
    "    temp = gp2['src_tx'].count()\n",
    "    temp2 = temp[temp>1]\n",
    "    if len(temp2)>0:\n",
    "        print(temp2)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}