projects / pingpong.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: f3b9bcd)
Update pipeline: graph now maps IoT devices' MACs to hostnames or other MACs (if...
authorJanus Varmarken <varmarken@gmail.com>
Mon, 6 Nov 2017 07:45:31 +0000 (23:45 -0800)
committerJanus Varmarken <varmarken@gmail.com>
Mon, 6 Nov 2017 07:45:31 +0000 (23:45 -0800)
Changes:
- base_gefx_generator.py updated such that it considers MAC addresses instead of IPs and considers device-specific DNS queries for the IoT devices during graph construction.
- extract_from_tshark.py: updated to also include eth.src and eth.dst.
- parse_dns.py: corrected return value of hostname_for_ip_at_time such that the method simply returns the hostname instead of a tuple of timestamp and hostname.
- updated example json generated by extract_from_tshark.py
- added example gephi file generated by base_gefx_generator.py

base_gefx_generator.py patch | blob | history
extract_from_tshark.py patch | blob | history
generated-graph-sample.gexf [new file with mode: 0644] patch | blob
http.json patch | blob | history
parse_dns.py patch | blob | history

diff --git a/base_gefx_generator.py b/base_gefx_generator.py
index 4b8a275c907400b5c25a88a9e792859118f65710..703fe456bbcdc70e5b06546c9f946fa3316eca9b 100644 (file)
--- a/base_gefx_generator.py
+++ b/base_gefx_generator.py
@@ -17,14 +17,16 @@ import json
 import tldextract
 import networkx as nx
 import sys
+from decimal import *
 
 import parse_dns
 
+JSON_KEY_ETH_SRC = "eth.src"
+JSON_KEY_ETH_DST = "eth.dst"
+
 def parse_json(file_path):
 
-    maps_tuple = parse_dns.parse_json_dns("./dns.json")
-    hn_ip_map = maps_tuple[0]
-    ip_hn_map = maps_tuple[1]
+    device_dns_mappings = parse_dns.parse_json_dns("./dns.json")
 
     # Init empty graph
     G = nx.DiGraph() 
@@ -34,26 +36,60 @@ def parse_json(file_path):
         data = json.load(jf)
         # Loop through json objects in data
         for k in data:
-            #print "k is:",k
-            # Fetch source and destination IPs.
-            # Each of these become a Node in the Graph.
-            src_ip = data[k]["src_ip"]
-            dst_ip = data[k]["dst_ip"]
-
-            if dst_ip in ip_hn_map:
-                # hack to get first element in set
-                for e in ip_hn_map[dst_ip]:
-                    break
-                dst_ip = e
+            # Fetch timestamp of packet
+            packet_timestamp = Decimal(data[k]["ts"])
+            # Fetch eth source and destination info
+            eth_src = data[k][JSON_KEY_ETH_SRC]
+            eth_dst = data[k][JSON_KEY_ETH_DST]
+            # Traffic can be both outbound and inbound.
+            # Determine which one of the two by looking up device MAC in DNS map.
+            iot_device = None
+            if eth_src in device_dns_mappings:
+                iot_device = eth_src
+            elif eth_dst in device_dns_mappings:
+                iot_device = eth_dst
+            else:
+                print "[ WARNING: DNS mapping not found for device with MAC", eth_src, "OR", eth_dst, "]"
+                # This must be local communication between two IoT devices OR an IoT device talking to a hardcoded IP.
+                # For now let's assume local communication.
+                # Add a node for each device and an edge between them.
+                G.add_node(eth_src)
+                G.add_node(eth_dst)
+                G.add_edge(eth_src, eth_dst)
+                # TODO add regex check on src+dst IP to figure out if hardcoded server IP (e.g. check if one of the two are NOT a 192.168.x.y IP)
+                continue
+            # It is outbound traffic if iot_device matches src, otherwise it must be inbound traffic.
+            outbound_traffic = iot_device == eth_src
 
             ''' Graph construction '''
             # No need to check if the Nodes and/or Edges we add already exist:
             # NetworkX won't add already existing nodes/edges (except in the case of a MultiGraph or MultiDiGraph (see NetworkX doc)).
+            
             # Add a node for each host.
-            G.add_node(src_ip)
-            G.add_node(dst_ip)
-            # Connect these two nodes.
-            G.add_edge(src_ip, dst_ip)
+            # First add node for IoT device.
+            G.add_node(iot_device)
+            # Then add node for the server.
+            # For this we need to distinguish between outbound and inbound traffic so that we look up the proper IP in our DNS map.
+            # For outbound traffic, the server's IP is the destination IP.
+            # For inbound traffic, the server's IP is the source IP.
+            server_ip = data[k]["dst_ip"] if outbound_traffic else data[k]["src_ip"]
+            hostname = device_dns_mappings[iot_device].hostname_for_ip_at_time(server_ip, packet_timestamp)
+            if hostname is None:
+                # TODO this can occur when two local devices communicate OR if IoT device has hardcoded server IP.
+                # However, we only get here for the DNS that have not performed any DNS lookups
+                # We should use a regex check early in the loop to see if it is two local devices communicating.
+                # This way we would not have to consider these corner cases later on.
+                print "[ WARNING: no ip-hostname mapping found for ip", server_ip, " -- adding eth.src->eth.dst edge, but note that this may be incorrect if IoT device has hardcoded server IP ]"
+                G.add_node(eth_src)
+                G.add_node(eth_dst)
+                G.add_edge(eth_src, eth_dst)
+                continue
+            G.add_node(hostname)
+            # Connect the two nodes we just added.
+            if outbound_traffic:
+                G.add_edge(iot_device, hostname)
+            else:
+                G.add_edge(hostname, iot_device)
     return G
 
 # ------------------------------------------------------
diff --git a/extract_from_tshark.py b/extract_from_tshark.py
index 7c1270fda73c82dc19aa4aeec704c532255cfa3d..5704a975bbf891678e75533a2d435b52a597969d 100644 (file)
--- a/extract_from_tshark.py
+++ b/extract_from_tshark.py
@@ -36,6 +36,11 @@ json_key_frame_comment = json_key_frame + ".comment"
 json_key_frame_ts = json_key_frame + ".time_epoch"\r
 \r
 \r
+JSON_KEY_ETH = "eth"\r
+JSON_KEY_ETH_SRC = "eth.src"\r
+JSON_KEY_ETH_DST = "eth.dst"\r
+\r
+\r
 def make_unique(key, dct):\r
     counter = 0\r
     unique_key = key\r
@@ -103,6 +108,9 @@ def change_file(fpath):
                 # JV: Also include src so we can see what device initiates the traffic\r
                 new_packet["src_ip"] = layers[json_key_ip][json_key_ip + ".src"]\r
                 new_packet["src_port"] = int(layers[json_key_tcp][json_key_tcp + ".srcport"])\r
+                #JV: Also include eth soure/destination info so that we can map traffic to physical device using MAC\r
+                new_packet[JSON_KEY_ETH_SRC] = layers[JSON_KEY_ETH][JSON_KEY_ETH_SRC]\r
+                new_packet[JSON_KEY_ETH_DST] = layers[JSON_KEY_ETH][JSON_KEY_ETH_DST]\r
 \r
                 # Go through all HTTP fields and extract the ones that are needed\r
                 http_data = layers[json_key_http]\r
diff --git a/generated-graph-sample.gexf b/generated-graph-sample.gexf
new file mode 100644 (file)
index 0000000..33f9f54
--- /dev/null
+++ b/generated-graph-sample.gexf
@@ -0,0 +1,23 @@
+<?xml version='1.0' encoding='utf-8'?>
+<gexf version="1.2" xmlns="http://www.gexf.net/1.2draft" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/2001/XMLSchema-instance">
+  <graph defaultedgetype="directed" mode="static" name="">
+    <meta>
+      <creator>NetworkX 2.0</creator>
+      <lastmodified>05/11/2017</lastmodified>
+    </meta>
+    <nodes>
+      <node id="94:10:3e:36:60:09" label="94:10:3e:36:60:09" />
+      <node id="d0:52:a8:a3:60:0f" label="d0:52:a8:a3:60:0f" />
+      <node id="diagnostics.meethue.com" label="diagnostics.meethue.com" />
+      <node id="68:37:e9:d2:26:0d" label="68:37:e9:d2:26:0d" />
+      <node id="dcp.cpp.philips.com" label="dcp.cpp.philips.com" />
+      <node id="00:17:88:69:ee:e4" label="00:17:88:69:ee:e4" />
+    </nodes>
+    <edges>
+      <edge id="0" source="d0:52:a8:a3:60:0f" target="94:10:3e:36:60:09" />
+      <edge id="1" source="68:37:e9:d2:26:0d" target="00:17:88:69:ee:e4" />
+      <edge id="2" source="00:17:88:69:ee:e4" target="dcp.cpp.philips.com" />
+      <edge id="3" source="00:17:88:69:ee:e4" target="diagnostics.meethue.com" />
+    </edges>
+  </graph>
+</gexf>
diff --git a/http.json b/http.json
index a2a7cab3e8adb96c7ea5b699fc045ae629cd4ef9..59198719ef12dad8543003f0a812fd3479f0c38c 100644 (file)
--- a/http.json
+++ b/http.json
@@ -1,39 +1,11 @@
 {
-    "02af3368-8615-42f9-a447-9d35d93f28a5": {
-        "dst_ip": "130.211.67.12", 
-        "dst_port": 80, 
-        "headers": {
-            "connection": "close", 
-            "content-type": "text/plain", 
-            "host": "diagnostics.meethue.com:80", 
-            "transfer-encoding": "chunked"
-        }, 
-        "host": "diagnostics.meethue.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 54159, 
-        "ts": "1508461977.224826000", 
-        "uri": "/bridges/fullconfig?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=e11f3860cfb5d8a0e502583853950fb6&auth=f66de122ea23c53e85a152b1be18131517dddef7"
-    }, 
-    "0351ec36-aa0f-4bdd-8d7f-159452a97217": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56792, 
-        "ts": "1508485432.565257000", 
-        "uri": "/description.xml"
-    }, 
-    "0b6f4155-be4c-4697-b146-f55ead4d22c6": {
+    "0018c361-c05b-462b-80fd-924d0d90110f": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"72\", Nonce=\"jwevBP0xoV+uF9UI3sJnlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"GCdNlUt1IhjIKFkIuQ8V8g==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"74\", Nonce=\"5uz+9xSbrsC2F9UIj3EnlQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"U77HA2bdom8FQeQHHjOBKw==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -42,15 +14,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45237, 
-        "ts": "1508499204.343328000", 
+        "src_port": 45243, 
+        "ts": "1508502803.048797000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "0b805495-a5f7-45cf-943f-86dfad5b0906": {
+    "06c3f251-5dd2-429f-840c-7cee46775c08": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"76\", Nonce=\"Txncu/KW2yK/F9UIeTMGug==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Fn/fJIlXLMbcdiZ27pWNwQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"51\", Nonce=\"IDqv9WAPICxSF9UIgYzuNQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"HO0GNANgmPqD3EsKDz11CQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -59,15 +33,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45249, 
-        "ts": "1508506403.694917000", 
+        "src_port": 45175, 
+        "ts": "1508463201.902797000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "0ccf92be-de36-4e8a-8858-eadcd6182ba3": {
+    "109a8616-e01e-47b1-a381-dc10de5c50a1": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"73\", Nonce=\"D/VVU+4V91+uF9UIMimHoA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"wTYNVcjDJuYaIlqPvDbd+Q==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"67\", Nonce=\"OeXj2KpCdTmVF9UIH/fp1g==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"v7WnBnxyc0rL6zBViUZt3Q==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -76,15 +52,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45242, 
-        "ts": "1508502802.629928000", 
+        "src_port": 45224, 
+        "ts": "1508492002.667066000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "10eb6435-6cd8-406b-88df-1a74e5152123": {
+    "1146dff1-5bec-4a75-a7be-8e0607e2d79b": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"53\", Nonce=\"Aj6ghgnkEo1aF9UIkdJNZQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"9OaGG6mRlwNym3ixwA9ivw==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"59\", Nonce=\"IIRRXKWHaLNzF9UIafRhqA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Mb84RTuO7v9NBZI4u2KVow==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -93,47 +71,47 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45181, 
-        "ts": "1508466802.518608000", 
+        "src_port": 45199, 
+        "ts": "1508477602.251054000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "18d15d28-6ffe-43a6-bc34-6022b099b033": {
-        "dst_ip": "5.79.62.93", 
+    "17203fc4-cc9c-4ddc-b75d-828dadcd5707": {
+        "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"54\", Nonce=\"RnQj4ESU6O5iF9UIGxlBuw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"lFHZk7Y9NuBYpbyswcoUZw==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
+            "accept": "*/*", 
+            "host": "192.168.0.160"
         }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45182, 
-        "ts": "1508466802.939248000", 
-        "uri": "/DcpRequestHandler/index.ashx"
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56971, 
+        "ts": "1508500993.884194000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "27f323cc-3efc-44e5-ab71-e10b6d797067": {
-        "dst_ip": "5.79.62.93", 
+    "1d146b55-7395-435d-8e03-d8747f6fc3ca": {
+        "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"64\", Nonce=\"WIGvypHsZdiMF9UIrliQWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"uf13Jx8s/eL7BiklzmuutQ==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
+            "accept": "*/*", 
+            "host": "192.168.0.160"
         }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45213, 
-        "ts": "1508484804.000058000", 
-        "uri": "/DcpRequestHandler/index.ashx"
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56611, 
+        "ts": "1508469852.249587000", 
+        "uri": "/description.xml"
     }, 
-    "2d55fe59-1d4b-49b5-b108-b0cee23de5c3": {
+    "1ea946a4-e4a6-4fa5-927e-4603e47d6251": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -141,13 +119,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56542, 
-        "ts": "1508463914.840072000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56609, 
+        "ts": "1508469851.936530000", 
+        "uri": "/description.xml"
     }, 
-    "2df150de-2b5c-49fe-af90-3407c81510ea": {
+    "1f73b3b1-a13d-499c-8df9-32873a7c340e": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -155,15 +135,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56538, 
-        "ts": "1508463913.265019000", 
-        "uri": "/description.xml"
+        "src_port": 56968, 
+        "ts": "1508500992.947109000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "32e78fdb-cba2-4258-ade5-c703f152cf08": {
+    "21088abf-df7d-45e8-a028-edd22a383f65": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"51\", Nonce=\"IDqv9WAPICxSF9UIgYzuNQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"HO0GNANgmPqD3EsKDz11CQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"63\", Nonce=\"0n/qkGVhjHaEF9UIbD9C0w==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"a7dKjQVsYpg5YH/p9UfqmQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -172,15 +154,33 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45175, 
-        "ts": "1508463201.902797000", 
+        "src_port": 45212, 
+        "ts": "1508484803.583720000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "3ca184d2-fcbd-4ddd-9194-9fca3f918418": {
+    "215520aa-f1ea-4129-83c5-155fa84aa219": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56701, 
+        "ts": "1508477534.895063000", 
+        "uri": "/description.xml"
+    }, 
+    "297939f9-7e43-48ba-b44c-f05d590fac2f": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"55\", Nonce=\"LDg3BhU5Mu9iF9UIehwGlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"yoodQRhNNMKwd6zmaU7QuA==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"72\", Nonce=\"jwevBP0xoV+uF9UI3sJnlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"GCdNlUt1IhjIKFkIuQ8V8g==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -189,15 +189,33 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45187, 
-        "ts": "1508470403.122955000", 
+        "src_port": 45237, 
+        "ts": "1508499204.343328000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "3fd44243-9913-4942-96f1-5433b6d7ba24": {
+    "2aa32fd9-ca8e-4ec4-9ef7-0e56a508ce51": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56538, 
+        "ts": "1508463913.265019000", 
+        "uri": "/description.xml"
+    }, 
+    "2cecaffd-d363-401d-9b6f-1ca89d2b350b": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"78\", Nonce=\"z9B2roxq4oTHF9UICymJ7Q==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"okPL+Sx5SKAgjONdFT54nQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"60\", Nonce=\"T8McgxJ9HBR8F9UIHQxr3A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"pB8wKvl1l7ugOuNTTS9oxQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -206,13 +224,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45255, 
-        "ts": "1508510004.140691000", 
+        "src_port": 45200, 
+        "ts": "1508477602.669084000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "4047fa78-c64f-42f6-90f5-a3434120a873": {
+    "2f197b06-d092-427f-a92a-ba9b247e73d6": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -220,13 +240,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56701, 
-        "ts": "1508477534.895063000", 
+        "src_port": 57055, 
+        "ts": "1508509044.965021000", 
         "uri": "/description.xml"
     }, 
-    "4a66ba94-c4c9-4fa6-840d-a3e3a05c604a": {
+    "3010efcb-45f8-43fc-9443-8a3ba838ee9f": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -238,9 +260,11 @@
         "ts": "1508463914.137918000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "4de03a45-b16a-46aa-b6b3-77a5089003fc": {
+    "3236af6d-4542-4257-9087-bafcbbdb5de9": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -248,13 +272,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57063, 
-        "ts": "1508509046.116595000", 
+        "src_port": 56879, 
+        "ts": "1508493119.264807000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "4e749246-241c-49c9-9842-0e0192971657": {
+    "3acd5f57-061a-474b-bb89-5b65f5e549d3": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -262,15 +288,33 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56700, 
-        "ts": "1508477534.717225000", 
+        "src_port": 57062, 
+        "ts": "1508509045.921481000", 
+        "uri": "/description.xml"
+    }, 
+    "3c1ba96c-4e39-439b-9ada-e6c66f6e0e7f": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 57072, 
+        "ts": "1508509214.456013000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "4f71ad00-32db-4efd-b74d-8731b65b88ea": {
+    "3f95a4d2-9586-430c-a002-616896328da3": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"71\", Nonce=\"LtIwGyrkvv2lF9UIdFDgLg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"jTrgvKNNbcTEqXRajrcYKQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"57\", Nonce=\"UKDWAA1aUlFrF9UItdlMsw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PdwZCCElcnhZG70H7kTWtg==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -279,15 +323,35 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45236, 
-        "ts": "1508499203.924411000", 
+        "src_port": 45193, 
+        "ts": "1508474003.675549000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "56441672-3494-4124-8a49-dcc11e0185e9": {
+    "4b7c4441-ee52-4167-a7e3-f9b196e31cf2": {
+        "dst_ip": "130.211.67.12", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "connection": "close", 
+            "content-type": "text/plain", 
+            "host": "diagnostics.meethue.com:80", 
+            "transfer-encoding": "chunked"
+        }, 
+        "host": "diagnostics.meethue.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 54159, 
+        "ts": "1508461977.224826000", 
+        "uri": "/bridges/fullconfig?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=e11f3860cfb5d8a0e502583853950fb6&auth=f66de122ea23c53e85a152b1be18131517dddef7"
+    }, 
+    "503b740d-2377-4ab3-b1c0-318522744453": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"58\", Nonce=\"rSl/kVJvL7NzF9UIfuR6vQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"F1ymgtXGLgEjjsJtNRm7jQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"55\", Nonce=\"LDg3BhU5Mu9iF9UIehwGlA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"yoodQRhNNMKwd6zmaU7QuA==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -296,31 +360,68 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45194, 
-        "ts": "1508474004.097958000", 
+        "src_port": 45187, 
+        "ts": "1508470403.122955000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "574fe230-c43a-44bb-9955-2edc23f820a7": {
-        "dst_ip": "130.211.67.12", 
+    "515d8cf7-1847-4ac5-a62d-9fb279703109": {
+        "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56697, 
+        "ts": "1508477533.624722000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+    }, 
+    "5247061a-0a8d-4bc5-a7a5-71f86862d3e1": {
+        "dst_ip": "5.79.62.93", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"66\", Nonce=\"bSBJ+8tVRzmVF9UI+DCyBw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rLf0EDCXW2dxHEFY/c0lzg==\"", 
             "connection": "close", 
-            "content-type": "text/plain", 
-            "host": "diagnostics.meethue.com:80", 
-            "transfer-encoding": "chunked"
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
         }, 
-        "host": "diagnostics.meethue.com:80", 
+        "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 54196, 
-        "ts": "1508483525.057124000", 
-        "uri": "/bridges/ws/stats?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=aa75654336d2f72df5b22d857fe4e512&auth=c0692053fa23c4a9704396bc516c1287a38e4b38"
+        "src_port": 45219, 
+        "ts": "1508488402.457324000", 
+        "uri": "/DcpRequestHandler/index.ashx"
+    }, 
+    "54753c2d-6229-405d-8cbd-b54c2d464099": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56612, 
+        "ts": "1508469853.385023000", 
+        "uri": "/description.xml"
     }, 
-    "58583350-165f-4297-b7fd-3c2be4a007b2": {
+    "562394f8-b1da-4002-9ad4-822c09bee722": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"56\", Nonce=\"87rYprWmElFrF9UIyB2bjQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"5oOnGRHc4VVgOtmTGnSXSw==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"52\", Nonce=\"+prNMq//zoxaF9UIAX4cmA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PD/HP4NMadOITSv65W1NVQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -329,13 +430,101 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45188, 
-        "ts": "1508470403.541300000", 
+        "src_port": 45176, 
+        "ts": "1508463202.320736000", 
+        "uri": "/DcpRequestHandler/index.ashx"
+    }, 
+    "58c45fe4-76f3-4b37-a318-32c55384cc82": {
+        "dst_ip": "5.79.62.93", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"65\", Nonce=\"YbFoE9OcpdiMF9UI5i3Sxg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"2+jvV9CpnWbrY7RxSfhszw==\"", 
+            "connection": "close", 
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
+        }, 
+        "host": "dcp.cpp.philips.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 45218, 
+        "ts": "1508488402.036753000", 
+        "uri": "/DcpRequestHandler/index.ashx"
+    }, 
+    "5d624b10-ff7e-4134-a095-ebb132041283": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56537, 
+        "ts": "1508463913.049301000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+    }, 
+    "5fc69874-d257-4986-8e73-81fe63d58a58": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56970, 
+        "ts": "1508500993.744272000", 
+        "uri": "/description.xml"
+    }, 
+    "6134fa96-2d71-4749-ab82-c9680631966d": {
+        "dst_ip": "5.79.62.93", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"49\", Nonce=\"pjd9TR/COapKF9UIvgMIbg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"cWIdFvlc1zTaM1lRh+sG1w==\"", 
+            "connection": "close", 
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
+        }, 
+        "host": "dcp.cpp.philips.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 45168, 
+        "ts": "1508459603.327754000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "5a36c038-ab16-42a7-8a92-e051fc29df26": {
+    "640baacd-ba1a-46ba-925f-1e7459564989": {
+        "dst_ip": "192.168.0.160", 
+        "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
+        "headers": {
+            "accept": "*/*", 
+            "host": "192.168.0.160"
+        }, 
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56539, 
+        "ts": "1508463913.918475000", 
+        "uri": "/description.xml"
+    }, 
+    "6518d1b2-1015-4ec9-95ee-77e9830e115a": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -343,13 +532,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57072, 
-        "ts": "1508509214.456013000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56878, 
+        "ts": "1508493119.118306000", 
+        "uri": "/description.xml"
     }, 
-    "631545b3-7c36-4ad4-8d3b-9c8aa14e50e2": {
+    "6a4d30ba-1446-4921-84c1-fbbbf1a4f6e1": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -357,13 +548,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56968, 
-        "ts": "1508500992.947109000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56794, 
+        "ts": "1508485432.979175000", 
+        "uri": "/description.xml"
     }, 
-    "636f0722-62c3-4f4e-83c1-7ec8d620017f": {
+    "6a7f595a-e223-45b3-97cc-48cad9d7c548": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -371,13 +564,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57074, 
-        "ts": "1508509215.329645000", 
+        "src_port": 57073, 
+        "ts": "1508509214.519479000", 
         "uri": "/description.xml"
     }, 
-    "6bb39ff4-f7e9-463c-94cd-0e13ab0eca7a": {
+    "6cb61e21-61f1-4d86-8211-f8e52362755f": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -385,15 +580,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56611, 
-        "ts": "1508469852.249587000", 
+        "src_port": 56788, 
+        "ts": "1508485431.641818000", 
         "uri": "/description.xml"
     }, 
-    "6f229ab4-8132-42e2-9658-e64ecb9e38c1": {
+    "6ce7eecd-fadf-45e2-9cea-fdd76d667be6": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"60\", Nonce=\"T8McgxJ9HBR8F9UIHQxr3A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"pB8wKvl1l7ugOuNTTS9oxQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"53\", Nonce=\"Aj6ghgnkEo1aF9UIkdJNZQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"9OaGG6mRlwNym3ixwA9ivw==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -402,13 +599,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45200, 
-        "ts": "1508477602.669084000", 
+        "src_port": 45181, 
+        "ts": "1508466802.518608000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "702258db-014c-4c3f-ac22-67940cf1d86d": {
+    "6de21d41-d0c9-4504-bb60-86479bdd0d1f": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -416,27 +615,34 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56969, 
-        "ts": "1508500993.623407000", 
+        "src_port": 57071, 
+        "ts": "1508509214.280691000", 
         "uri": "/description.xml"
     }, 
-    "705b3baf-1ac5-46c3-83f2-ae5f9dac8bb4": {
-        "dst_ip": "192.168.0.160", 
+    "6eac540f-2617-4caf-a777-158fa155a7e2": {
+        "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"54\", Nonce=\"RnQj4ESU6O5iF9UIGxlBuw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"lFHZk7Y9NuBYpbyswcoUZw==\"", 
+            "connection": "close", 
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
         }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56794, 
-        "ts": "1508485432.979175000", 
-        "uri": "/description.xml"
+        "host": "dcp.cpp.philips.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 45182, 
+        "ts": "1508466802.939248000", 
+        "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "78c7c99a-8694-487c-bdf7-64573690af95": {
+    "706cc9e4-06a0-4260-a5fb-d1e5846b15fd": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -444,13 +650,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57073, 
-        "ts": "1508509214.519479000", 
-        "uri": "/description.xml"
+        "src_port": 56613, 
+        "ts": "1508469853.515797000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "7d02be24-50a2-4e6e-9fec-997049827cbc": {
+    "73768ca9-ada0-4930-9be5-a4ae242bc6e3": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -458,13 +666,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56793, 
-        "ts": "1508485432.751765000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56698, 
+        "ts": "1508477533.627907000", 
+        "uri": "/description.xml"
     }, 
-    "7d448a67-5b17-4613-ae05-a4fcda00c918": {
+    "75b2f21d-cafb-4fa2-a1be-86c8da9b7b9c": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -476,9 +686,11 @@
         "ts": "1508477533.470368000", 
         "uri": "/description.xml"
     }, 
-    "7e6a70a8-08c6-434b-84a4-0e7153e69400": {
+    "773114f0-2158-4484-9905-0b2c23357138": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -486,15 +698,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56791, 
-        "ts": "1508485432.224563000", 
+        "src_port": 56881, 
+        "ts": "1508493120.171827000", 
         "uri": "/description.xml"
     }, 
-    "8101743c-9fd0-4ef5-b5e8-fbe5665f35c0": {
+    "7a7d63cd-9a64-4c22-943c-2ff539fb0713": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"57\", Nonce=\"UKDWAA1aUlFrF9UItdlMsw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PdwZCCElcnhZG70H7kTWtg==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"50\", Nonce=\"HYIu7st62itSF9UI1C0tnw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"AIJFnUuBeCAhSJwsSPPIJA==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -503,13 +717,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45193, 
-        "ts": "1508474003.675549000", 
+        "src_port": 45169, 
+        "ts": "1508459603.745723000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "82da1531-bfb3-4ecb-9144-578b595c3eb7": {
+    "7bbe7675-bca6-480c-8b4c-372cfb412b65": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -517,15 +733,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56878, 
-        "ts": "1508493119.118306000", 
-        "uri": "/description.xml"
+        "src_port": 56700, 
+        "ts": "1508477534.717225000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "84f2828f-4c25-43ae-bdd0-8889e8c8565b": {
+    "7c0eac67-4f15-4fce-8443-ef89c391060b": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"66\", Nonce=\"bSBJ+8tVRzmVF9UI+DCyBw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rLf0EDCXW2dxHEFY/c0lzg==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"70\", Nonce=\"w0E1Ikptdv2lF9UIt96XtA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"ZbLS0OUJ3WJY/VmOWlIEQg==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -534,32 +752,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45219, 
-        "ts": "1508488402.457324000", 
+        "src_port": 45231, 
+        "ts": "1508495603.618857000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "865d9d50-7ca4-4cc4-bb95-bd4ca5ccc517": {
-        "dst_ip": "192.168.0.226", 
-        "dst_port": 49153, 
-        "headers": {
-            "content-length": "277", 
-            "content-type": "text/xml; charset=\"utf-8\"", 
-            "host": "192.168.0.226:49153", 
-            "soapaction": "\"urn:Belkin:service:basicevent:1#GetBinaryState\"", 
-            "user-agent": "CyberGarage-HTTP/1.0"
-        }, 
-        "host": "192.168.0.226:49153", 
-        "method": "POST", 
-        "src_ip": "192.168.0.243", 
-        "src_port": 51912, 
-        "ts": "1508472514.240077000", 
-        "uri": "/upnp/control/basicevent1"
-    }, 
-    "86657adb-fdea-46ef-b73d-0fca66ef111e": {
+    "80a3ebbb-6983-406f-8bfa-4c0e9ccca1f7": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"74\", Nonce=\"5uz+9xSbrsC2F9UIj3EnlQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"U77HA2bdom8FQeQHHjOBKw==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"73\", Nonce=\"D/VVU+4V91+uF9UIMimHoA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"wTYNVcjDJuYaIlqPvDbd+Q==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -568,15 +771,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45243, 
-        "ts": "1508502803.048797000", 
+        "src_port": 45242, 
+        "ts": "1508502802.629928000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "889c274f-c89b-444b-9561-8129efdec4c2": {
+    "80ca0244-6b0d-4b4c-9672-c0e4d82ba48e": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"70\", Nonce=\"w0E1Ikptdv2lF9UIt96XtA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"ZbLS0OUJ3WJY/VmOWlIEQg==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"61\", Nonce=\"wrIsdgJIWhR8F9UIx6Nk6A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rMFjUBkfbR8k+XM4J0Nk+A==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -585,27 +790,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45231, 
-        "ts": "1508495603.618857000", 
+        "src_port": 45205, 
+        "ts": "1508481202.944385000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "8a1c85a6-ff64-4400-8786-9463930871ea": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57071, 
-        "ts": "1508509214.280691000", 
-        "uri": "/description.xml"
-    }, 
-    "8a61488b-64e8-47cd-b228-b4ceacb4e8d7": {
+    "8404af06-b8d8-4276-aea8-fee733250922": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -613,13 +806,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57055, 
-        "ts": "1508509044.965021000", 
+        "src_port": 56880, 
+        "ts": "1508493119.423201000", 
         "uri": "/description.xml"
     }, 
-    "8ac211a0-fe22-4b55-a4f4-9de139b7df8e": {
+    "87e491e1-d4e0-4248-8172-fa71bfbd2625": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -627,15 +822,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56609, 
-        "ts": "1508469851.936530000", 
+        "src_port": 56966, 
+        "ts": "1508500992.697184000", 
         "uri": "/description.xml"
     }, 
-    "9bef0b14-4c04-4732-b1f8-10c612369bdb": {
+    "8b7dcd6a-c592-42c6-8749-433f748ff589": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"62\", Nonce=\"BdKCsHaZQHaEF9UI5C5bWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"hZf/7zl4u0jeRzps/5PXjA==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"77\", Nonce=\"v6de2RSqHCO/F9UIB9IETQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Y2KkPRoOd5rN1bo4Bru7XQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -644,43 +841,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45206, 
-        "ts": "1508481203.365353000", 
+        "src_port": 45254, 
+        "ts": "1508510003.723787000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "a1da7cdb-0fea-4036-8fcb-87136ff53cab": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56541, 
-        "ts": "1508463914.706660000", 
-        "uri": "/description.xml"
-    }, 
-    "a63e4867-f2d8-4fd1-afd1-4e579e205914": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56788, 
-        "ts": "1508485431.641818000", 
-        "uri": "/description.xml"
-    }, 
-    "aa76670d-02c4-492b-93c7-84273fe3d4c4": {
+    "902ca1cf-b791-4fdd-bc7c-63eda786335d": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"49\", Nonce=\"pjd9TR/COapKF9UIvgMIbg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"cWIdFvlc1zTaM1lRh+sG1w==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"69\", Nonce=\"O2nbMFG4qpudF9UI9et8gQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rE4BCqqoV5ApwZlmkzLx/A==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -689,13 +860,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45168, 
-        "ts": "1508459603.327754000", 
+        "src_port": 45230, 
+        "ts": "1508495603.198446000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "ab05e8ab-722e-4d4f-b152-f6a1f2624942": {
+    "94ca8be3-3c28-4fae-93da-2bdf41621ad0": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -703,13 +876,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56882, 
-        "ts": "1508493120.316778000", 
+        "src_port": 57061, 
+        "ts": "1508509045.209972000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "acf4d525-98af-4763-bc68-e440a452eaab": {
+    "995abfd5-ed0b-4d4d-a9fe-1c09fb7f0baa": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -717,47 +892,31 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56971, 
-        "ts": "1508500993.884194000", 
+        "src_port": 56793, 
+        "ts": "1508485432.751765000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "b04880cc-2d0c-4527-8131-3cd9784ca01e": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"75\", Nonce=\"8tOzN9657sC2F9UIl3ayqQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"OZk4/yc2TQeK7ph0tAkojA==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45248, 
-        "ts": "1508506403.275265000", 
-        "uri": "/DcpRequestHandler/index.ashx"
-    }, 
-    "b14255b0-4a74-41c3-8742-6e2f0cee7660": {
-        "dst_ip": "5.79.62.93", 
+    "9aa6333b-b72b-455a-8135-c75c0c81ae72": {
+        "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"59\", Nonce=\"IIRRXKWHaLNzF9UIafRhqA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Mb84RTuO7v9NBZI4u2KVow==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
+            "accept": "*/*", 
+            "host": "192.168.0.160"
         }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45199, 
-        "ts": "1508477602.251054000", 
-        "uri": "/DcpRequestHandler/index.ashx"
+        "host": "192.168.0.160", 
+        "method": "GET", 
+        "src_ip": "192.168.0.227", 
+        "src_port": 56702, 
+        "ts": "1508477535.050616000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "b791ec19-599b-42ba-a2ae-089ebbefb1bb": {
+    "9b7c2e45-6897-47f5-a3ac-60a88fd71525": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -765,13 +924,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56615, 
-        "ts": "1508469854.003616000", 
+        "src_port": 56610, 
+        "ts": "1508469852.190570000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "bc4573ba-130c-4cf0-8a10-7badbcf30f73": {
+    "a12bb9fa-49ec-4969-b687-18567f93d8a8": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -779,13 +940,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56970, 
-        "ts": "1508500993.744272000", 
+        "src_port": 57065, 
+        "ts": "1508509046.706024000", 
         "uri": "/description.xml"
     }, 
-    "bfe7758d-cd12-4747-b291-a825a5545c14": {
+    "a1305724-ce2b-4ec0-96a1-56ffdada2782": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -793,13 +956,34 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56795, 
-        "ts": "1508485433.142029000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56791, 
+        "ts": "1508485432.224563000", 
+        "uri": "/description.xml"
+    }, 
+    "a4464775-d8d8-44fc-9215-94a4bfb5c26d": {
+        "dst_ip": "5.79.62.93", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"76\", Nonce=\"Txncu/KW2yK/F9UIeTMGug==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Fn/fJIlXLMbcdiZ27pWNwQ==\"", 
+            "connection": "close", 
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
+        }, 
+        "host": "dcp.cpp.philips.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 45249, 
+        "ts": "1508506403.694917000", 
+        "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "c1303f0d-16e2-4563-8860-59917ab4b310": {
+    "a61dd83c-6989-4559-9039-363dbeb54ab9": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -807,15 +991,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56537, 
-        "ts": "1508463913.049301000", 
+        "src_port": 56542, 
+        "ts": "1508463914.840072000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "c7bf2ac6-7668-458e-93ca-2faf1d1c6a19": {
+    "a9ce3646-8671-4c44-a14e-47a38d0a32e0": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"65\", Nonce=\"YbFoE9OcpdiMF9UI5i3Sxg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"2+jvV9CpnWbrY7RxSfhszw==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"56\", Nonce=\"87rYprWmElFrF9UIyB2bjQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"5oOnGRHc4VVgOtmTGnSXSw==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -824,13 +1010,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45218, 
-        "ts": "1508488402.036753000", 
+        "src_port": 45188, 
+        "ts": "1508470403.541300000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "c84e3fb8-6bef-49b7-9144-950292db7d7e": {
+    "acd1abe3-3f2e-4656-8847-5c3213277d11": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -838,13 +1026,34 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56539, 
-        "ts": "1508463913.918475000", 
-        "uri": "/description.xml"
+        "src_port": 56882, 
+        "ts": "1508493120.316778000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+    }, 
+    "bc134e48-ab13-4e58-b132-dd6435f3ac2b": {
+        "dst_ip": "5.79.62.93", 
+        "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
+        "headers": {
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"71\", Nonce=\"LtIwGyrkvv2lF9UIdFDgLg==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"jTrgvKNNbcTEqXRajrcYKQ==\"", 
+            "connection": "close", 
+            "content-length": "1328", 
+            "content-type": "application/CB-Encrypted; cipher=AES", 
+            "host": "dcp.cpp.philips.com:80"
+        }, 
+        "host": "dcp.cpp.philips.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 45236, 
+        "ts": "1508499203.924411000", 
+        "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "c93448ef-3756-4717-9e99-db8c982d63cb": {
+    "bd3385cb-97f2-43ba-9639-b92249b43a20": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -852,13 +1061,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56698, 
-        "ts": "1508477533.627907000", 
-        "uri": "/description.xml"
+        "src_port": 57063, 
+        "ts": "1508509046.116595000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "cf5a011c-08a4-4867-8780-99807b6d9202": {
+    "bffb106d-cfe8-4a1c-9f23-33fbd2d5e217": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -866,13 +1077,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56880, 
-        "ts": "1508493119.423201000", 
+        "src_port": 56969, 
+        "ts": "1508500993.623407000", 
         "uri": "/description.xml"
     }, 
-    "d0d7a004-380d-48e1-8044-3769dcf94932": {
+    "c0838e3b-834e-413b-bcb8-d259b10616d1": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -884,11 +1097,13 @@
         "ts": "1508509215.520208000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "d1554124-637e-4eae-af3d-27bc78aeb043": {
+    "cacaff93-4fc0-4d24-a0db-83a437c22f8f": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"63\", Nonce=\"0n/qkGVhjHaEF9UIbD9C0w==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"a7dKjQVsYpg5YH/p9UfqmQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"64\", Nonce=\"WIGvypHsZdiMF9UIrliQWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"uf13Jx8s/eL7BiklzmuutQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -897,13 +1112,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45212, 
-        "ts": "1508484803.583720000", 
+        "src_port": 45213, 
+        "ts": "1508484804.000058000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "d1e4b5a6-0618-4e54-9b60-7b7d7a486100": {
+    "cb89a141-47e7-48e2-86bb-998e956c390a": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -911,27 +1128,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57062, 
-        "ts": "1508509045.921481000", 
+        "src_port": 56614, 
+        "ts": "1508469853.818103000", 
         "uri": "/description.xml"
     }, 
-    "d3b8625a-ed7e-415f-acc6-979a40992b43": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57066, 
-        "ts": "1508509046.856076000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "dac77d90-24aa-4e76-9638-79583117ad18": {
+    "d798cc2e-b848-416a-ae9f-0feb5c5cc83a": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -939,15 +1144,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56702, 
-        "ts": "1508477535.050616000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 57074, 
+        "ts": "1508509215.329645000", 
+        "uri": "/description.xml"
     }, 
-    "dcb6a56e-675f-45f1-832e-c9e2fe13a389": {
+    "db713a11-86ca-4903-bf03-78c056424a33": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"61\", Nonce=\"wrIsdgJIWhR8F9UIx6Nk6A==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rMFjUBkfbR8k+XM4J0Nk+A==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"68\", Nonce=\"pedBaQkJYZudF9UICPNNyA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rXzU3PkJXq66quYxt4dR0w==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -956,13 +1163,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45205, 
-        "ts": "1508481202.944385000", 
+        "src_port": 45225, 
+        "ts": "1508492003.083641000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "dd112fdb-7aa7-4186-b4a9-ab79f44bdfee": {
+    "de22dff6-4385-4c1b-9c0e-647784497294": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -970,13 +1179,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56879, 
-        "ts": "1508493119.264807000", 
+        "src_port": 56795, 
+        "ts": "1508485433.142029000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "dd1b8cf7-b8c1-4ba9-8560-00e76d8fb58d": {
+    "df5bcd9f-f274-4fff-b318-27fb659b6f59": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -984,13 +1195,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57065, 
-        "ts": "1508509046.706024000", 
+        "src_port": 57064, 
+        "ts": "1508509046.116540000", 
         "uri": "/description.xml"
     }, 
-    "ddf802e0-d1f6-4417-b8b4-9fd517ba4fb5": {
+    "e3d19c2c-b137-4756-919c-f70036e6ee04": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -998,29 +1211,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56790, 
-        "ts": "1508485431.919622000", 
+        "src_port": 56615, 
+        "ts": "1508469854.003616000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "e2f32c2c-dff6-4420-b64c-ed8446121c6c": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56966, 
-        "ts": "1508500992.697184000", 
-        "uri": "/description.xml"
-    }, 
-    "e4c21926-118c-4f66-ba1d-1da579be5243": {
+    "e600104e-fbe8-4319-9d84-ca08047efd0f": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"77\", Nonce=\"v6de2RSqHCO/F9UIB9IETQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"Y2KkPRoOd5rN1bo4Bru7XQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"75\", Nonce=\"8tOzN9657sC2F9UIl3ayqQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"OZk4/yc2TQeK7ph0tAkojA==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -1029,13 +1230,15 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45254, 
-        "ts": "1508510003.723787000", 
+        "src_port": 45248, 
+        "ts": "1508506403.275265000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "e6112204-b70b-4e59-8a44-745930dd927e": {
+    "e9139b55-7c4d-407f-aaeb-b4e748a066a3": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1043,29 +1246,17 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56614, 
-        "ts": "1508469853.818103000", 
+        "src_port": 56792, 
+        "ts": "1508485432.565257000", 
         "uri": "/description.xml"
     }, 
-    "e81a19c7-0688-4cd7-9399-b01771a4b9c4": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56697, 
-        "ts": "1508477533.624722000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
-    }, 
-    "e83e79f3-a707-405a-85e7-bad1dd6f4999": {
+    "e9557ac5-4e07-4514-a804-1b0a69b99036": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"52\", Nonce=\"+prNMq//zoxaF9UIAX4cmA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"PD/HP4NMadOITSv65W1NVQ==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"62\", Nonce=\"BdKCsHaZQHaEF9UI5C5bWQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"hZf/7zl4u0jeRzps/5PXjA==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -1074,15 +1265,17 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45176, 
-        "ts": "1508463202.320736000", 
+        "src_port": 45206, 
+        "ts": "1508481203.365353000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "f212fe3c-e29c-4442-abc8-6544acf1b063": {
+    "ed359f08-9716-46e9-b242-fa0a7ad74b32": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"67\", Nonce=\"OeXj2KpCdTmVF9UIH/fp1g==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"v7WnBnxyc0rL6zBViUZt3Q==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"58\", Nonce=\"rSl/kVJvL7NzF9UIfuR6vQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"F1ymgtXGLgEjjsJtNRm7jQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -1091,29 +1284,35 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45224, 
-        "ts": "1508492002.667066000", 
+        "src_port": 45194, 
+        "ts": "1508474004.097958000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "f28684ad-3949-4944-8ef5-9e1252360f8c": {
-        "dst_ip": "192.168.0.160", 
+    "edbec7e3-ab76-4c3d-92cf-afbf3a717665": {
+        "dst_ip": "130.211.67.12", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
+            "connection": "close", 
+            "content-type": "text/plain", 
+            "host": "diagnostics.meethue.com:80", 
+            "transfer-encoding": "chunked"
         }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56612, 
-        "ts": "1508469853.385023000", 
-        "uri": "/description.xml"
+        "host": "diagnostics.meethue.com:80", 
+        "method": "POST", 
+        "src_ip": "192.168.0.160", 
+        "src_port": 54196, 
+        "ts": "1508483525.057124000", 
+        "uri": "/bridges/ws/stats?sso=91c2b44e0cc2e21ed49576ab6732c15b5c8a86e5f4211feb4a1e9a086dddf9d2663e7c6b035a33b43dd98c6168842c6bbed4f84f8ba27cb6e6593dc3de07a2909c62693157c503a676c182a44daf78ddae30900de525cad753035de299958db2121a4284346b74371c889cfc5df609cb33d126e3051871163f5d767a9d53b72ae6e8901db39b90d2247db5cb734db1b8f18c37bfc23ed6091359629f8c68074ea0d7377c6da7b5b88bccda18a2e137e29f0bab89d64d94c2524b639e5712061b&i=aa75654336d2f72df5b22d857fe4e512&auth=c0692053fa23c4a9704396bc516c1287a38e4b38"
     }, 
-    "f3a85fff-5014-4f54-b825-27791d326dd1": {
+    "ee7a172f-4939-42b3-90c4-f14569632c3d": {
         "dst_ip": "5.79.62.93", 
         "dst_port": 80, 
+        "eth.dst": "b0:b9:8a:73:69:8e", 
+        "eth.src": "00:17:88:69:ee:e4", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"50\", Nonce=\"HYIu7st62itSF9UI1C0tnw==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"AIJFnUuBeCAhSJwsSPPIJA==\"", 
+            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"78\", Nonce=\"z9B2roxq4oTHF9UICymJ7Q==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"okPL+Sx5SKAgjONdFT54nQ==\"", 
             "connection": "close", 
             "content-length": "1328", 
             "content-type": "application/CB-Encrypted; cipher=AES", 
@@ -1122,58 +1321,34 @@
         "host": "dcp.cpp.philips.com:80", 
         "method": "POST", 
         "src_ip": "192.168.0.160", 
-        "src_port": 45169, 
-        "ts": "1508459603.745723000", 
+        "src_port": 45255, 
+        "ts": "1508510004.140691000", 
         "uri": "/DcpRequestHandler/index.ashx"
     }, 
-    "f662028a-cca4-4d30-8453-20a0d9476671": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 57064, 
-        "ts": "1508509046.116540000", 
-        "uri": "/description.xml"
-    }, 
-    "f792bc49-1048-4829-a57f-a62cfbd9025b": {
-        "dst_ip": "192.168.0.160", 
-        "dst_port": 80, 
-        "headers": {
-            "accept": "*/*", 
-            "host": "192.168.0.160"
-        }, 
-        "host": "192.168.0.160", 
-        "method": "GET", 
-        "src_ip": "192.168.0.227", 
-        "src_port": 56536, 
-        "ts": "1508463912.908377000", 
-        "uri": "/description.xml"
-    }, 
-    "f80f72a4-d5d9-43df-9540-c5fdf697cb2c": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
+    "f1b63783-f5dd-4a48-ad04-40b447f2adf7": {
+        "dst_ip": "192.168.0.226", 
+        "dst_port": 49153, 
+        "eth.dst": "94:10:3e:36:60:09", 
+        "eth.src": "d0:52:a8:a3:60:0f", 
         "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"68\", Nonce=\"pedBaQkJYZudF9UICPNNyA==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rXzU3PkJXq66quYxt4dR0w==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
+            "content-length": "277", 
+            "content-type": "text/xml; charset=\"utf-8\"", 
+            "host": "192.168.0.226:49153", 
+            "soapaction": "\"urn:Belkin:service:basicevent:1#GetBinaryState\"", 
+            "user-agent": "CyberGarage-HTTP/1.0"
         }, 
-        "host": "dcp.cpp.philips.com:80", 
+        "host": "192.168.0.226:49153", 
         "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45225, 
-        "ts": "1508492003.083641000", 
-        "uri": "/DcpRequestHandler/index.ashx"
+        "src_ip": "192.168.0.243", 
+        "src_port": 51912, 
+        "ts": "1508472514.240077000", 
+        "uri": "/upnp/control/basicevent1"
     }, 
-    "fa25640c-56aa-4c32-9ed5-8ee1fce08034": {
+    "f8607e7e-d759-4f28-95c4-9cb58fa19e67": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1181,13 +1356,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56613, 
-        "ts": "1508469853.515797000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56541, 
+        "ts": "1508463914.706660000", 
+        "uri": "/description.xml"
     }, 
-    "fbcd6a04-d740-4a3a-9e3d-aa1d29e30ccb": {
+    "fa94b3a9-8cbd-4782-a151-a274592aeeb4": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1195,13 +1372,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56610, 
-        "ts": "1508469852.190570000", 
-        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
+        "src_port": 56536, 
+        "ts": "1508463912.908377000", 
+        "uri": "/description.xml"
     }, 
-    "feb3148f-1f50-459a-acc2-be94e63f0d87": {
+    "fb58b8af-4bd8-443f-a9b1-9143aca25692": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1209,13 +1388,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56881, 
-        "ts": "1508493120.171827000", 
+        "src_port": 56699, 
+        "ts": "1508477534.524516000", 
         "uri": "/description.xml"
     }, 
-    "ff359b9b-b9a5-4fa3-9cc9-e1a3d74243bc": {
+    "fc44d4d5-0fff-4c2a-b246-1a3a2c162409": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1223,30 +1404,15 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 56699, 
-        "ts": "1508477534.524516000", 
-        "uri": "/description.xml"
-    }, 
-    "ff36d109-a217-4cb2-980e-445c84186644": {
-        "dst_ip": "5.79.62.93", 
-        "dst_port": 80, 
-        "headers": {
-            "authorization": "CBAuth Type=\"SSO\", Client=\"001788fffe69eee4\", RequestNr=\"69\", Nonce=\"O2nbMFG4qpudF9UI9et8gQ==\", SSOToken=\"kcK0TgzC4h7UlXarZzLBW1yKhuX0IR/rSh6aCG3d+dJmPnxrA1oztD3ZjGFohCxrvtT4T4uifLbmWT3D3geikJxiaTFXxQOmdsGCpE2veN2uMJAN5SXK11MDXeKZlY2yEhpChDRrdDcciJz8XfYJyzPRJuMFGHEWP112ep1Ttyrm6JAds5uQ0iR9tctzTbG48Yw3v8I+1gkTWWKfjGgHTqDXN3xtp7W4i8zaGKLhN+KfC6uJ1k2UwlJLY55XEgYb\", Authentication=\"rE4BCqqoV5ApwZlmkzLx/A==\"", 
-            "connection": "close", 
-            "content-length": "1328", 
-            "content-type": "application/CB-Encrypted; cipher=AES", 
-            "host": "dcp.cpp.philips.com:80"
-        }, 
-        "host": "dcp.cpp.philips.com:80", 
-        "method": "POST", 
-        "src_ip": "192.168.0.160", 
-        "src_port": 45230, 
-        "ts": "1508495603.198446000", 
-        "uri": "/DcpRequestHandler/index.ashx"
+        "src_port": 56790, 
+        "ts": "1508485431.919622000", 
+        "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }, 
-    "ff5c5a1a-8894-45b6-888c-aeca3b933780": {
+    "fe685706-cfaa-4b66-9959-1fe78bbbd89a": {
         "dst_ip": "192.168.0.160", 
         "dst_port": 80, 
+        "eth.dst": "00:17:88:69:ee:e4", 
+        "eth.src": "68:37:e9:d2:26:0d", 
         "headers": {
             "accept": "*/*", 
             "host": "192.168.0.160"
@@ -1254,8 +1420,8 @@
         "host": "192.168.0.160", 
         "method": "GET", 
         "src_ip": "192.168.0.227", 
-        "src_port": 57061, 
-        "ts": "1508509045.209972000", 
+        "src_port": 57066, 
+        "ts": "1508509046.856076000", 
         "uri": "/api/tXLok71AFLlKq8tlwKvgitpHa0q-QAxYppxwDf4j/lights"
     }
 }
\ No newline at end of file
diff --git a/parse_dns.py b/parse_dns.py
index e81fd95e3477519f42599846987a1ed4a0e9e7ca..831b075bd31f2053d0bda9ea78c88a79332a16ac 100644 (file)
--- a/parse_dns.py
+++ b/parse_dns.py
@@ -82,7 +82,8 @@ class DeviceDNSMap:
                                # t is a better fit if it happened BEFORE the input timestamp
                                # and is LATER than the current best_fit
                                best_fit = t
-               return best_fit
+               # return the matching hostname
+               return best_fit[1]
 
        def add_mapping(self, ip, timestamp_hostname_tuple):
                self.ip_mappings[ip].append(timestamp_hostname_tuple)
PingPong 1.0: packet-level signatures extractor and detector.