Flow 2 risky: tcp 10.1.3.143:32804 -> 10.1.6.18:1232
Flow 5 midstream: tcp 17.2.0.124:3032 -> 17.2.0.122:1720