Flow 1 risky: tcp 172.16.2.185:52494 -> 192.168.2.142:3389