Flow 1 risky: tcp 10.0.0.1:1637 -> 10.0.0.2:21477